Privacy Policy

This policy explains how Fleuve Ltd (“Fleuve”, “we”, “us”) handles personal data. It covers two different situations, which is deliberate - the two are legally different and it's important not to blur them:

• This website. When you browse fleuve.co.uk or submit our contact form, Fleuve is the data controller of that information.
• School Medical by Fleuve. When a school uses our software, the school is the data controller of pupil, parent, and staff data entered into the platform, and Fleuve acts only as a data processor, acting on the school's instructions under a data processing agreement.

If you're a parent, pupil, or member of school staff with a question about how a specific school is using your data within School Medical, that request should go to the school directly, as the data controller. We'll always support the school in responding, as their processor.

1. Who we are

Fleuve Ltd, a company registered in England & Wales under company number [COMPANY REGISTRATION NUMBER], with its registered office at [REGISTERED OFFICE ADDRESS].

For any privacy query, contact us at info@fleuve.co.uk.

2. Website data we collect

When you use this website, we may collect:

• Contact form submissions - your name, email address, school (if given), phone number (if given), and message.
• Basic technical data collected automatically by our hosting infrastructure (such as IP address and browser type) for security and reliability purposes.

We do not currently use analytics or advertising cookies on this website. See our Cookie Policy for full detail.

3. How we use website data, and our legal basis

We use contact form submissions to respond to your enquiry, which is necessary for our legitimate interest in running our business and communicating with people who contact us (UK GDPR Article 6(1)(f)). Where you've enquired about becoming a customer, we may also rely on taking steps prior to entering into a contract (Article 6(1)(b)).

4. School Medical by Fleuve - data processed on behalf of schools

As a processor, we process personal data - including special category data such as pupil medical and health information - strictly on the instructions of the school (the controller), for the purpose of providing the School Medical platform. This includes data such as pupil health centre visits, incident reports, medicine administration records, and related contact and staff information.

We do not use school or pupil data for our own purposes (such as marketing, or to train any third-party AI model) beyond what is necessary to operate, maintain, and support the platform.

5. Who we share data with

We use a small number of carefully chosen sub-processors to run our infrastructure. All are bound by contractual data protection obligations consistent with UK GDPR:

• Supabase (database and authentication hosting, EU West region).
• Vercel (application hosting).
• Resend (transactional email delivery).
• Microsoft (single sign-on authentication, where a school enables it).
• Wonde (school management information system sync, where a school enables it).

A full, current list of sub-processors used for School Medical is available on request to schools we work with.

6. International transfers

We aim to keep personal data within the UK/EU wherever possible. Where a sub-processor involves a transfer outside the UK, we ensure an appropriate safeguard is in place, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or another lawful transfer mechanism recognised under UK GDPR.

7. How long we keep data

Website contact form submissions are retained only as long as necessary to handle your enquiry, and are deleted or anonymised thereafter. For School Medical, retention periods for pupil and school data are configured by each school, in line with their own record retention obligations, and are detailed in our data processing agreement with that school.

8. Security

We apply role-based access control, encryption in transit, audit logging of access to sensitive records, and regular internal security review to data processed through School Medical. A summary of our security measures is available to schools on request.

9. Your rights

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Have inaccurate data corrected.
• Have data erased, in certain circumstances.
• Restrict or object to certain processing.
• Receive your data in a portable format, in certain circumstances.

For website-related data, contact us directly at info@fleuve.co.uk to exercise these rights. For data held within School Medical, please contact the relevant school directly, as they are the data controller.

You also have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk.

10. Children's data

We recognise that School Medical processes data belonging to children. Schools, as data controllers, are responsible for establishing the appropriate lawful basis for processing pupil data (including any parental consent requirements) and for providing appropriate privacy information to parents and pupils. We support schools in meeting these obligations as their processor.

11. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by an updated date at the top of this page.