Privacy notice
Wysehub Ltd. Version 1.0. Last reviewed 9 September 2026.
WyseHub is a service of Wysehub Ltd. This notice explains what happens to the claims our partners put into the platform, what we hold about the people who use the portal and visit this site, and the rights you have under the UK General Data Protection Regulation and the Data Protection Act 2018. It is written to be read, so it says what the system does rather than what a policy might say.
Who we are
Wysehub Ltd is registered with the Information Commissioner’s Office under number 15820659. Our registered address is 167-169 Great Portland Street, London, England, W1W 5PF. Our data protection contact is contact@wysehub.co.uk. AI Claims and WyseAi are other brands of Wysehub Ltd, each covered by its own notice.
WyseHub is the operations platform between the insurers and brokers who refer claims to us, our source partners, and the hire, repair and accident-management companies who service them, our supplier partners. When a claim comes in, WyseHub allocates it to a partner, automatically, using our AI scoring and the rules the partners have set, then tracks it through to completion, applies the rates the partners have agreed, raises the invoices and reports on the results.
Two kinds of data, two roles
Most of the personal data WyseHub handles is inside the claims our partners put into the platform: the name of the claimant, the vehicle and incident details, the documents attached to the claim and the notes from calls about it. That data belongs to the people in the claim, not to us. For that data, the partner who referred the claim is the controller and Wysehub Ltd is their processor, acting on their written instructions under a data processing agreement. If your data is in a claim, the organisation you dealt with is the first place to ask, and we will help them answer.
For the people who hold a portal account on a partner’s behalf, for visitors to this website, and for the business contacts we deal with, Wysehub Ltd is the controller, and this notice applies directly.
The claims our partners put into WyseHub
A claim reaches the platform when a source partner refers it, by the portal, by API or by a feed from the system they already run. A claim record holds:
- The people in the claim: the claimant and, where relevant, the third party and the witnesses, with their contact details.
- The vehicle and incident details: registration, make and model, where and when the incident happened, and what was damaged.
- The documents that support it, such as photographs, engineer’s reports, hire agreements and repair estimates.
- The notes and call records our partners add as the claim progresses, and the invoices and payments that follow.
Where a claim involves injury, the record may hold health information about the people involved. That is special category data. We process it only because our partner has a lawful basis to handle the claim it belongs to, only for that claim, and with the safeguards below. We do not use the claims our partners put into the platform to train models, ours or anyone else’s.
What the platform adds is the record of what happened to the claim: which partner it was allocated to and why, each change of status, the rates applied, the invoices raised and the reports produced. Every allocation is logged with who or what made it, so a decision can be explained a year later.
How we use AI
Some workflows include a liability score. Annie, our scoring service run with our partner AnnieAi, reads the details of a claim and produces a score with the reasons behind it, which helps route the claim to the right partner and shows the partner’s staff where to look first. The result is for people to act on. WyseHub does not make decisions about people by itself: a person at the partner decides what happens to a claim, and the score is one of the things they see.
Personal data is used where the work needs it and minimised where it does not. Scoring a claim needs the incident and the parties to it, so those details are sent; details that do not bear on the score are not. Which workflows include scoring is agreed with each partner and stated in their agreement.
How the platform is protected
- Each partner sees its own claims and nothing else. Every request is scoped to your organisation on the server before it returns anything. A source partner sees the claims it referred; a supplier partner sees the claims allocated to it.
- Access within a partner is by role. Your own administrator manages who on your team can see and do what, and changes to that access are recorded.
- Access is logged. Sign-ins are recorded, sessions expire after an hour of inactivity and must be renewed within seven days, and the service applies rate limiting and security headers on every request.
- Data in transit is encrypted between you and us, and between us and each processor we use.
Who processes data for us
The suppliers below run parts of the service. Which of them handle a given piece of work depends on the workflow: a claim that is scored uses the models, a claim that is only tracked does not, and the reports a partner receives are set up with that partner. Each supplier is under a data processing agreement with us and receives only what its job needs. We do not sell personal data, and nobody receives it for their own marketing.
| Who | What they do for us | Where |
|---|---|---|
| DigitalOcean | File storage for the documents and reports attached to claims | London (UK) |
| Amazon Web Services | Runs the AI models used by the workflows that include them | London (UK) |
| AnnieAi | Liability scoring on claim details, in workflows that use it | UK |
| Microsoft | Sends our email: sign-in codes, password resets, notifications, and the enquiries and receipts from the contact form | UK or EU |
| Xero | Invoicing our partners | Under transfer safeguards |
| Sentry | Error monitoring for the service | EU or US, under transfer safeguards |
| Metabase | Reporting dashboards embedded in the portal | Hosted by us in the UK |
Supplier partners receive the claims allocated to them, because servicing a claim is what they do; they are controllers of the data they hold for that purpose. Professional advisers, regulators and law enforcement may receive data where the law requires it. A workflow set up for a partner with a different arrangement is described in that partner’s agreement rather than here.
