Privacy Policy

1. Who We Are

Neurocuole Ltd [Company Registration: PLACEHOLDER — to be updated upon registration] is a clinical health technology platform registered in England and Wales. We operate the Neurocuole platform — a secure, multi-organisation clinical record management and communication system used by registered healthcare organisations and practitioners.

Neurocuole acts as both a Data Controller (for platform infrastructure, user accounts and consent management) and a Data Processor (processing clinical data on behalf of registered healthcare organisations that are Joint Data Controllers).

Registered Address: [PLACEHOLDER — registered address to be added]

2. Data We Collect

2.1 Platform Users (Clinicians and Administrators)

• Full name, professional title and job role
• Work email address and contact details
• Professional registration number (e.g. GMC, NMC)
• Login activity, session logs and audit trails
• Communications sent via the platform

2.2 Patients (with consent)

• Personal identifiers: name, date of birth, national patient identifier (e.g. NHS number)
• Contact details: address, phone number, email
• Clinical history: diagnoses, conditions, procedures, medications, allergies
• Clinical correspondence: letters, referrals, discharge summaries
• Appointments and encounter records
• Diagnostic results and investigation reports
• Care plans and clinical observations
• Consent records and consent audit trail

2.3 Automatically Collected Data

• IP addresses and device/browser information (security and fraud prevention only)
• Access logs and session timestamps
• Error logs (anonymised for technical diagnostics)

3. How We Use Your Data

4. Legal Basis for Processing

We rely on the following legal bases depending on jurisdiction:

United Kingdom

• Article 6(1)(b) — Contract performance (user accounts, service delivery)
• Article 6(1)(c) — Legal obligation (audit, retention requirements)
• Article 6(1)(e) — Public task (clinical care)
• Article 6(1)(f) — Legitimate interests (security, fraud prevention)
• Article 9(2)(h) — Health or social care purposes (clinical data)
• Article 9(2)(a) — Explicit consent (patient-initiated consent portal)
• Data Protection Act 2018 — Schedule 1, Part 1, Paragraph 2

Republic of Ireland

• Health Research Regulations 2018; Data Protection Act 2018 (Ireland)
• Supervised by the Data Protection Commission (DPC)

United Arab Emirates

• UAE Federal Law No. 45 of 2021 — Personal Data Protection Law (PDPL)
• DHA and MOHAP health data regulations where applicable
• Consent and legitimate interest as defined under UAE PDPL

5. Who We Share Data With

We do not sell personal data. We share data only as described below:

Healthcare Organisations (Joint Data Controllers)

Registered healthcare organisations using the Neurocuole platform are Joint Data Controllers for the clinical records of their patients. They access data only within the scope of the patient's consent and have signed our Data Processing Agreement.

Sub-processors (Infrastructure)

Legal Disclosure

We may disclose data where required by law, court order or regulatory authority. We will notify affected individuals where legally permitted to do so.

6. International Transfers

Data is primarily stored and processed in the United Kingdom and the European Economic Area using Microsoft Azure infrastructure. All transfers outside the UK/EEA are governed by appropriate safeguards including:

• UK Adequacy Regulations for EEA transfers
• Standard Contractual Clauses (SCCs) for transfers to non-adequate countries
• Binding Corporate Rules where applicable

For UAE-based operations, data may be stored on Azure UAE North / West Africa infrastructure and is subject to UAE PDPL transfer requirements.

7. How Long We Keep Data

8. How We Protect Your Data

• Encryption at rest: All databases and blob storage encrypted with AES-256
• Encryption in transit: TLS 1.2+ enforced on all connections; HSTS enabled
• Access control: Role-based permissions; multi-factor authentication required for all staff
• Audit trails: Every data access, modification and export permanently logged
• Penetration testing: Regular third-party security assessments
• Incident response: Breach notification to ICO within 72 hours as required by UK GDPR Article 33
• Infrastructure: Microsoft Azure ISO 27001 / SOC 2 Type II certified data centres

9. Your Rights

Under UK GDPR and applicable law, you have the following rights:

To exercise any of these rights, contact us at privacy@neurocuole.net. We will respond within 30 days.

10. Cookies

The Neurocuole platform uses only strictly necessary cookies required for authentication, session management and security. We do not use advertising, tracking or analytics cookies.

11. Children

The Neurocuole platform handles clinical records for patients of all ages, including children, when instructed by registered healthcare organisations. Processing of children's data is carried out under Article 9(2)(h) (health purposes) with appropriate safeguards. Children's records are retained in accordance with NHS and applicable national records management guidelines.

Parents and legal guardians may exercise data rights on behalf of children under 16.

12. Changes to This Policy

We review and update this Privacy Policy periodically to reflect changes in law, technology or our practices. Material changes will be notified to registered users by email and to patients via updated consent forms. The "Last updated" date at the top of this page indicates when the most recent changes were made.

Continued use of the Neurocuole platform after notification of material changes constitutes acceptance of the updated policy.

13. Contact Us