Privacy Policy

1. Who we are

Cogent Clinic is a clinical practice environment and documentation assistant provided by Cogent Clinic Ltd, a company registered in the United Kingdom.

For the purposes of UK data protection law, Cogent Clinic Ltd is the data controller for the personal data described in this policy where we collect and use information about our clinician customers, website visitors, prospects, and business contacts.

In relation to content submitted by clinician customers for document generation, clinical workflow support (client folders, living formulation, supervision briefs), and reflective-thinking chat, our role is generally that of a data processor, acting on the clinician's instructions. The clinician remains the data controller for their patient data.

Controller name: Cogent Clinic Ltd
Product name: Cogent Clinic
Company number: SC887432
Registered address: Mearns Castle Golf Academy, Waterfoot Road, Glasgow, G77 5RR
Contact email for privacy matters: [email protected]
Website: www.cogent.clinic
Location: United Kingdom

2. What this policy covers

This policy explains how we collect, use, store, and protect personal data when:

• you visit our website,
• you contact us,
• you join a waitlist or request information,
• you become a clinician customer,
• you use the Cogent Clinic product, or
• you otherwise interact with us in a business capacity.

It also explains, at a high level, how data is handled when clinicians use the product to generate draft documentation.

3. The privacy approach

Cogent Clinic is designed around data minimisation. Patient-identifying details are tokenised client-side before content is sent for processing, which means identifiable patient information does not reach Cogent Clinic's servers in the normal course of operation, and the clinician reviews and controls what they submit.

No technical system is perfect, so Cogent describes the residual risks honestly and maintains contractual, security, and incident-response controls on the basis that personal data could still be involved in edge cases, misuse, or failures.

4. The personal data we collect

A. Information about website visitors and prospects

We may collect:

• name,
• email address,
• organisation or practice name,
• phone number if voluntarily provided,
• enquiry details,
• marketing preferences,
• website usage data such as IP address, browser type, pages viewed, referral source, and basic analytics events.

B. Information about clinician customers

We may collect:

• name,
• work email address,
• billing details,
• account credentials and MFA-related information,
• subscription and transaction records,
• support correspondence,
• usage metadata, such as feature usage, timestamps, document type selected, and model route used,
• audit logs and security logs.

C. Content processed through the product

When a clinician uses Cogent Clinic, content is submitted for several connected workflows: drafting documents, managing client folders, maintaining a living formulation, preparing for supervision, live session transcription, running a folder-scoped reflective-thinking chat, and running a documentation-completeness check on a finished draft.

Our design is that:

• directly identifying patient details are detected and replaced with placeholders (tokenised) in the clinician's browser before anything leaves the device,
• the mapping between placeholders and real names remains on the clinician's device, encrypted with a key derived from the clinician's password,
• we process only the de-identified content to generate drafts and to run the secondary surfaces (formulation suggestions, clinical chat, completeness checks),
• session transcripts captured through the live-transcription feature are encrypted client-side with the clinician's key and stored as ciphertext under the relevant client folder. We cannot read them; retention is indefinite and deletion is controlled by the clinician,
• live transcription audio streams directly from the clinician's browser to an EU-hosted speech-to-text service, with UK GDPR transfers covered by the UK Addendum to the EU SCCs (part of the sub-processor's Data Processing Addendum); Cogent Clinic Ltd has opted out of having customer audio or transcripts used for model training or benchmarking via the sub-processor's documented opt-out process; audio does not pass through our infrastructure,
• the AI provider we use for inference operates on inference-only contractual terms. Customer content is not used to train or fine-tune any model.

However, depending on product configuration, user behaviour, or failure modes, submitted content may still include personal data and may in some cases include special category data, including health information.

D. Payment and financial data

Payments are processed by Stripe, and Cogent does not store full payment card details directly.

5. How we use personal data

We use personal data to:

• operate and improve our website,
• respond to enquiries,
• manage waitlists, demos, and onboarding,
• create and manage customer accounts,
• provide the Cogent Clinic service,
• authenticate users and protect account security,
• process payments and maintain financial records,
• provide customer support,
• monitor service reliability, misuse, and security,
• maintain audit trails and accountability records,
• communicate service updates and important notices,
• send marketing communications where consent or another valid basis applies,
• comply with legal and regulatory obligations.

6. Our lawful bases

Depending on the context, we rely on one or more of the following lawful bases under UK GDPR:

Contract

Where processing is necessary to provide our service, manage an account, or respond to a request connected to entering into a contract.

Legitimate interests

Where processing is necessary for our legitimate interests, provided those interests are not overridden by your rights and interests. This includes:

• securing the platform,
• preventing misuse,
• improving the product,
• handling support,
• maintaining appropriate records.

Consent

Where you opt in to receive marketing communications or where consent is otherwise required.

