Privacy notice

Last updated 9 October 2026 · Version 1.1 (in the app, the short version is called privacy-3). The version history is at the end.

The short version

• Your records, documents and journeys stay on your phone, locked with your passphrase. There is no Taxdose account.
• We don't see your records. We don't sell data, show adverts or track you across other apps.
• AI reading is optional. If you ask AI to read a hard document, we black out your personal details on your phone first, show you exactly what will go, and send only those pictures. You agree once, then confirm each document.
• Apple or Google take your payments, not us.
• Please don't add documents that contain patient information.
• You can object, withdraw, ask for a copy or ask us to delete what our server holds. If you're unhappy with how we've handled your information, complain to us first (section 15). We'll acknowledge it within 30 days. You can also go to the ICO.
• Taxdose is for adults only. It isn't meant for anyone under 18.

1. Who we are

Taxdose is made by Praelion Ltd ("we", "us"). We're a company registered in England and Wales, company number 17209225. Our registered office is First Floor, Swan Buildings, 20 Swan Street, Manchester, M4 5JW, United Kingdom.

We're the data controller for the information described in sections 5 and 6, and for our website (section 5.5). We can't see the records on your phone (section 3), so you're in control of those.

• ICO registration number: ZC149009
• Privacy questions: privacy@praelion.com
• Everything else: hello@praelion.com
• Data protection officer: we aren't required to have one, so we don't. Our privacy contact above deals with every privacy question.

2. What Taxdose is

Taxdose helps UK doctors keep their tax records in order and prepare drafts of a P87 claim or a Self Assessment return. You check each draft and send it to HMRC yourself. Taxdose never sends anything to HMRC.

3. What stays on your phone

Almost everything Taxdose handles stays on your phone and never reaches us:

• the documents and photos you add (payslips, P60s, invoices, receipts, statements);
• the figures read from them, your answers and your edits;
• your drafts and the PDFs made from them;
• your mileage journeys and where they went;
• your settings, and "Your choices" (what you agreed to, and when).

How it's protected. Your records sit in an encrypted database on the phone. Its key is locked with your passphrase. If you turn on Face ID, Touch ID or fingerprint unlock, the phone's secure hardware keeps a copy of the key for that phone only. Nobody, including us, can reset your passphrase or recover your records without it.

Phone backups. We leave Taxdose's records out of iCloud and Google device backups on purpose. To keep a copy, make an encrypted Taxdose backup (see section 8).

Reading documents. Taxdose reads documents on your phone. On phones that have one, an AI model built into the phone (for example Apple's on-device model) helps with hard layouts. Nothing leaves the phone for this.

What the app stores on your phone. Taxdose stores information on your phone only to do what you ask of it: your records, your settings, the unlock key, and the sign-in it uses for AI reading. It has no advertising IDs, analytics or tracking. Because this storage is strictly necessary for the service you asked for, the law doesn't require a separate cookie-style consent for it.

4. Permissions Taxdose asks for

Location, in more detail

• Taxdose records location only between the start and end of a journey, or until the journey stops by itself because the phone hasn't moved for a while.
• Locations stay on your phone. We never receive them. Journeys only count once you've reviewed them.
• iPhone: a journey you start in the app keeps recording while the phone is locked, using "While Using" access (you'll see the blue location indicator). Taxdose asks for "Always" only if you turn on one-tap journeys (Siri, widgets, Control Centre or car automations). With one-tap on, anyone holding your unlocked phone can start or end a journey.
• Android: Taxdose doesn't ask for background location ("Allow all the time"). Each journey runs from a screen you can see, with an ongoing notification and an End button.

5. What we hold, and why

If you never use AI reading, we hold nothing about you, apart from emails you send us and the short-term logs any website keeps when you visit it. If you do use AI reading, this is what our server keeps. It comes from your phone, except the subscription and device checks, which also come from Apple or Google (sections 5.1 and 5.2).

Do you have to give it? No. AI reading is optional. If you don't agree to it, nothing is sent and the rest of Taxdose works as usual.

We don't store the pictures, the text on them or the figures the AI reads. We don't store your name, email, NI number, tax reference, address, date of birth or bank details. As a backstop, our server also removes anything in the AI's reply that looks like an NI number, tax reference, sort code, account number or card number.

