Share only what is needed.

Summary first, authorised detail later

The proposed adult pathway starts with a limited summary for selected verified organisations. A named provider staff member requests assessment access; the referrer records a separate release decision. Handover information goes only to the chosen provider under a separate permission. Access has a purpose, scope and expiry, with MFA, revocation and an audit trail.

A summary can still identify someone when combined with other information. Health, criminal-offence and other sensitive material needs specific legal assessment and proportionate handling. Membership payment, a declaration or a checkbox does not provide blanket authority.

Responsibilities and privacy information

Referrers and providers are responsible for their actual purposes and decisions. HousingAssured's platform and any processor activity must be assessed separately. Each organisation needs the correct legal basis, appropriate privacy information and signed sharing or processing arrangements. People must be told about relevant recipients, retention, choices and rights in an accessible way before live use.

Supplier and deletion checks

The current technology includes Sites/OpenAI hosting and identity, Cloudflare infrastructure and private storage, postcode/address lookups and a prepared Stripe integration. Email sending is not yet configured and no automated malware-scanning service is represented as operating. Actual account contracts, processing locations, transfer safeguards, deletion jobs and backup/restore periods still need verification.

The fictional pilot makes closed referrals unavailable after 30 days and uses manual cleanup for physical removal. The wider proposed retention schedule is a review draft, not a claim that all automatic deletion is implemented. No real referral records should be uploaded.

Before the portal opens

Approve the DPIA, controller/processor roles and legal conditions; verify staff and organisations; complete supplier agreements and privacy information; test private files, MFA, named access, expiry, revocation, file checking, incidents, deletion and restores. A suitably qualified reviewer must assess the health/criminal-offence conditions. High residual risk requires the appropriate consultation assessment before processing.