Privacy Policy

SmartLPA Ltd is the “data controller” responsible for your personal data.

• Company: SmartLPA Ltd, a company registered in England and Wales, company number 17309200.
• ICO registration: [ICO REGISTRATION NUMBER]. (As a UK organisation processing personal data, SmartLPA Ltd is registered with the Information Commissioner’s Office.)
• Contact for privacy matters: support@smartlpa.co.uk.

We are not required to appoint a statutory Data Protection Officer, but the contact above is responsible for overseeing data protection at SmartLPA.

SmartLPA is a document-preparation and checking tool. We help you prepare and review Lasting Power of Attorney (“LPA”) forms for England and Wales, and we run an automated check against the Office of the Public Guardian’s (“OPG”) requirements.

We are not a law firm and do not provide legal advice. We do not submit your LPA to the OPG on your behalf. Our role is to help you complete and check your own forms. This distinction matters for how your data is used — see our Terms of Service for more.

We collect the following categories of personal data.

3.1 Data you provide to create your LPA

To prepare your LPA forms, you provide details about the people involved. This can include:

• Donor (the person the LPA is for): full name, address, date of birth, and (for Health & Welfare LPAs) preferences about care and life-sustaining treatment.
• Attorneys and replacement attorneys: full names, addresses, and dates of birth.
• Certificate provider: full name and address.
• People to be notified (if any): names and addresses.

3.2 Special-category (sensitive) data

Health & Welfare LPAs (form LP1H) concern your health, care, and welfare. Information you provide in a Health & Welfare LPA — including any preferences about medical treatment and life-sustaining treatment — is “special-category” personal data under UK GDPR (data concerning health). We handle this data with additional care, and we only process it on the basis of your explicit consent, given when you choose to create a Health & Welfare LPA (see “Legal bases”, section 6).

3.3 Uploaded photographs of signed forms

When you use our checking service, you photograph your completed and signed LPA pages and upload them to us. These images contain the personal data above, plus signatures, and are processed by our automated checking service (see section 5).

3.4 Account and contact data

• Email address — used to create your account and sign you in (we use passwordless “magic link” sign-in).
• Phone number — only if you choose to receive SMS reminders (optional; see section 6 on consent).

3.5 Payment data

When you pay, our payment processor Stripe collects and processes your card details directly. SmartLPA does not receive or store your full card number. We store a record that a payment was made (amount, date, and Stripe’s reference), not your card data.

3.6 Technical and usage data

• Sign-in sessions and security tokens (to keep you logged in and secure your uploads).
• Cookies necessary for the Service to function — see section 10.

We use your personal data to:

• Prepare your LPA forms from the details you provide.
• Run our automated check against OPG requirements and give you the results.
• Take payment for the service.
• Create and secure your account, and sign you in.
• Send service messages (for example, your receipt, or that your check is ready).
• Send SMS reminders, only if you have opted in.
• Keep records we are required to keep, and detect and prevent fraud or misuse.
• Comply with our legal obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

Important — please read this carefully.

Our checking service uses artificial intelligence provided by Anthropic to read the photographs of your LPA and check them against OPG requirements. To do this:

• The content of your LPA — including the personal data and, for Health & Welfare LPAs, the special-category health data described above — is sent to Anthropic’s API for automated analysis.
• Anthropic acts as our data processor and processes this data on our instructions, under a data processing agreement.
• This involves a transfer of your personal data outside the UK (Anthropic is based in the United States). We rely on appropriate safeguards for this transfer — see section 8 (International transfers).

The check is automated, but it does not make a legally-significant decision about you: it produces a report for you to review and act on. You remain responsible for your own LPA. If you would prefer not to have your data processed by AI in this way, you should not use the checking service.

Under UK GDPR we must have a lawful basis for each use of your data. Our bases are:

Withdrawing consent. Where we rely on your consent (health data, SMS), you can withdraw it at any time — for SMS, by opting out; for the health data, by deleting the relevant LPA or your account (section 9). Withdrawing consent does not affect processing already carried out.

We use trusted third-party service providers (“processors”) to run the Service. Each processes your data only on our instructions, under a data processing agreement. They are:

We do not share your personal data with anyone else except where required by law, or to establish, exercise, or defend legal claims.

Some of our processors are located outside the UK (notably Anthropic, Resend, and Vercel in the United States). Where your personal data is transferred outside the UK, we ensure it is protected by appropriate safeguards, such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses, together with additional protective measures.

Because our checking service transfers special-category health data to the United States (section 5), we consider this transfer carefully. If you do not wish your data to be transferred in this way, please do not use the checking service.

We keep your personal data only as long as we need it:

• While you have an account, we keep your LPA drafts and records so you can access them.
• Uploaded photographs are retained [CONFIRM RETENTION PERIOD] and then deleted.
• After a period of inactivity, or when you delete your account, your personal data is deleted or irreversibly anonymised.
• We keep minimal records of transactions for as long as we are required to for legal, tax, and accounting purposes — typically six years.

Deleting your data. You can delete your account and associated personal data at any time from your account settings. When you do, we irreversibly remove or anonymise your personal data from our active systems, including the encrypted LPA content and uploaded photographs, subject only to the minimal legal/financial records above.

We use cookies that are strictly necessary for the Service to work — for example, to keep you signed in and to secure your session. These do not require your consent.

Under UK GDPR, you have the right to:

• Access the personal data we hold about you.
• Rectify inaccurate or incomplete data.
• Erase your data (“right to be forgotten”).
• Restrict or object to certain processing.
• Data portability — receive your data in a portable format.
• Withdraw consent at any time, where we rely on it.
• Not be subject to solely-automated decisions with legal effect (our check does not make such decisions — see section 5).

How to exercise your rights. You can delete your account and data yourself at any time from your account settings. For any other request, please contact us at support@smartlpa.co.uk. We will respond within one month.

Complaints. If you are unhappy with how we handle your data, you can complain to the Information Commissioner’s Office (ICO) at ico.org.uk — though we would appreciate the chance to resolve your concern first.

We take security seriously. Measures include:

• Encryption at rest of the personal data in your LPA drafts and check results.
• Secure, passwordless sign-in and protected upload links.
• Access controls limiting who can access personal data.
• Processing only through vetted providers under data processing agreements.

No system is perfectly secure, but we work to protect your data using appropriate technical and organisational measures.

The Service is intended for adults (18+) preparing LPAs. It is not directed at children, and we do not knowingly collect data from children.

We may update this policy from time to time. We will post the updated version here and change the “Last updated” date. If we make significant changes, we will take reasonable steps to notify you.

For any privacy questions or to exercise your rights, contact us at:

SmartLPA Ltd, a company registered in England and Wales (company number 17309200).
support@smartlpa.co.uk