Legal obligation

Where we must retain or disclose information to comply with tax, accounting, legal, or regulatory obligations.

Special category data

Where special category data is processed through the product, the clinician customer is usually the controller and is responsible for their own Article 9 condition. Our role is typically processor. In residual-risk cases where such data reaches our systems, processing is limited to what is necessary to provide the service securely and under the clinician's instructions.

7. Processor role for clinician-submitted content

For clinician-submitted content used to generate draft documentation, we generally act as a processor on behalf of the clinician customer.

That means:

• the clinician decides the purpose and lawful basis for using the tool in their practice,
• the clinician is responsible for ensuring they have an appropriate legal basis for processing patient information,
• we process content on their behalf to provide the service,
• our data processing agreement sets out the instructions, safeguards, and responsibilities between us and the clinician customer.

8. Sharing personal data

We may share personal data with carefully selected service providers and sub-processors that help us run the service, including providers for:

• cloud hosting (including our UK-resident database and object storage),
• AI inference (on inference-only contractual terms; customer content is not used to train any model),
• live speech-to-text transcription (audio streams directly from the clinician's browser to an EU-hosted service; UK GDPR transfers are covered by the UK Addendum to the EU SCCs within the sub-processor's Data Processing Addendum; Cogent Clinic Ltd has opted out of model training and benchmarking on audio or transcripts via the sub-processor's documented process; audio does not transit our infrastructure and the returned transcript is encrypted on the clinician's device and stored by us as ciphertext in the UK),
• authentication,
• payment processing,
• transactional email,
• error monitoring (metadata only, no clinical content),
• customer support,
• analytics (metadata only, no clinical content).

The live sub-processor list is published in the sub-processor register and kept up to date.

Personal data may also be disclosed where required by law, regulation, court order, or to establish, exercise, or defend legal claims.

Cogent does not sell personal data.

9. International transfers

Cogent Clinic is offered on a UK-only basis and is not offered to EU customers at this stage, with clinical-content processing kept inside the UK on UK-hosted infrastructure.

Some providers used for account, support, analytics, or payment operations may process data outside the UK, and where that happens an appropriate transfer mechanism is in place, including an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or another lawful safeguard. The transfer routes for the active providers are named in the sub-processor register.

10. Data retention

We keep personal data only for as long as necessary for the purposes we collected it for, including to satisfy legal, accounting, or regulatory requirements.

A fuller retention schedule is maintained separately. In summary:

• account data is retained during the customer relationship and for a short period after closure,
• financial records are retained for the legally required period,
• audit and usage metadata are retained only as long as needed for security and accountability,
• support correspondence is retained for a limited operational period,
• saved drafts are retained until the clinician deletes them or closes their account,
• encrypted session transcripts are retained indefinitely as ciphertext we cannot read, and are deleted manually by the clinician or automatically on client-folder or account deletion,
• folder-scoped chat conversations are retained until the clinician deletes the conversation or the folder.

11. Security

We use technical and organisational measures intended to protect personal data, including:

• encryption in transit,
• encryption at rest where appropriate,
• access controls and least-privilege permissions,
• MFA for accounts,
• logging and monitoring,
• vulnerability management,
• documented retention controls,
• incident response procedures.

No method of transmission or storage is completely secure, but we take data protection seriously and design the service to minimise exposure.

12. Personal data breach handling

We maintain an incident response plan for data breaches and security incidents. If a personal data breach occurs, we will assess it promptly and, where required, notify:

• the Information Commissioner's Office, and/or
• affected customers or other affected persons, within the timelines required by law.

Where we act as processor, we will notify the relevant clinician controller without undue delay in line with our contractual obligations.

13. Your rights

Depending on the context, you may have rights under UK data protection law, including the right to:

• access your personal data,
• rectify inaccurate data,
• erase your data,
• restrict processing,
• object to processing,
• data portability,
• withdraw consent where processing relies on consent,
• complain to the ICO.

These rights are not absolute and may depend on our role.

If you are a patient whose clinician has used Cogent Clinic, your rights will usually need to be exercised through your clinician as the controller of your clinical data.

14. Cookies and analytics

The website may use cookies or similar technologies for:

• essential site functionality,
• analytics,
• performance monitoring,
• marketing, if enabled.

Full details of the cookies and similar technologies used, and the controls available to you, are in our Cookie Policy.

15. Complaints

If you have concerns about how we handle your personal data, please contact us first at [email protected].

ICO registration: ZC132394
Data Protection Lead: Dr Aisha Tariq, Director, Cogent Clinic Ltd

You also have the right to complain to the Information Commissioner's Office: https://ico.org.uk

16. Changes to this policy

We may update this policy from time to time to reflect legal, technical, or operational changes. The latest version will be published on the website with the updated date.