Privacy notice

Who we are

LegionellaWise is operated by O&J Studio Ltd., Clyde Offices, 48 West George Street, Glasgow, G2 1BP. We are the data controller for the account and property records you create in the service. For privacy questions, contact privacy@legionellawise.com.

What we collect

• Account details: your name, email address, password hash and the competence declaration you make.
• Property records: address, property type, occupancy status and the manager contact you choose to record.
• Assessment content: your answers, room and outlet register, temperature readings, notes and findings.
• Photo evidence: the images you upload, plus a stripped derivative used for display and reports.
• Service data: sign-in events, email delivery status and error logs needed to keep the service working.

Why we can use it

• Contract: creating your account, running assessments and producing your reports.
• Legitimate interests: keeping the service secure, preventing abuse and improving usability using non-identifying analytics.
• Consent: optional marketing email, which you can withdraw at any time in Settings.

Photos and image metadata

Photos are stored in private storage and are never publicly listed. Where a photo carries capture metadata we record only a safe subset — capture time, device and software — and generate a stripped derivative for use in reports.

Location data is not displayed, exported or retained in the report. If metadata is missing we label it clearly as unavailable rather than inferring anything about the photo.

People about whom you record data

The service is designed to avoid occupant personal data. We do not ask for tenant names, contact details or medical information. Where susceptibility is relevant, only a neutral yes/no risk-relevant flag is recorded, with no health detail.

Who processes data on our behalf

Processors act only on our instructions under written terms. Data is hosted in the UK or the European Economic Area, or under appropriate safeguards where a processor operates elsewhere.

• Cloud application hosting and content delivery.
• Managed database, authentication and private file storage.
• Transactional email delivery for verification, reset and reminder messages.
• Payment processing, when paid plans are enabled — card details never reach our servers.
• Error and performance monitoring, which receives technical diagnostics only.

Analytics

We measure how the service is used with our own first-party events. Those events record an action name, a random session identifier, the page pattern, a coarse device class and, where relevant, a plan tier or outcome band. They never contain names, addresses, email addresses, report content, report references or share links.

How long we keep it

Retention periods are published in full in our retention schedule. In short: finalised reports and their evidence are kept for the period stated there so you can rely on your records, and closed accounts are deleted or anonymised after the stated window.

Your rights

To exercise a right, email privacy@legionellawise.com. We respond within one month.

• Access a copy of your personal data.
• Correct inaccurate account or property details.
• Delete your account, subject to records we must keep to operate the service.
• Object to or restrict processing, and withdraw marketing consent.
• Complain to the Information Commissioner's Office (or the Data Protection Commission in Ireland).

Cookies and similar technology

We use strictly necessary storage to keep you signed in and to hold a random analytics session identifier for the length of your browser session. We do not use advertising cookies or third-party tracking pixels.