Privacy notice
How CliniPraxi collects, uses, protects and shares personal data under the UK GDPR, the EU GDPR and the Data Protection Act 2018.
1. Who we are
The data controller is To be confirmed (trading as CliniPraxi), company number To be confirmed, registered in England and Wales at To be confirmed. ICO registration: To be confirmed.
Privacy contact: To be confirmed.
For second opinions, the reviewing clinician acts under our instructions and professional duty of confidentiality.
2. Data we collect
Account data: email address, authentication records, display name, jurisdiction, declared professional registration and learning preferences.
Learning data: course progress, reflections, bookmarks, practice and timed assessment attempts, AI feedback requests, certificates and community submissions.
Patient service data (special category health data): your clinical question, uploaded reports, images and test results, consent records, the reviewer’s written opinion and a full access audit trail.
Technical data: device and browser type, sign-in times, security logs and your cookie choices.
3. Why we use it and our lawful bases
Providing your account, courses and requested services: contract (Article 6(1)(b)).
Security, fraud prevention, academic integrity and service improvement: legitimate interests (Article 6(1)(f)), balanced against your rights.
Health data for second opinions: your explicit consent (Article 9(2)(a)) and the provision of health care under the responsibility of a regulated professional (Article 9(2)(h) with DPA 2018 Schedule 1).
Record-keeping required by law and professional regulators: legal obligation (Article 6(1)(c)).
Optional cookies: consent, which you can withdraw at any time in Cookie settings.
4. Who we share it with
Assigned reviewing clinicians, only for the case they are assigned to.
Our hosting and infrastructure providers (Lovable Cloud), our email delivery provider and our AI model provider for formative learning feedback. AI feedback never receives patient health data.
Regulators, courts or law enforcement where the law requires it.
We never sell personal data or use health data for advertising.
5. International transfers
Data is hosted in the UK / EU region. Where a provider processes data outside the UK or EEA, we rely on adequacy regulations or the UK International Data Transfer Addendum / EU Standard Contractual Clauses.
6. How long we keep it
Second opinion records, uploaded documents and audit trails: 8 years from completion, in line with UK medical record guidance, then securely deleted.
Certificates and assessment records: for as long as the certificate may be verified, plus 6 years.
Account and learning data: until you close your account, then within 30 days, except where we must keep records longer.
Security logs: up to 12 months.
7. How we protect it
Encryption in transit and at rest, private storage for clinical documents, short-lived signed links, role-based access validated by the database, an append-only audit trail, and a completed Data Protection Impact Assessment (ref. CliniPrax-2129898291810).
8. Your rights
You can ask to access, correct, erase, restrict or port your data, object to processing, and withdraw consent at any time. You can submit a request from this page when signed in. We respond within one month.
You can complain to the Information Commissioner’s Office (ico.org.uk, 0303 123 1113) or your local supervisory authority.
9. Children
CliniPraxi is not intended for anyone under 18. A parent or guardian may request a second opinion on behalf of a child where they hold parental responsibility.
10. Changes
Last updated 15 October 2026. We will notify you of material changes by email or in the app.