Booking and invoice records
Online bookings, authority confirmations, invoice details and booking status are held as restricted business records. The public confirmation and invoice pages use a non-sequential access token, are excluded from search indexing and should not be forwarded beyond authorised recipients.
Evidence minimisation
We agree an evidence request that is proportionate to scope. Clients should provide relevant documents and avoid unnecessary personal, commercially sensitive or legally privileged material. If sensitive content is necessary, we agree how it will be handled before transfer.
Governance Health Check records
The online Health Check saves the arrangement profile, evidence references and status, safeguard answers, assessment responses and action-plan information against a non-sequential private access token. It is designed to record where supporting evidence is held in the purchaser's approved system, not to receive copies of the evidence. Purchasers should use document references rather than pasting sensitive source content into commentary fields.
Transfer and access
Independent-review evidence is transferred through an agreed route rather than uploaded to this website. Health Check evidence remains in the purchaser's own approved system and is referenced by metadata only. Access is restricted to the named reviewer and any authorised person whose involvement has been agreed, such as a peer reviewer or essential service provider.
Working records and factual correction
We maintain a proportionate record of scope, evidence received, meetings, analysis, conflicts, findings and issue of the report. The client may correct factual errors through the agreed correction round; professional findings remain the responsibility of the lead reviewer.
Confidentiality, circulation and publication
Authorised recipients and any confidentiality constraints are agreed at appointment. Reports and case studies are not made public without express client agreement, except where disclosure is required by law or already lawfully in the public domain.
Retention, return and deletion
The appointment records the intended treatment of evidence after the review. We retain only what is needed for the service and relevant legal, contractual, insurance or professional requirements, then securely delete or return material as appropriate. Backups and immutable business records may expire on their normal controlled cycle.
Incidents and questions
Suspected loss, unauthorised access or incorrect disclosure is contained, assessed, recorded and notified where required. Data and records questions can be sent to governance@designreviewpanel.co.uk.