AI Use and Data Protection Policy

AI Use and Data Protection Policy

 

Last Updated: July 2026

1. Purpose

KCurryVA uses artificial intelligence (AI) tools to support efficiency, creativity and business operations where they can add value. This policy explains how AI may be used within the business, the safeguards that are applied, and the standards followed to protect client information and maintain the quality of services provided.

AI is a tool that can help improve efficiency and support business processes, but it does not replace professional judgement, experience, accountability or responsibility.

Any use of AI must support, not compromise, client confidentiality, professional standards, quality of service or trust.

Because many KCurryVA clients work with sensitive personal, health and employment-related information, a cautious and proportionate approach is taken to AI use. Protecting confidentiality, professional standards and client trust will always take priority over efficiency gains.

2. What AI May Be Used For

AI tools may be used to assist with:

Internal Business Activities

• Business planning and strategic development
• Process improvement and workflow design
• Administrative efficiency and automation
• Research and idea generation
• Creating standard operating procedures and internal documentation

Client-Facing Support Activities

• Generating content ideas and brainstorming topics
• Drafting social media posts, blog content and website copy
• Creating outlines, summaries and first drafts
• Supporting content development and organisation
• Assisting with research and information gathering

AI is used to support work, not to replace professional decision-making, client relationships or human oversight.

3. What AI Will Not Be Used For

AI will not be used to:

• Process, approve or manage client payments or financial transactions
• Make decisions on behalf of clients
• Replace professional expertise, judgement or client-specific advice
• Complete and finalise client work without human review
• Submit work to clients without checking it for accuracy, relevance and quality
• Undertake activities that require professional qualifications, clinical judgement, legal advice or regulated decision-making

Highly sensitive personal, medical, legal or financial information will not be uploaded to AI tools unless appropriate safeguards, permissions and protections are in place and the use is considered appropriate and necessary.

All work delivered to clients remains subject to human review and approval.

4. Appropriate Use and Risk Assessment

Before using AI for any task, consideration will be given to:

• The sensitivity of the information involved
• The potential consequences of errors or inaccuracies
• Client confidentiality requirements
• Whether AI adds genuine value to the task
• Whether the task requires professional judgement that should remain entirely human-led

If the risks are considered to outweigh the benefits, AI will not be used.

AI use is intended to support professional services, not replace professional responsibility.

5. Data Protection and Privacy

Protecting client information is a priority.

When using AI tools, KCurryVA will:

• Avoid sharing sensitive or confidential information wherever possible
• Share only the minimum information necessary to complete a task
• Seek to anonymise or minimise identifiable information wherever reasonably practicable
• Regularly review and remove information that is no longer required
• Use temporary, limited-retention or privacy-focused features where available and appropriate
• Consider the privacy, security and data-handling practices of AI providers before using them for business purposes

For the purposes of this policy, sensitive information may include:

• Personal information
• Medical or health-related information
• Case records and assessment information
• Financial information
• Employment-related information
• Legal documentation
• Any information that a client would reasonably expect to remain confidential

Because AI services are provided by third-party organisations, careful consideration will always be given to whether information is appropriate to share before any AI tool is used.

6. Human Review and Accountability

AI-generated content can be inaccurate, incomplete, misleading or out of date. For this reason, all AI-assisted work will be reviewed and verified before it is used or delivered.

Particular attention will be given to:

• Facts, statistics and research
• Names, dates and contact details
• Financial information
• Legal, regulatory or compliance-related content
• Client-specific instructions and requirements
• Professional communications and public-facing content

Responsibility for all final work remains with KCurryVA, regardless of whether AI has assisted with drafting, research, organisation or content generation.

7. Transparency with Clients

AI tools may be used to support content creation, administration, research and business efficiency.

AI is used as an assistant rather than a replacement for professional judgement, expertise or human oversight.

Clients are welcome to ask questions about how AI is used within the business and to discuss any confidentiality, privacy or data-handling requirements relevant to their work.

Where appropriate and practical, client preferences regarding AI use will be taken into consideration.

8. Review and Updates

AI technology continues to evolve, and this policy will be reviewed periodically to ensure it remains appropriate, practical and aligned with legal, ethical and professional expectations.

Updates may be made to reflect changes in:

• Business operations
• Client requirements
• Industry standards and best practice
• Applicable legal or regulatory obligations
• The AI tools and technologies used within the business

The most current version of this policy will be maintained by KCurryVA.

Version History

Version	Date	Summary of Changes	Approved By
1.0	10 July 2026	Initial issue	Business Owner