Privacy Notice
1. Who we are
Torinova Health Limited (Torinova) builds an AI ambient scribe and administrative-automation tools for GP practices. Registered office: 61 Bridge Street, Kington, United Kingdom, HR5 3DJ.
ICO registration number: ZC195821.
Contact for privacy matters: privacy@torinovahealth.co.uk, or 0161 457 3551 (+44 161 457 3551 from outside the UK).
Where a GP practice uses Torinova products, the practice is the controller of its patient data and Torinova acts as its processor under a written contract, on the practice’s documented instructions. Patient data is covered by your practice’s own privacy notice. This notice covers the personal data Torinova controls.
2. The personal data we collect, and why
- Practice and business contacts. Names, roles and organisational contact details of GP practice and primary-care staff, plus our correspondence, to introduce and provide Torinova services (legitimate interests, UK GDPR Article 6(1)(f), applied with the marketing rules in the Privacy and Electronic Communications Regulations).
- Website visitors. IP address and device/usage data for torinovahealth.co.uk, to run and secure the website (legitimate interests, Article 6(1)(f)).
- Enquiries, rights requests and complaints. Names, contact details and the content of your request, to respond, and to meet our legal obligations for information rights and complaints.
- Our team. Account, training and compliance records for the people who work on Torinova, to run and secure the organisation (legitimate interests, Article 6(1)(f); legal obligation for statutory records).
3. Where we get your data
Directly from you; from your organisation; from public and professional sources (for example NHS practice listings); and automatically when you use our website.
4. Who we share it with
Service providers under contract: Google (Workspace), Atlassian (Jira and Bitbucket), Netlify (website hosting, including messages sent through our contact form), Cloudflare (network security for our clinical infrastructure), Canva (design) and Anthropic (Claude, our AI assistant for internal work, never patient data). We do not sell personal data. We share data with regulators or authorities where the law requires it. Clinical AI processing for practices runs on Torinova-operated infrastructure; no third-party AI service receives that data.
5. Sending data outside the UK
Some providers process data outside the UK, in the United States and Australia. Those transfers rely on UK-recognised safeguards (the UK Addendum to the EU Standard Contractual Clauses or the UK International Data Transfer Agreement), or, for any provider without an executed addendum, on documented compensating controls (data minimisation and training opt-outs). Each provider’s safeguard status is recorded in our sub-processor register.
6. How long we keep it
Only as long as needed, per our retention schedule: outreach contacts until you object or after 24 months of inactivity (suppression list kept so we do not contact you again); correspondence, rights requests and complaints for 6 years; website logs short-lived. Details are in our Records Retention & Disposal Policy.
7. Your rights
You have the rights of access, rectification, erasure, restriction, portability and objection under the UK GDPR. Write to privacy@torinovahealth.co.uk; we respond within one month. We may ask you to clarify your request; where the law allows, the response period pauses while we wait.
8. Automated decision-making
Torinova makes no decision about you based solely on automated processing that produces legal or similarly significant effects.
9. Cookies
torinovahealth.co.uk sets no cookies unless you agree to analytics cookies in the banner shown on your first visit. If you do not choose, or you choose Reject, no analytics or advertising script loads and no such cookie is set.
If you choose Accept, we use the following to understand how the site is used:
- Google Analytics 4 (Google Ireland Limited) counts visits, the pages viewed, how visitors arrived (for example from a search or a link), their approximate location by country and city, and the type of device and browser. It also records when a contact or demo form is sent, but never what was written in it. Google Analytics does not log or store IP addresses. Its cookies (named _ga and _ga_*) last up to 2 years, and we keep the resulting reports for 14 months. Advertising features and Google signals are switched off.
Our lawful basis is your consent (UK GDPR Article 6(1)(a) and regulation 6 of PECR). These providers may transfer data outside the UK under the safeguards set out in their terms. You can withdraw consent at any time: choose and then Reject, and we will remove the analytics cookies this site set. The site works in full whichever you choose. None of this applies to Torinova’s clinical product, which handles patient data separately and never through these services. See also Security.
10. How to complain
Complain to us at privacy@torinovahealth.co.uk. We acknowledge within 30 days, investigate and tell you the outcome. You can also complain to the Information Commissioner’s Office (ICO) at ico.org.uk.
11. Changes to this notice
We update this notice when our processing changes and show the version and date at the top.