Confidentiality & Data Handling Policy

1. Purpose and scope

This policy explains how The Garment Tech Clinic (the “Clinic”) handles confidential customer product information submitted for a Tech Pack Health Check, garment-technology consultancy or related service.

It applies to technical and commercially sensitive product information. Personal information such as names, email addresses and transaction records is also handled under our Privacy Policy and applicable UK data-protection law.

2. Information covered by this policy

• tech packs, specification sheets, measurements and Points of Measure;
• grading rules, size charts, patterns or pattern-related information;
• sketches, drawings, photographs, prototypes, garment details and product concepts;
• fabric, trim, component, colour, artwork, print, embroidery, labelling and packaging information;
• sample comments, fit comments, test information and development history;
• factory, supplier, costing, sourcing and commercial information;
• unreleased brand, collection, product-launch and marketing information; and
• any analysis, extract or copy that reveals the substance of the above.

3. How customer files move through the Clinic

1. Payment and job details: payment is handled through Stripe; job details are submitted through the Clinic website.
2. Confidential upload: technical files are normally supplied through the Clinic's dedicated Dropbox File Request.
3. Clinic working copy: files needed for the assessment are accessed in the Clinic's controlled working environment.
4. AI-assisted first pass: where appropriate, the current PDF Health Check analyser submits the file through the OpenAI API using the controls described in section 5 below.
5. Human review: AI output is an internal draft. A Senior Garment Technologist reviews the findings and applies professional judgement before a customer-facing report is issued.
6. Report and follow-up: the final report and reasonable immediate follow-up are supplied to the customer.
7. Deletion: working customer technical files are normally deleted under the retention timetable in section 9.

4. What we will not do

• We will not sell a customer's tech pack or design.
• We will not publish customer technical information.
• We will not use a customer's design to manufacture, source, copy, commercialise or market that product for ourselves.
• We will not use customer confidential information to develop or assist a competing product for another customer.
• We will not use identifiable customer work in advertising, social media, case studies, public examples or training material without prior written permission.

Nothing in this policy prevents the Clinic from using general garment-technology knowledge, skills, experience and know-how independently known or developed, provided customer confidential information is not used or disclosed.

5. OpenAI API and AI-assisted analysis

The Clinic's current Tech Pack Health Check workflow uses the OpenAI API to assist with document analysis, comparison, arithmetic checking and identification of possible technical inconsistencies. AI output is not treated as a final professional conclusion.

• OpenAI states that API inputs and outputs are not used to train its models by default.
• The Clinic has API model-feedback, evaluation/fine-tuning data sharing and API input/output sharing disabled.
• The Clinic's analyser requests the AI response with store:false.
• A temporary API file upload is given a one-hour expiry safeguard where supported and the analyser requests deletion immediately after analysis.
• OpenAI's published API data terms state that API inputs and outputs may nevertheless be retained for up to 30 days to provide the service and identify abuse, unless a different retention control such as Zero Data Retention applies.
• Live customer tech packs are not processed through Richard Reddington's personal ChatGPT workspace.

The Clinic does not opt customer files into OpenAI model-training or voluntary data-sharing programmes. Service-provider retention for security, abuse monitoring or legal obligations is not the same as permission to use customer content for model training.

AI-assisted analysis does not transfer ownership of customer intellectual property or change the confidential status of information supplied.

6. Other approved service providers

The Clinic uses third-party technology and professional service providers where reasonably necessary to operate the service. Current core providers include:

Access to customer confidential information is limited to people and approved systems that reasonably need it. The Clinic limits information supplied to providers to what is reasonably necessary for the task.

7. Human review and decision-making

The Health Check is AI-assisted, human reviewed. The AI analyser produces an internal draft; it does not independently approve a garment, release bulk production, certify compliance or make a final customer decision. A Senior Garment Technologist reviews the analysis before issue and may accept, reject, amend or add findings.

8. Security

The Clinic uses reasonable technical and organisational measures appropriate to the nature of the information held. No internet-based system can truthfully be described as absolutely or 100% secure, so the Clinic does not make that claim.

If we become aware of a material unauthorised use or disclosure affecting customer confidential information, we will take reasonable steps to contain and investigate it and will notify the affected customer where appropriate and required.

9. File retention and deletion

Working copies of customer tech packs and other confidential technical files are normally retained only for the period reasonably required to complete the service and immediate follow-up.

Unless there is a continuing reason to retain them, the Clinic will normally delete or securely dispose of working copies within 30 days after the final Clinic report and immediate follow-up are complete.

The OpenAI API step has separate service-provider retention described in section 5. A temporary uploaded API file is requested for deletion immediately by the Clinic analyser, but OpenAI may separately retain API inputs/outputs for up to 30 days under its published standard API abuse-monitoring/data-retention terms unless a different retention control applies.

The Clinic may retain limited information where reasonably necessary for legal, insurance, accounting, security, dispute-resolution or regulatory purposes. Routine backups may persist until overwritten in the ordinary course. Any retained confidential information remains subject to this policy.

A customer may ask us in writing to delete working confidential files sooner where reasonably possible and where this does not conflict with legal, security, insurance or legitimate record-retention requirements.

10. Reports, records and communications

The Clinic may retain the final report, basic job records and customer correspondence where reasonably necessary for business administration, insurance, accounting, professional records or dispute resolution. Retention of a record is not permission to reuse the customer's design or technical information for another purpose.

11. Sample reports, demonstrations and marketing

Sample reports, mock tech packs and technical examples shown on the Clinic website or in advertising are created specifically for demonstration purposes unless we clearly state that written customer permission has been obtained.

Customer work is never assumed to be available for marketing. Identifiable customer material is used publicly only with explicit written permission.

12. Non-Disclosure Agreement

A customer may request a separate NDA before sending any confidential product files. The Clinic's standard Customer Confidentiality Agreement (NDA) is published in full on this website.

If a signed NDA and this policy contain different confidentiality terms, the signed NDA takes priority for the confidential information it covers.

13. International processing

Some technology providers used by the Clinic operate internationally and may process information outside the UK. Where UK data-protection law applies to a transfer of personal data, the Clinic relies on an applicable adequacy arrangement or appropriate contractual/other safeguards made available by the relevant provider, as required by law. See the Privacy Policy for personal-data details.

14. Required disclosures

Nothing in this policy prevents disclosure where the Clinic is required to disclose information by law, court order or a competent regulator. Where lawful and reasonably practicable, we will disclose only what is required and notify the customer before disclosure where appropriate.

15. Changes to this policy

We may update this policy as the Clinic's services, technology providers or legal obligations change. The published version shows the latest update date. A material change will not retrospectively remove confidentiality protections already agreed under an existing signed NDA or service contract.

16. Contact

Richard Reddington
The Garment Tech Clinic
2 White Cottages, Capenhurst Lane, Capenhurst, Chester, Cheshire CH1 6HF
Email: richard@reddington.tech