Privacy policy

Effective Date: 26 March 2026 | Version: 1.0

This Privacy Policy explains how ClinLexis Ltd ("we", "us", "our") collects, uses, stores, and protects personal data when you use the ClinLexis platform ("Service"). We are committed to protecting your privacy and complying with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Data Controller

ClinLexis Ltd (Company No. 17081483), with its registered office at 238a Telegraph Road, Heswall, Wirral, CH60 0AL, is the data controller for the personal data described in this policy. Our Data Protection Officer can be contacted at support@clinlexis.co.uk.

2. Personal Data We Collect

2.1 Account Information

Name, email address, and phone number
Professional details (medical specialism)
Account credentials (passwords are stored in hashed form only)

2.2 Uploaded Content

Medical documents, clinical records, and associated files
Patient data contained within uploaded documents
Images and supporting materials

2.3 Usage Data

IP addresses and browser information
Feature usage and interaction patterns
Consent records (type, version, timestamp, IP address)

3. Special Category Data

The Service processes health-related data, which constitutes special category data under Article 9 of the UK GDPR. We process this data on the basis of your explicit consent (Article 9(2)(a)) and, where applicable, for reasons of substantial public interest in the area of public health (Article 9(2)(i)).

We implement additional safeguards for special category data, including encryption at rest and in transit, strict access controls, and audit logging.

4. How We Use Your Data

To provide and operate the Service, including AI-powered document analysis and chronology generation.
To manage your account and subscription.
To communicate with you about your account, service updates, and support requests.
To maintain security and prevent fraud.
To comply with legal obligations.
To improve the Service (using aggregated, anonymised data only).

5. Legal Bases for Processing

Consent (Article 6(1)(a)) — for AI processing of uploaded documents and special category data.
Contract (Article 6(1)(b)) — to provide the Service under your subscription agreement.
Legal obligation (Article 6(1)(c)) — to comply with applicable laws and regulations.
Legitimate interests (Article 6(1)(f)) — for service security, fraud prevention, and service improvement.

6. AI Processing

When you upload documents to the Service, they are processed using artificial intelligence models to extract information, generate chronologies, and perform evidence analysis. By accepting this Privacy Policy, you consent to this AI-powered processing of your uploaded Content as described in this section.

AI processing is used to assist your professional work, not to make automated decisions about individuals. All AI-generated outputs require human review before use.

We do not use your uploaded documents or personal data to train AI models. Document processing is performed solely for the purpose of providing the Service to you.

7. Data Sharing and Third Parties

We may share your data with the following categories of recipients:

Cloud infrastructure providers (for hosting, storage, and AI-powered document processing)
Payment processors (Stripe) for subscription management
Professional advisers (legal, accounting) where required
Law enforcement or regulators where required by law

We ensure all third-party processors have appropriate data processing agreements in place and provide adequate levels of data protection.

8. Data Location

All personal data and uploaded Content is processed and stored within the United Kingdom. We do not transfer your data outside the UK.

9. Data Retention

We retain your personal data for as long as your account is active. When your subscription ends, is cancelled, or your free credits are exhausted without an active subscription, we retain your uploaded Content and account data for ninety (90) days (the "Retention Period"). During the Retention Period, you may continue to access and export your data.

After the Retention Period, we reserve the right to permanently delete all Content and personal data associated with your account, unless a longer retention period is required by law or for the establishment, exercise, or defence of legal claims.

We will notify you by email at thirty (30) days and seven (7) days before the end of the Retention Period.

9.1 AI Processing Data Lifecycle

Certain data generated during AI processing — including document embeddings, vector representations, and AI assistant conversation history — is retained for ninety (90) days from the date on which the initial analysis for a given case is generated (the "AI Availability Window"). After this period, such data may be permanently deleted.

Your uploaded documents, extracted text, user-edited content (such as chronology corrections and key findings), and completed reports are not affected by the AI Availability Window and are retained in accordance with the general retention terms above.

Consent records are retained for 7 years for GDPR compliance audit purposes.

10. Your Rights Under GDPR

You have the following rights regarding your personal data:

Right of access — request a copy of your personal data.
Right to rectification — request correction of inaccurate data.
Right to erasure — request deletion of your data ("right to be forgotten").
Right to restrict processing — request limitation of how we process your data.
Right to data portability — receive your data in a structured, machine-readable format.
Right to object — object to processing based on legitimate interests.
Right to withdraw consent — withdraw consent at any time without affecting the lawfulness of prior processing.
Right not to be subject to automated decision-making — request human review of automated decisions.

To exercise any of these rights, contact us at support@clinlexis.co.uk. We will respond to your request within one month.

11. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

Encryption in transit (TLS 1.2+) and at rest (AES-256)
Role-based access controls and authentication
Regular security assessments and penetration testing
Audit logging of all data access and modifications
Secure infrastructure with redundancy and disaster recovery

12. Data Breach Notification

In the event of a personal data breach, we will notify the Information Commissioner's Office (ICO) within 72 hours where feasible, as required by Article 33 of the UK GDPR. Where the breach is likely to result in a high risk to your rights and freedoms, we will also notify you directly without undue delay.

13. Cookies

The Service uses essential cookies for authentication and session management. We do not use third-party tracking cookies. For more information, see our Cookie Policy.

14. Children's Privacy

The Service is not intended for use by individuals under the age of 18. We do not knowingly collect personal data from children.

15. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of material changes via email or through the Platform at least 30 days before they take effect. The "Effective Date" at the top of this policy indicates when it was last updated.

16. Complaints

If you are unhappy with how we handle your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Website: ico.org.uk | Helpline: 0303 123 1113

17. Contact

For questions about this Privacy Policy or to exercise your data rights, contact us at support@clinlexis.co.uk or write to our Data Protection Officer at the address above.