Privacy Policy

1. Introduction

ClinWell ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our healthcare management platform.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and applicable healthcare data protection standards including NHS Data Security and Protection Toolkit requirements.

2. Information We Collect

Personal Information

• Name and contact details
• Date of birth and NHS number
• Medical history and clinical records
• Appointment and consultation information
• Insurance and billing details

Technical Information

• IP address and browser type
• Device information and operating system
• Usage patterns and access logs

3. How We Use Your Information

We use your information to:

• Provide healthcare management services
• Schedule and manage appointments
• Process billing and insurance claims
• Communicate with healthcare providers
• Improve our services and platform functionality
• Comply with legal and regulatory requirements

4. Data Security

We implement appropriate technical and organisational measures to protect your personal data, including:

• Encryption in transit and at rest
• Access controls and authentication
• Regular security audits and assessments
• Staff training on data protection
• Incident response procedures

5. Your Rights

Under UK GDPR, you have the right to:

• Access your personal data
• Rectify inaccurate personal data
• Erase your personal data (right to be forgotten)
• Restrict processing of your personal data
• Data portability
• Object to processing
• Withdraw consent at any time

6. AI-Assisted Features

ClinWell includes AI-assisted features that support clinic staff with drafting correspondence and transcribing dictation. These features operate under strict controls:

• A qualified clinician reviews all AI-generated content before it becomes part of any patient record or is sent to anyone. The system makes no autonomous clinical decisions.
• AI processing is disabled by default and only operates where the platform's data protection controls and processor agreements permit it. Where AI processing involves a processor outside the UK, it takes place only under safeguards compliant with UK GDPR.
• Patient data is never used to train AI models.
• AI-generated content is identified as such within the platform.
• Your data protection rights are unaffected: you may raise any query or objection regarding AI-assisted processing with your clinic or with our Data Protection Officer (contact details below).

7. Data Retention

We retain personal data in accordance with NHS Records Management Code of Practice and applicable legal requirements. Medical records are typically retained for a minimum of 8 years after the last treatment, or longer where required by law.

8. Contact Us

For privacy-related enquiries or to exercise your data protection rights, please contact our Data Protection Officer:

9. Supervisory Authority

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) if you believe your data protection rights have been infringed.

ICO Website: https://ico.org.uk