Privacy Policy

01Introduction & Scope

Clinstrux ("Clinstrux", "we", "us", "our") provides a clinical workflow platform for pharmacists at app.clinstrux.com, a companion community at clinby.clinstrux.com, and this marketing site at clinstrux.com (together, the "Services"). This Privacy Policy explains how we collect, use, disclose, and safeguard information when you visit our website, register for an account, use the platform, interact with our Clinby AI companion, or participate in the Clinby Community.

This policy is written to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. If you are located outside the United Kingdom, your information may still be processed in accordance with this policy and applicable local law.

02Who We Are

The data controller responsible for your information is:

Clinstrux Ltd
Registered in England and Wales
Registered office: London, United Kingdom
Company number: [to be inserted upon incorporation]
Email: clinstrux@clinstrux.com

References to "Clinstrux" throughout this policy mean Clinstrux Ltd unless the context requires otherwise.

03Information We Collect

3.1 Account & registration information

When you create an account — either directly or via Google Sign-In — we collect your name, email address, job title, profile picture or avatar selection, and (optionally) your institution or employer. If you register on behalf of an organisation, we also collect your organisation's name and the roles assigned to its members (individual, admin, or member).

3.2 Organisation data

If you create or join an Organisation on the platform, we process invitation records, membership roles, and administrative actions (such as adding, removing, or promoting members). Organisation administrators have read-only visibility into certain case metadata for members of their organisation — see Section 4 for what this does and does not include.

3.3 Clinical case & workflow data

The core function of the platform is to let you enter clinical scenarios (diagnoses, medications, allergies, renal function, and similar structured variables) into a workflow (such as ABX, MEDREV, POLY, CKD, HF, DM, COPD, ANTICOAG, or DEPRESC) in order to generate a structured recommendation. This is described fully in Section 4.

3.4 Clinby interactions

When you interact with Clinby — our in-platform AI companion — we process the messages you send it, the workflow context it is given in order to answer you, and its responses. See Section 5.

3.5 Clinby Community content

If you participate in the Clinby Community, we collect the posts, comments, and votes you submit, along with your community profile (display name, avatar, and role). See Section 6.

3.6 Early access & contact form submissions

If you submit our "Request Access" form, we collect your name, email address, role, institution, and any free-text answers you provide about your intended use case, workflow gaps, or feature requests.

3.7 Cookies & similar technologies

We use a small number of cookies and browser storage mechanisms, described in full in Section 13.

3.8 Technical & usage data

Like most web services, our hosting and analytics infrastructure automatically logs technical information such as IP address, browser type, device type, referring URL, pages visited, and timestamps, for security and service-improvement purposes.

04Clinical Case Data — Please Read Carefully

Where a user nonetheless enters clinical scenario data — including data that describes a real patient in a de-identified or hypothetical form — we process that data as follows:

• Case data is stored in our database (hosted via Supabase) and associated with your account and, where applicable, your organisation;
• Case data is used to generate the structured recommendation, clinical rationale, and documentation output you request;
• Where you are a member of an Organisation, your organisation's administrator(s) may view certain case metadata (reference, workflow type, status, current step, and risk level) for oversight and clinical governance purposes, but cannot edit your case or view full clinical detail beyond that metadata, to preserve clinical accountability;
• Case data is not knowingly used to train third-party foundation models on an ongoing basis without an appropriate data processing agreement being in place with the relevant sub-processor (see Section 8).

If you are a healthcare organisation considering using Clinstrux with real patient data as part of a clinical service, please contact us at clinstrux@clinstrux.com before doing so, so that we can discuss appropriate safeguards, a data processing agreement, and whether the platform is currently fit for that purpose.

05Clinby & AI Processing

Clinby is an LLM-powered clinical companion built into the platform. When you interact with Clinby — whether via chat, an in-context explanation, or a proactive suggestion — the platform sends relevant context (such as your current workflow step and the clinical variables you have entered) to our underlying AI model provider(s) in order to generate a response.

We take reasonable steps to work with AI model providers who offer appropriate data protection commitments, and we do not permit our AI sub-processors to use your data to train their general-purpose models without a specific agreement in place. Clinby's suggestions are generated using structured, explainable workflow logic combined with language-model assistance; they are informational in nature and do not constitute medical advice. You, the pharmacist, remain solely responsible for any clinical decision made using the platform.

06Clinby Community

The Clinby Community (hosted at clinby.clinstrux.com) is a moderated discussion space for pharmacists, sharing the same account and login as the main platform. When you post, comment, or vote in the community:

• Your display name, avatar, job title, and post/comment history are visible to other logged-in members;
• Content you post is reviewed by human moderators (not automated filters) for compliance with our community guidelines, which strictly prohibit sharing identifiable patient information;
• We retain community content for as long as your account is active, or as needed for moderation and audit records, even if you later leave your organisation;
• Community content is not intended for direct patient care decisions, consistent with the disclaimer shown throughout the community.

