Privacy notice.

What we collect

• Account data: your name, email and a hashed password. For an organisation account, the organisation name.
• Workspace data: the chats, messages, patient profiles and audit events you create.
• Technical data: IP address, browser user agent, session cookie and the timestamp of each request.
• Analytics data: only if you accept the cookie banner. Anonymised page views through Google Analytics 4. The default is denied.

What we do not collect

• Personal data about you from third parties.
• Advertising pixels before you consent.

Where it is processed

Your account, your workspace data and your audit events are held on our own infrastructure in the EU/UK. Literature retrieval runs on that same infrastructure and never leaves it.

Writing the answer is different. Your prompt and the retrieved evidence are sent to our language-model provider, MiniMax, to generate a response. That processing happens outside the EU/UK.

Do not enter identifiable patient data. A patient profile built from a name, date of birth and history is personal data in our hands the moment you type it, and it goes straight to the model provider with the rest of the prompt. Use initials or a case reference. Corporate deployments can be pointed at an internally hosted model instead, which removes this transfer entirely.

How we use it

Account data authenticates you and runs the service. Workspace data powers the service for you and is not used to train models. Technical data covers security, rate limiting and diagnostics. Analytics data is read in aggregate to decide which pages need work.

Retention

• Account data: kept while the account is active, deleted 30 days after closure.
• Workspace data: kept while the account is active. Soft-deletable on request, hard-deletable in writing.
• Audit events: kept for the period required by the kind of work the workspace is used for.
• Analytics data: 14 months by default in GA4, configurable.

Your rights

Under UK GDPR you can ask to see, correct, erase, restrict or export your data, and you can object to our processing it. Email us with the subject line "Privacy request" and we reply within 30 days.

Contact

Data controller: Biomedical Guru Ltd. Email: privacy@biomedical.guru. Postal address on request.

Last updated: 2026-11. We will tell account holders about any material change.