Logs. Our server writes short technical notes about each request: a request number, the result, how long it took, the number of pages, the cost and the kind of document. They never contain anything from your documents. Our hosting provider also keeps short-term logs of the requests reaching our server, which can include your IP address and device details. We use these only to keep the service secure and working. Lawful basis: legitimate interests (keeping our network and systems secure).

5.1 Checking your subscription for AI reading

Taxdose checks your subscription on your phone. To give your phone its AI page allowance, the app can also send our server the proof of purchase that Apple or Google gave your phone. Our server checks it with Apple or Google. We keep:

• the store's reference for the purchase (for Apple, the original transaction number; for Google, a one-way fingerprint of the purchase token, never the token itself);
• the product, the expiry date, and whether it's a test purchase;
• which random IDs it's linked to.

Apple or Google may also tell our server when that subscription renews, ends or is refunded, so the allowance stays right. We use this to apply your allowance, and to stop one subscription unlocking unlimited phones (up to 5 phones share one subscription's 200 pages). Lawful basis: contract. We never receive your Apple ID, Google account, card or address.

5.2 Protecting the service from misuse

To stop abuse of AI reading, the app can ask Apple (App Attest) or Google (Play Integrity) to confirm it's a genuine copy of Taxdose on a real device. We keep the result and, on iPhone, a device key reference, linked to your random ID. This doesn't identify you. Lawful basis: legitimate interests (keeping the service secure and affordable).

5.3 If you email us

If you email us, we keep your email address and what you send while we help you, and for up to 2 years after our last reply, in case you come back to us. Lawful basis: legitimate interests (answering you). Please don't send us your documents or any patient information.

5.4 On your phone, for your subscription

Taxdose keeps a count of the PDFs you've made on your phone, because your first PDF is free. It travels with your encrypted backups and never reaches us.

5.5 Our website

www.taxdose.co.uk sets no cookies and has no analytics, advertising or tracking. Like any website, our hosting provider (Vercel) handles your IP address and browser details to deliver the pages and protect the site, and keeps short-term logs. Lawful basis: legitimate interests (running a secure website). If you email us from the website, section 5.3 applies.

6. AI reading in detail

AI reading is optional and part of Taxdose Pro. You can use all of Taxdose without it. How AI reading works explains it step by step, with the exact wording you agree to.

• Only when you ask. It's offered only for a document your phone couldn't read well. Nothing is sent until you tap "Send to AI", one document at a time.
• What is sent: pictures of up to 4 pages of that document, and nothing else. No text is sent.
• What is blacked out first, on your phone: names (yours, other people's, employers' and practices'), addresses and postcodes, your National Insurance number, tax and PAYE references, payroll and other reference numbers, bank account numbers, sort codes, IBANs and card numbers, email addresses, phone numbers, web addresses, NHS and GMC numbers, dates of birth and other dates that could be one, sick, maternity and other statutory pay lines, and signatures and handwriting. Amounts and tax codes stay visible, because that's what AI needs to read.
• Checked twice. Blacking out is automatic and can miss something. So Taxdose reads each outgoing picture again and won't send a page where it can still see one of your identifiers. Then it shows you exactly the pictures that will go, so you can cancel.
• Who reads it: the pictures go to our server, hosted by Supabase in London, which passes them to OpenAI. Both act for us as processors, under contract.
  • OpenAI may process the pictures in the United States.
  • OpenAI doesn't use them to train its models. We ask it not to store them as part of the request.
  • OpenAI may keep them for up to 30 days to check for misuse, then deletes them. Pictures its safety checks flag may be kept longer for review.
• Always checked by you. AI suggestions are marked "Read by AI · check it" and never count until you confirm them.
• Lawful basis: your consent. If a page happens to show something sensitive about you, such as a trade-union subscription, you give your explicit consent to it being read only to find your figures.
• Withdrawing. Tap "Withdraw and stop sending" in Settings › Your choices. Nothing new is sent after that. A reading already under way at that moment may still finish. Values the AI already read stay in your records until you change them.
• Allowance. Taxdose Pro includes up to 200 AI pages per tax year (6 April to 5 April), as fair use.

7. Patient information and sensitive data

Taxdose is for your own tax records. Please don't add documents that identify patients, and never send them for AI reading. If a document shows patient details, black them out before adding it, or leave it out.