If you believe a post contains identifiable patient information or otherwise breaches our community guidelines, please report it or contact clinby@clinstrux.com.

07Legal Basis & Purposes of Processing

Under UK GDPR, we rely on the following legal bases depending on the purpose of processing:

08Sharing Your Information

We do not sell your personal information. We share information only with the following categories of recipients, each acting under appropriate contractual safeguards:

• Infrastructure & hosting providers — including Vercel (application hosting) and Supabase (database, authentication, and file storage) — who process data on our behalf to operate the Services;
• Authentication providers — including Google, where you choose to sign in with Google;
• AI model providers — who process the content of your Clinby interactions in order to generate responses, as described in Section 5;
• Form and communications tools — including our form-processing provider for the Request Access form, and our email provider for transactional communications;
• Your organisation — where applicable, limited to the case metadata described in Section 4;
• Professional advisers and regulators — where necessary to comply with a legal obligation, enforce our Terms, or protect the rights, property, or safety of Clinstrux, our users, or others;
• A successor entity — in the event of a merger, acquisition, or sale of assets, subject to this policy continuing to apply to your information.

09International Data Transfers

Some of our sub-processors operate outside the United Kingdom, including in the United States and the European Economic Area. Where we transfer personal information internationally, we rely on appropriate safeguards recognised under UK GDPR, such as the UK International Data Transfer Agreement (IDTA), the EU Standard Contractual Clauses (as incorporated into UK law), or a determination that the recipient jurisdiction offers an adequate level of protection.

10Data Retention

We retain personal information for as long as necessary to provide the Services and for the following periods thereafter:

• Account data: for the life of your account, and for up to 12 months after closure to allow for reactivation, fraud prevention, and legal compliance;
• Clinical case & workflow data: retained as part of your case history until you delete it or close your account, after which it is deleted or anonymised within a reasonable period;
• Community content: retained as described in Section 6;
• Request Access / contact form data: retained for up to 24 months for follow-up, or until you ask us to delete it;
• Technical and log data: typically retained for up to 12 months for security and diagnostic purposes.

We may retain information for longer where required by law, to resolve disputes, or to enforce our agreements.

11Security

We apply industry-standard technical and organisational measures to protect your information, including encryption in transit (TLS/HTTPS), database-level access controls and row-level security policies restricting who can view case and organisation data, authentication safeguards, and least-privilege access for our own team. No method of transmission or storage is 100% secure; if you believe your account has been compromised, please contact us immediately at clinstrux@clinstrux.com.

12Your Rights

Under UK GDPR, you have the right to:

• Access the personal information we hold about you;
• Rectify inaccurate or incomplete information;
• Erase your information in certain circumstances ("right to be forgotten");
• Restrict our processing of your information in certain circumstances;
• Object to processing based on legitimate interests, including direct marketing;
• Data portability — receive your information in a structured, machine-readable format, or have it transmitted to another controller;
• Withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing before withdrawal.

To exercise any of these rights, contact us at clinstrux@clinstrux.com. We will respond within one month, as required by law. We may need to verify your identity before actioning certain requests.

13Cookies

We use the following categories of cookies and local storage:

You can manage or withdraw your cookie preferences at any time via the cookie banner shown on our sites, or through your browser settings. Disabling strictly necessary cookies may prevent you from logging in or using core features.

14Children's Privacy

Clinstrux is intended for use by qualified or trainee healthcare professionals and is not directed at, or intended for use by, children. We do not knowingly collect personal information from anyone under the age of 18. If you believe a child has provided us with personal information, please contact us so that we can delete it.

15Automated Decision-Making

Clinstrux's workflows and Clinby's suggestions use structured logic and AI assistance to surface recommendations, explanations, and flags. These outputs are decision-support only: no automated process makes a final clinical decision, and no automated process produces a legal or similarly significant effect concerning you without the involvement of the pharmacist using the platform. The pharmacist using Clinstrux is always the human decision-maker of record.

16Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes to our practices, technology, legal requirements, or the Services themselves. We will update the "Last updated" date at the top of this page, and where changes are material, we will take reasonable steps to notify registered users (such as by email or an in-platform notice).

17Contact & Complaints

If you have any questions, concerns, or requests regarding this Privacy Policy or our handling of your information, please contact:

General enquiries: clinstrux@clinstrux.com
Clinby Community: clinby@clinstrux.com

If you are not satisfied with our response, you have the right to lodge a complaint with the UK Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, United Kingdom
ico.org.uk — Helpline: 0303 123 1113