For your clients

Effective 19 June 2026. If your clinician uses Cogent Clinic, this is a plain-English explanation of what it is and what happens to your information.

Your clinician uses a piece of software called Cogent Clinic to help with the writing side of their practice. This notice explains, in plain language, what that means for you and what happens to your information. It is written for you as a client, not for clinicians or lawyers.

For a fuller everyday explanation of how it works, see cogent.clinic/for-clients. If you would like the longer legal version, the Clinician Privacy Policy and the Data Processing Agreement on this Trust Centre describe the same arrangements in more detail.

Who is responsible for your information

Your clinician is responsible for your information. They decide what to record, how it is used, and how long to keep it. Cogent Clinic Ltd is a company that provides software to your clinician and acts on your clinician's behalf.

In data-protection language: your clinician is the controller of your information. Cogent Clinic Ltd is a processor, which means it follows your clinician's instructions.

Because your information includes health details, the law treats it as especially sensitive. Your clinician processes it as part of providing you with healthcare, in their capacity as a registered health professional bound by a duty of confidentiality. This is the legal basis they rely on to keep and use your clinical record: they do not need your consent to maintain an accurate record of your care, and their professional obligations require them to do so.

Separately, the live-transcription (session recording) feature is optional. Your clinician will explain it and ask for your explicit consent before using it, and you are free to refuse or to withdraw that consent at any time without it affecting your care. Withdrawing consent does not remove notes your clinician has already made. If a session has been transcribed and you would like the transcript deleted, ask your clinician; they control it and can delete it.

☐ I confirm that my clinician has explained the live-transcription (session recording) feature, and I give my explicit consent to my sessions being recorded and transcribed using Cogent Clinic for the purpose of supporting my clinical notes. I understand this is optional and that I can refuse or withdraw my consent at any time without it affecting my care.

Client name: _____________________ Signature: _____________________ Date: ____________

If you have a question about your record, ask your clinician first: they hold your record, and they can pass on any question that is about how the software works.

What the software does, and who decides

Cogent Clinic is a writing tool. It helps your clinician draft session notes, letters, and similar documents faster, and helps them keep their notes organised in a folder for each client. It does not diagnose you, make treatment decisions, or predict anything about you. Your clinician is in charge of your care.

A few things are worth being clear about:

• Your clinician decides, not the software. The AI produces a first draft. Your clinician reads it, edits it, and chooses whether to use it. Nothing becomes part of your record until they have reviewed and approved it.
• No decision about you is made by AI alone. In the language of data-protection law, there is no decision about you made by automated means alone that has a legal or similarly significant effect.
• You can ask. If your clinician shares something that was drafted with AI help, they will tell you, and you can ask them about it at any time.

There is a fuller, plain-English walk-through of all of this at cogent.clinic/for-clients.

How your information is handled, and where it goes

• Your name is removed before the AI sees it. When your clinician uses the drafting feature, your name and any phone numbers, NHS numbers, dates of birth, email addresses, or postcodes are replaced with placeholders before the text is sent to the AI, and your clinician confirms this first. The AI, and the other companies Cogent Clinic works with behind the scenes, see text like "the client" or "PERSON 1" rather than your real name. The AI providers are contractually prevented from using your clinician's content to train their models.
• What is stored is kept encrypted in the UK. The list that links a placeholder back to your real name, and any saved session transcript, are stored encrypted on Cogent Clinic's UK systems, with access limited to a small number of authorised people and every access recorded. Cogent Clinic does have the technical ability to unlock stored content under those controls, so we do not claim that nobody there could ever read it; what we can promise is that your real name is removed before the text reaches the AI, and that access to anything stored is tightly controlled and logged.
• Live transcription uses a partner in the European Union. If your clinician uses live transcription, the audio streams directly from their browser to a speech-to-text partner at its European Union endpoint (Ireland) and does not pass through Cogent Clinic's systems. That partner keeps no audio after the session. Because this takes place within the European Economic Area, it is covered by the UK's adequacy regulations, so no additional transfer safeguards are required.

What categories of information are involved

The categories of information that may be processed about you while your clinician uses Cogent Clinic include:

• the text your clinician writes or dictates about you, with your name and other direct identifiers replaced by placeholders;
• the spoken audio of a session, where your clinician uses the live-transcription feature and you have consented to it being recorded for that purpose;
• the transcript of that audio, which Cogent Clinic stores locked (encrypted) on its UK systems, with access limited to a small number of authorised people and recorded;
• the clinician's working notes, formulation, and treatment plan, which mention you by placeholder rather than by name where possible.

The categories of information that are not routinely processed include your address, your full date of birth, your NHS number, your full email or phone number, and your full name. Where these appear in the clinician's input, they are replaced with placeholders before the AI sees them.

Your rights

You have legal rights about information held about you under UK GDPR and the Data Protection Act 2018. These rights include:

• the right to be informed about how your information is used (this notice is part of that);
• the right of access to a copy of the information held about you;
• the right to correction if something is wrong;
• the right to erasure in certain circumstances;
• the right to restrict processing in certain circumstances;
• the right to object to certain types of processing;
• the right to data portability for the parts of the record that are held electronically;
• the right to complain. You can make a data protection complaint directly to your clinician (who is the controller of your information), and they must acknowledge it and respond to it. If you are not satisfied with how your clinician handles it, you can then complain to the Information Commissioner's Office.

The right place to start is with your clinician. Your clinician is the person who decides what is in your record, who can access it, and how long it is kept. They are best placed to respond, and they will involve Cogent Clinic if a request needs us to do something on their behalf.

If you wish to complain about how your information is handled, you should first raise it with your clinician, who is responsible for your information. Your clinician must acknowledge your complaint in accordance with applicable data protection laws, including acknowledging it within the applicable statutory period and responding without undue delay. If you are unhappy with how your clinician has dealt with it, you can then raise a concern with the Information Commissioner's Office at ico.org.uk/concerns or by phone on 0303 123 1113.

If something goes wrong

If Cogent Clinic becomes aware of a security incident that may affect your information, we will tell your clinician within 24 hours of becoming aware of it, with the information we have at that point. Your clinician will then decide whether and how to tell you, based on their clinical and ethical obligations.

If your clinician makes a clinical decision based on a Cogent Clinic draft, the responsibility for that decision is theirs. Cogent Clinic is a writing tool. It does not make clinical decisions and is not a substitute for your clinician's judgement.

Who to contact

For anything about your record, contact your clinician.

For anything about how Cogent Clinic works as a piece of software:

Cogent Clinic Ltd Mearns Castle Golf Academy, Waterfoot Road, Glasgow G77 5RR Privacy email: [email protected] General contact: [email protected] Company number: SC887432 ICO registration: ZC132394

For independent advice or to make a complaint about how your information is handled:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF Web: ico.org.uk/concerns Phone: 0303 123 1113

If we change anything in this notice that matters to you, we will update it here and tell your clinician.