RC Timeline
Real Care Timeline
Privacy Policy
RC Timeline (Real Care Timeline) — Last updated: 18 July 2026
This Privacy Policy explains how Colin Laffan (“we”, “us”, “our”) collects, uses, and protects your personal data when you use the RC Timeline app (“the App”). We take your privacy seriously, particularly given the sensitive nature of the care records this App is designed to hold.
If you have any questions, contact us at laffaner@gmail.com.
1. Who We Are
RC Timeline is an iOS and iPadOS app developed and operated by Colin Laffan, an independent software developer. The App is designed to help parents and carers record and organise care events for their dependants.
For the purposes of UK and EU data protection law, Colin Laffan is the data controller.
2. Data We Collect
Account data
- Email address — used to create and identify your account. If you sign in with Apple, we receive a verified email address (or an Apple-relayed address if you choose to hide your email).
Care records you create
- Subjects — the name, date of birth, optional profile photo, and notes you enter for each person you are tracking care for.
- Timeline events — event title, date, event type, organisation, professional name, and notes you enter for each care event.
- Documents — files (photos, PDFs) you attach to events. These are stored in your private cloud storage.
Automatically collected data
- Crash reports — if the App crashes, an anonymised crash report is sent automatically. This includes device type, iOS version, and a stack trace but does not include your care records or personal details.
- Usage events — anonymised usage signals such as app opened, event created, document uploaded, and scan initiated. No care record content is included in these signals.
Data collected when using AI extraction
When you use the document scan feature, the text extracted from your document (via on-device OCR) is sent to an AI service to pre-fill an event form. If you have entered a subject name in the App, that name may also be sent to improve extraction accuracy. See Third-Party Services for details.
2. How We Use Your Data
| Purpose | Data used | Legal basis |
|---|---|---|
| Creating and managing your account | Email address | Contract performance |
| Storing and displaying your care records | Subjects, events, documents | Contract performance |
| Pre-filling event forms from scanned documents | OCR text, subject name | Consent (you initiate the scan) |
| Diagnosing crashes and fixing bugs | Crash reports | Legitimate interests |
| Understanding how the App is used to improve it | Anonymised usage events | Legitimate interests |
3. Third-Party Services
We use the following third-party services to operate the App:
| Service | Purpose | Data sent | Location |
|---|---|---|---|
| Supabase | Authentication, database, and file storage | Email address, care records, documents | EU (AWS eu-west-1) |
| Sentry | Crash reporting | Anonymised crash reports (device type, iOS version, stack trace) | EU |
| PostHog | Usage analytics | Anonymised usage events (no care record content) | EU (eu.i.posthog.com) |
| Anthropic (Claude AI) | AI extraction of care event data from scanned documents | OCR text of scanned document; optionally, subject name | United States |
Supabase, Sentry, and PostHog all process data within the EU. Anthropic processes data in the United States. Where data is transferred outside the UK or EU, we rely on Standard Contractual Clauses or equivalent safeguards.
Links to each provider’s privacy policy:
4. Data Storage and Security
Your care records are stored in a private Supabase database protected by Row Level Security — only your account can read or write your data. Documents are stored in private Supabase Storage with equivalent access controls.
Your session token is stored in the iOS Keychain with the kSecAttrAccessibleWhenUnlockedThisDeviceOnly attribute, meaning it cannot be backed up to iCloud or accessed when the device is locked.
The App implements jailbreak detection and will not operate on compromised devices.
5. Data Retention
Your data is retained for as long as your account is active. You can delete your account at any time from the Profile screen in the App, which permanently and irreversibly deletes all your care records, documents, and account data from our servers.
6. Children’s Data
RC Timeline is used by parents and carers to record information about their dependants — it is not directed at children and children do not use it directly. We do not knowingly collect personal data directly from children under 13. If you believe we have inadvertently received such data, please contact us at laffaner@gmail.com.
7. Your Rights
Under UK GDPR and EU GDPR you have the right to:
- Access — request a copy of the personal data we hold about you.
- Rectification — correct inaccurate data (most data can be edited directly in the App).
- Erasure — delete your account and all associated data (available directly in the App via Profile → Delete Account).
- Data portability — receive your data in a structured, machine-readable format.
- Restriction — ask us to restrict processing of your data in certain circumstances.
- Object — object to processing based on legitimate interests.
- Withdraw consent — withdraw consent for AI extraction at any time by not using the scan feature.
To exercise any of these rights, contact us at laffaner@gmail.com. We will respond within 30 days.
8. Data Protection Complaints (Users in the United Kingdom)
If you are in the United Kingdom and have a concern about how we handle your personal data, you can contact us directly at laffaner@gmail.com and we will do our best to resolve it.
You also have the right to lodge a complaint with the UK supervisory authority:
Information Commissioner’s Office (ICO)
Website: ico.org.uk/make-a-complaint
Helpline: 0303 123 1113
This clause is required under the UK Data (Use and Access) Act 2025, which came into force on 19 June 2026.
9. Users in the European Union
If you are in the EU, you have the same rights as listed in Section 7 under the General Data Protection Regulation (GDPR). You may lodge a complaint with your local EU data protection authority if you believe your rights have been infringed.
10. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via a notice in the App. The “Last updated” date at the top of this page will always reflect the current version.
11. Contact
For any privacy-related questions or requests:
Colin Laffan
laffaner@gmail.com