Field Judgement pilot · notice version 6 September 2026
Privacy and minimum necessary information
The pilot preserves a connected learning and performance history between an identified learner, trainer and manager. It is not a clinical record, product knowledge base or employee-monitoring system.
What is collected
Name, work email, role, named learning location, an approximate device-location check, learning contributions, research links, optional audio and files, reconstruction information, handovers, feedback, results, decisions, timestamps and access/audit events.
What must not be entered
Patient-identifiable or special-category personal data, trade secrets, confidential product detail, source code, sensitive pricing, contract terms, passwords or unnecessary customer information. Reference an approved controlled source instead of copying protected material.
Who can see what
The learner sees their connected history. The assigned trainer sees the developmental and coaching history required for the Offer Handover. The assigned manager sees only the later Performance Handover, consequence and manager decision. The TNAC pilot owner can administer access, support the pilot and inspect stored role views; owner access is logged.
Voice, files and location
Voice is offered first where the learner’s browser supports speech recognition. The browser or operating-system speech service may process the speech to return a transcript; the learner must review or correct it before it becomes evidence. Original audio is stored in the pilot only when the learner chooses to record it. Typing remains available. Images have common metadata removed before storage. Device location is reduced to an approximate three-decimal coordinate and is used only to evidence where capture occurred.
Storage and security
Structured records are stored in the site’s Cloudflare D1 database; uploaded and generated files are stored in its private Cloudflare R2 bucket. Access uses individual accounts, revocable sessions, role checks and encrypted transport. The precise hosting jurisdiction must be approved by the pilot data controller before real GE information is entered.
Retention
Pilot records are retained until 90 days after the pilot closes unless the data controller approves a different documented period or a legal hold applies. The owner must export any required archive, verify it, and then retire the hosted records and files. Browser drafts remain only in the current tab session and are cleared on secure sign-out.
Your choices and rights
Do not use voice or file upload if it is unnecessary. You may ask the pilot owner for a copy, correction, restriction or deletion assessment. Some evidential history may need an auditable correction rather than silent alteration.