# Built-in GDPR rights & DPO — user help

> Public / partner-facing summary of KallosSim’s **in-product** data-protection controls.  
> Technical RoPA inventory: [gdpr-data-controls.md](gdpr-data-controls.md) · Legal notice: [privacy.html](../privacy.html) · Partner briefing: [outreach/partner-peer-brief.md](outreach/partner-peer-brief.md)

**Last updated:** 2026-07-15

---

## What “built-in” means

KallosSim does not leave GDPR and DPO handling to email alone. Practitioners and organisation administrators exercise core UK GDPR rights **inside the product**, with a dedicated API (`/api/gdpr`) and an organisation **DPO role**.

| Layer | What exists |
|-------|-------------|
| **Practitioner controls** | Profile → *My data usage* — export, delete training, delete account, research consent, contact org DPO |
| **Organisation DPO** | Role `dpo` is a lead role (org admin). Org Settings stores `dpo_email`. Governance tab for DPIA sign-off |
| **Platform DPO** | `dpo@kallossim.com` — one calendar month response (UK GDPR) |
| **Design default** | Full conversation transcripts are **not** stored in the database — only scores, metadata, and short evaluation excerpts (≤30 days) |

---

## Where to find it in the app

| Need | Location |
|------|----------|
| See what we store / research consent | Profile menu → **My data usage** |
| Download a copy of your data (Art. 15 / 20) | *My data usage* → **Download my data** |
| Delete practice sessions only (Art. 17) | *My data usage* → **Delete training history** |
| Delete / anonymise account (Art. 17) | *My data usage* → **Delete my account** |
| Contest an automated score (DUAA 2025 / Art. 21) | *My data usage* → **Contact my organisation's DPO** |
| Contact platform DPO | `mailto:dpo@kallossim.com` (also linked in *My data usage*) |
| Set organisation DPO email | Org Admin → **Settings** (or onboarding) |
| Record org DPIA / privacy sign-off | Org Admin → **Governance** (DPO role) |
| Aggregated quality only (k≥5) | Org Admin → **Quality** |
| Practitioner handbook | [howto.html](../howto.html) — *Privacy & improvement* |
| Support category | In-app support → **Data / GDPR** |

---

## Rights mapped to product actions

| Right | UK GDPR | In-product action |
|-------|---------|-------------------|
| Access + portability | Art. 15 / 20 | **Download my data** → JSON export with `data_control_manifest` |
| Erasure (training) | Art. 17 | **Delete training history** |
| Erasure (account) | Art. 17 | **Delete my account** (anonymisation) |
| Restrict / withdraw research | Art. 6 / 18 | Toggle research consent in *My data usage* |
| Object / contest score | Art. 21 · DUAA 2025 | **Contact my organisation's DPO** |
| Transparency | Art. 13 / 14 | *My data usage* + [privacy.html](../privacy.html) |

API operations: `export` · `delete_training` · `delete_account` · `request_review` (and org-lead `delete_org`). Audited to `opslog.pii_event`.

---

## Two DPO contacts — do not confuse them

| Contact | Who | When to use |
|---------|-----|-------------|
| **Organisation DPO** | Your employer’s registered DPO (`dpo_email` on the org) | Contest a score, org-scoped data rights, workforce DPIA questions |
| **Platform DPO** | KallosSim — `dpo@kallossim.com` | Provider-level queries, deletion when org DPO is unavailable, DPA / processor questions |

The in-app **Contact my organisation's DPO** button notifies the email on file for your organisation. If none is set, practitioners still have the platform DPO mailto path.

---

## Organisation DPO role

- Role id: `dpo` — part of `LEAD_ROLES` with team lead, senior manager, and editorial board
- Access: Org Admin (Quality, Members, Settings, Governance)
- Responsibilities in-product: maintain `dpo_email`, review Quality aggregates, record Governance / DPIA sign-off
- Scores are **advisory learning support only** — not formal competence records for appraisal without human review

---

## What we deliberately do not store

- Full practice **conversation transcripts** (browser / session only)
- Real service-user, patient, or employee case files (all scenarios are AI-generated)
- Fine-tuning of AI models on production user conversations (OpenAI zero-retention API)

Full field inventory and delete behaviour: [gdpr-data-controls.md](gdpr-data-controls.md).

---

## Related reading

| Audience | Document |
|----------|----------|
| Practitioners | [howto.html § Privacy](../howto.html#privacy-improvement) · in-app guide *How the solution is governed* |
| Partners / procurement | [partner-peer-brief.md](outreach/partner-peer-brief.md) |
| DPO / compliance | [governance-handbook.md](governance-handbook.md) · [gdpr-data-controls.md](gdpr-data-controls.md) · [privacy.html](../privacy.html) |
| Developers | [`api/gdpr.js`](../api/gdpr.js) · `tests/gdpr-controls.test.js` |