We don't set out to handle sensitive data, such as health information, religious beliefs or trade-union membership. Some financial documents can reveal it by accident, for example a BMA subscription or a sick pay line on a payslip. Taxdose blacks out sick, maternity and other statutory pay lines before sending, but can't recognise everything. If you send such a page for AI reading, it's handled under your explicit consent, only to read the figures, and nothing from it is kept on our server.

On your phone, this information stays in your encrypted records, which we can't see.

8. Backups and files you share

• Encrypted backups are files you make and save wherever you choose (Files, iCloud Drive, Google Drive, a computer). They're locked with a passphrase. We never receive them.
• PDFs, mileage spreadsheets and other exports go wherever you send them. Once shared, that app or service looks after them, not us.

9. Who else is involved

We don't sell data or share it for advertising. Taxdose contains no advertising, analytics or crash-reporting tools.

Sending data outside the UK. Our server and database are in London. OpenAI may process page pictures in the United States. Supabase and Vercel are US companies, and they or their sub-processors may access our hosted data from outside the UK to run the service. In each case we rely on the UK International Data Transfer Addendum to the standard contractual clauses in each company's data processing agreement. You can ask us for a copy of the relevant safeguards at privacy@praelion.com.

10. How long we keep things

11. Your rights

Under UK data protection law you have the right to:

• be told how your data is used (this notice);
• get a copy of your data;
• have it corrected;
• have it deleted;
• restrict how it's used;
• move it to another service;
• withdraw your consent at any time. This doesn't affect what happened before.

Your right to object. Where we rely on legitimate interests (agreement records, misuse and security checks, logs and emails), you can object at any time, for reasons to do with your situation. We'll stop unless we have strong legitimate grounds to carry on, or need the information for a legal claim. Email privacy@praelion.com.

Most of your data is on your phone, so you can see, export, correct and delete it yourself.

For what our server holds:

• Delete it: Delete all data in Settings asks our server to delete what it holds for your random ID. Deleting your data explains exactly what happens.
• Anything else: email privacy@praelion.com. We don't know who you are, so please include your random ID from Settings › Your choices. Without it we can't find your records.
• We keep your agreement records even after a deletion request, for the time in section 10, because they're our proof of what you agreed to.

We reply within one month. If a request is complex, we may need up to two more months, and we'll tell you why within the first month. There's no charge in most cases. We'll make a reasonable and proportionate search for your information.

Automated decisions. Taxdose makes no decisions about you with legal or similarly significant effects. AI and on-phone reading only suggest figures for you to check. Automatic limits (your page allowance, daily limits and misuse checks) can pause AI reading. If you think that's wrong, email us and a person will look at it.

12. Children

Taxdose is for qualified doctors working in the UK. It isn't meant for anyone under 18, isn't designed for or marketed to children, and we don't knowingly hold children's data.

13. Security

• Records are encrypted on the phone, with a key protected by your passphrase.
• Connections to our server use HTTPS.
• The app can't reach our database directly. Every request is checked first.
• Agreement records can't be edited or deleted through the service. Each one is chained to the one before, so changes would show, and your phone keeps its own receipt of each.
• Spending and usage limits stop runaway use.

No system is perfectly secure. If a breach affects you and is likely to put you at risk, we'll tell you and the ICO, as the law requires.

14. Changes to this notice

If we change this notice in a way that matters, Taxdose will show you the new version before you carry on. Your phone keeps a record of each version you've seen and agreed to, in Settings › Your choices. Smaller changes (clearer wording, new contact details) are listed in the version history below.

15. Questions and complaints

Questions: email privacy@praelion.com.

Complaining to us. If you're unhappy with how we've used your information, please tell us first. We'll do our best to put things right.

1. Email privacy@praelion.com, with "Complaint" in the subject. Say what went wrong and, if it's about what our server holds, include your random ID from Settings › Your choices.
2. We'll acknowledge your complaint within 30 days, and usually within a few working days.
3. We'll look into it without undue delay, keep you updated, and tell you the outcome and what we've done about it.

Complaining to the ICO. If you're not happy with our answer, or you don't want to come to us first, you can complain to the Information Commissioner's Office (ICO): ico.org.uk/make-a-complaint, or call 0303 123 1113. The ICO usually expects you to have raised it with us first.

16. Version history