Confidentiality Policy

Duty of confidence

Papillon treats client, service-user, patient, legal, commercial and assignment information as confidential. The duty applies before, during and after an assignment or working relationship and is reinforced through contracts, confidentiality commitments and role-specific instructions.

Minimum necessary access

• Information is accessed only by authorised people who need it to perform, manage, assure or lawfully audit the service.
• Identifiers are minimised, redacted or separated from content where practicable.
• Files are exchanged only through approved secure portals, encrypted links or agreed secure email routes.
• Personal email, unauthorised file-sharing, unencrypted removable media and consumer AI tools must not be used for client information.
• Workers must prevent conversations from being overheard and protect screens, notes and devices during remote or on-site work.

Permitted disclosure

Confidential information is disclosed only with authority, under contract, where required by law, or where a documented safeguarding or public-interest justification applies. Any disclosure is limited to what is necessary and recorded when appropriate.

Breach, retention and return

Suspected loss, misdirection, unauthorised access or disclosure must be reported immediately. Papillon contains and investigates the incident, informs the relevant controller or client without undue delay and supports any required notification. Information is retained only for the agreed contractual or legal period, then securely returned or deleted.