Last updated: 9 October 2026
This policy explains how we handle personal data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
1. Who is the data controller
CHCexpert (chcexpert.co.uk) is run by Karol Slusarczyk, trading as Benefits Expert, a UK sole trader registered with the Information Commissioner's Office (ICO:00014179042). Benefits Expert is the data controller. In this policy, "we", "us" and "our" mean Benefits Expert. You can contact us about your data at support@benefitsexpert.co.uk.
2. What we collect
We collect only what we need to write the statement you ask for:
- your email address, and your relationship to the person (for example daughter);
- the name you use for the person (a first name or "Mum" is enough);
- the health and care information you choose to enter about them, and the main health conditions;
- how you are able to use their information (their agreement, or a lasting power of attorney or deputyship);
- for a refusal, the dates, levels and reasons you copy from the decision; and
- technical data, such as your IP address and browser, used to keep the service secure.
We never ask for an NHS number, an address, a date of birth or medical records, and please do not enter them. The free preview needs your email address, because we send your free section there and keep the free section to one per family.
3. Health information about your relative
Information about health is "special category" data and needs extra protection under the law. Before anything is written you confirm one of these: that the person has agreed that you can use their health information to prepare for this assessment, or that you hold a registered lasting power of attorney or are a court-appointed deputy. You also give your own explicit consent, under Article 9(2)(a) of the UK GDPR, for us to process the health information you enter, and you confirm it is true to the best of your knowledge. We use it for one purpose only: to write the statement, summary or letter you asked for. You can withdraw your consent at any time (see "Your rights" below).
4. Our lawful bases
- Consent for the health information (Article 6(1)(a) and Article 9(2)(a)).
- Performance of a contract to deliver the pack you have paid for.
- Legitimate interests to keep the service secure and to prevent abuse and fraud, such as one person taking many free sections.
5. How we use the data
We use it to write and deliver your statement, to take your payment, to send you the emails connected with your order, to answer your questions and to keep the service safe. If you use the free preview or a free tool, we may email you now and then about the next steps of the assessment; every such email has a way to unsubscribe. We do not use health information for advertising and we do not build a profile of you or your relative.
6. Who we share it with
We share data only with the providers who help us run the service, under their data processing terms:
- Vercel hosts the website and runs the code that sends your request onward;
- Anthropic, our text generation provider: the information you enter is sent through its commercial API to write your statement. Under its commercial terms it is not used to train its models, it is kept by Anthropic only for a strictly limited period and it is handled under a data processing agreement;
- Upstash (through our hosting) holds the coded counts that keep the free section to one per family, for 30 days at most, and the marker of the letter link of a Family Pack + Local Resolution Letter order, for about 13 months (section 7);
- Zoho delivers our emails and hosts our support mailbox;
- Stripe takes payments. We never see or store your full card number.
We do not sell data. We do not share it with the NHS, your integrated care board, the council or anyone else, unless the law requires it. You decide what to share with the assessment team.
7. How long we keep it
What you type is not stored on our servers once your statement has been written. While you fill in the form, a copy is kept in your own browser tab (session storage) so that it survives the trip to the payment page; it is deleted when you close the tab, or straight away if you press "Clear what I typed".
The emails we send you (your free section or your pack) and the alerts we send ourselves (your email address, the area you chose and the main health conditions you listed) stay in our business mailbox so that we can resend them and deal with support, refunds or payment disputes. We delete them when you ask, and otherwise when they are no longer needed for those purposes.
If you buy the Family Pack + Local Resolution Letter before the decision, your order email contains a personal letter link. So that it writes your letter once, we keep a coded form of your order reference (a hash, which cannot be read back) with a marker saying whether the letter has been written and when. Nothing else is kept with it, and it is deleted automatically about 13 months after your purchase.
The two PDFs of your pack are made in your own browser. To make them, the page loads two open-source PDF libraries from cdnjs (Cloudflare) and jsDelivr, which see your IP address as for any web request; your pack itself is never sent to them.
To keep the free section to one per family we keep coded forms (keyed hashes, which cannot be read back) of your email address and the area you chose (and, for an address that is not with one of the big email or internet providers, of the part after the @ sign), of your internet connection's IP address, of the random code in your browser's free section cookie and, if you list several conditions, of that list and of each condition in it, with the time and a count. Nothing else is kept with them, and they are deleted automatically after 30 days at most.
8. International transfers
Some of our providers process data outside the UK, including in the United States. Where that happens, transfers are covered by appropriate safeguards, such as the UK's approved transfer mechanisms, so that the data stays protected to UK standards.
9. Your rights
You, and the person you wrote about, have the right to:
- access the personal data we hold;
- ask us to correct data that is wrong or incomplete;
- ask us to erase data;
- withdraw consent to the processing of health information at any time; and
- complain to the Information Commissioner's Office at ico.org.uk.
To use any of these rights, email support@benefitsexpert.co.uk. Withdrawing consent does not affect processing we did before you withdrew it.
10. Cookies and browser storage
Essential cookies, which the service needs to work:
- chc_fd is set when you get your free section: a random code with no personal details, signed so it cannot be altered, which lets us limit how many free sections one browser can get. It is sent only to our own servers, cannot be read by the page and expires after 30 days.
- chc_order is set after payment: your order reference, so that your pack can still be emailed to you if the page cannot send it. It is sent only to our email route, cannot be read by the page and expires after 38 hours.
Session storage in your browser tab keeps your draft, your order link and the email you used, until you close the tab. Your cookie choice is kept in local storage under chcexpert_cookies.
Optional analytics cookies (Google Analytics and Microsoft Advertising) are used only if you choose "Accept analytics", and only once we have set them up; until then nothing is loaded. Our URLs never carry health details. You can change your choice at any time by clearing this site's data in your browser.
11. Contact us
If you have any question about this policy or about your data, email support@benefitsexpert.co.uk and we will reply as soon as we can.