International transfers
In our standard setup claims are stored and processed in the United Kingdom, with files and models in London. Some suppliers may process limited data outside the UK: our error monitoring may hold technical records with a provider outside the UK, and our invoicing runs on a service under transfer safeguards. Where a partner’s workflow is set up differently, their agreement says where processing takes place. Where data leaves the UK we rely on an adequacy decision, the UK International Data Transfer Agreement or the UK Addendum to the Standard Contractual Clauses. Ask us for a copy of the safeguard that applies.
How long we keep data
- The claims our partners put into the platform, and the documents and reports that belong to them, are kept for the period agreed in that partner’s contract and then deleted or anonymised. A partner can ask us to delete their claims sooner.
- The record of a claim’s allocation and progress (which partner it went to, when, and what was applied) is kept for as long as the partner’s claims are, because it is what makes a decision explainable.
- Sign-in records and access changes are kept for 6 years, in line with our information security policy.
- Financial records, including invoices, are kept for 6 years, as HMRC requires.
- Enquiries and business correspondence are kept for as long as the relationship lasts and for 6 years afterwards, in line with the Limitation Act 1980.
Accounts, sign-in and this website
To use the portal on a partner’s behalf we hold your name, work email address, your role and the partner you belong to, and a record of your sign-ins. Sign-in is by password, with a code sent by email where your partner has asked for it; we never see your password in clear. We process this data to provide the service under our contract with your organisation.
Visiting this website tells us your IP address, browser and the pages you request, in the ordinary server records every website keeps. We use those to run and secure the site, on the basis of our legitimate interest in doing so, and we keep them for no longer than 90 days. There are no analytics, advertising or social media scripts on this site, and nothing here profiles you.
If you write to us, through the contact form on this site or by email, we keep your message and reply to it. The form asks for your name, a work email address, your company, whether you are an insurer, a broker or a supplier, and your message. It sets no cookies. The message reaches us as an email, and you receive a short receipt with a WH- reference number. Nothing else is stored. We use those details to answer you and, if you become a partner, to set up the work. We keep enquiries for the period given under how long we keep data. We only send marketing to people who have asked for it, and every such message says how to stop.
Cookies
This site and the signed-in portal set only the cookies they need to work. None of them tracks you, and none is shared with anyone else. There are no analytics or advertising cookies. Every cookie below is strictly necessary, so there is no cookie banner: none of them needs your consent.
| Cookie | Purpose | Lasts |
|---|---|---|
| access_token | Keeps you signed in | 60 minutes |
| refresh_token | Renews your sign-in without asking you again | 7 days |
| csrf_token | Protects forms against forged requests | Session |
Your rights
Under the UK GDPR you can ask us:
- for a copy of the personal data we hold about you;
- to correct data that is inaccurate or incomplete;
- to delete your data where there is no compelling reason for us to keep it;
- to restrict how we use your data in certain circumstances;
- to stop processing based on our legitimate interests, or for direct marketing;
- for your data in a structured, machine-readable format;
- not to be subject to a decision made solely by automated means where it has a legal or similarly significant effect on you.
On that last point: WyseHub does not make automated decisions with a legal effect about people. It does allocate claims to partners automatically, using its scoring and the rules our partners set, but that decides which partner handles a claim, not whether or how a person is served, and a partner’s own staff can reallocate a claim at any time.
To exercise a right, write to contact@wysehub.co.uk. We respond within one calendar month. If your data is in a claim a partner put into the platform, we will pass your request to them as the controller and help them answer it. If you are unhappy with how we handle your request you can complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
Changes to this notice
We update this notice when the platform changes in a way that affects it, for instance when a processor is added or removed. The version and review date at the top tell you which one you are reading, and where a change is material we take reasonable steps to tell the people it affects.
How to contact us
Wysehub Ltd, 167-169 Great Portland Street, London, England, W1W 5PF. Email contact@wysehub.co.uk or telephone 0333 880 9113. Our ICO registration number is 15820659.
Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone 0303 123 1113.