1. Who we are

Psychiatry Ink Ltd
71–75 Shelton Street
Covent Garden
London, WC2H 9JQ
United Kingdom

Registered in England and Wales.
Company number: 17275704.

General enquiries:

hello@psychiatry.ink

Data protection enquiries:

data-protection@psychiatry.ink

EU/EEA and Swiss representative (Art. 27 GDPR / Swiss FADP)

Psychiatry Ink Ltd has appointed Data Protection Representative Limited, trading as DataRep, as its Data Protection Representative in the European Union / European Economic Area under the EU GDPR (Article 27) and in Switzerland under the Swiss Federal Act on Data Protection (FADP).

If you are located in the EU/EEA or Switzerland and wish to raise a question about the processing of your personal data, or exercise your data protection rights, you may contact DataRep on our behalf by email, online form or post.

Email (please quote "Psychiatry Ink Ltd" in the subject line):

datarequest@datarep.com

Online form:

https://www.datarep.com/data-request

By post: please address postal correspondence to "DataRep" and not to "Psychiatry Ink Ltd". The relevant DataRep postal contact address for your country is listed in DataRep’s representative contact summary.

The appointment of a representative does not affect the responsibility of Psychiatry Ink Ltd as the controller.

2. Scope of this notice

This notice applies to:

• visitors to our public websites, including psychiatry.ink and related country or language versions;
• users who create an account or use Psychiatry.Ink;
• organisations that subscribe to Psychiatry.Ink;
• people who contact us for support, billing, security, or legal enquiries;
• limited clinical or patient-related data processed inside the service on behalf of professional users or healthcare organisations.

This notice does not replace the privacy notice that a doctor, clinic, hospital, or healthcare organisation must provide to its own patients.

3. Our role: controller and processor

For website, account, billing, support, security, marketing, and business-administration data, Psychiatry Ink Ltd is usually the controller.

For patient-related clinical content entered by a professional user or organisation into the Psychiatry.Ink workspace, the customer is usually the controller and Psychiatry Ink Ltd is usually the processor. In that case, we process the data only on the customer’s documented instructions and under the applicable Data Processing Agreement.

Some product modes are designed to minimise server-side patient identifiers. For example, patient names, dates of birth, and patient-to-document mapping may remain in the clinician’s local encrypted vault where that configuration is enabled. Users remain responsible for using the privacy settings correctly and for avoiding unnecessary identifiers in AI prompts, dictation, support tickets, or free-text fields.

4. Personal data we collect

Depending on how you use the service, we may process:

Account and organisation data

Name, professional title, email address, organisation name, role, login information, subscription status, country, language, and account settings.

Billing and payment data

Plan, invoice details, billing address, VAT or tax details where applicable, payment status, transaction identifiers, and limited payment metadata. Card details are normally processed by our payment provider and are not stored by Psychiatry Ink Ltd.

Support and communication data

Emails, contact-form messages, support requests, security reports, attachments you provide, and related correspondence metadata.

Technical and security data

IP address, device information, browser type, operating system, login times, error logs, audit logs, access logs, cookie identifiers, security events, and diagnostic telemetry.

Product usage data

Feature usage, credit usage, AI model selected, token or API usage metadata, document type selected, generation status, error reports, and user preferences.

Clinical workspace data

Clinical notes, dictated text, generated drafts, medication notes, laboratory values, templates, risk-assessment text, and other content entered or generated by the user. This data may include health data or other special category data if entered by the user.

AI processing data

Text, prompts, instructions, clinical snippets, de-identified material, dictated content, audio snippets, generated outputs, and model metadata may be processed by AI providers when the user uses AI features.

5. Data we ask users not to submit unnecessarily

Users should not submit patient names, direct identifiers, unnecessary addresses, unnecessary legal identifiers, or other excessive personal data to AI features, support tickets, or contact forms unless this is permitted under their local law, professional obligations, patient information framework, and the applicable agreement with Psychiatry Ink Ltd.

6. Purposes of processing

We process personal data to:

• provide, maintain, secure, and improve Psychiatry.Ink;
• create and manage user accounts and organisations;
• provide documentation, dictation, template, AI, medication, laboratory, and workflow functions;
• process subscriptions, invoices, payments, and credits;
• provide support and respond to enquiries;
• monitor security, prevent abuse, investigate incidents, and protect the service;
• comply with legal, regulatory, tax, accounting, and contractual obligations;
• send service notices, security notices, legal updates, and product communications;
• analyse aggregated or de-identified usage trends to improve performance and reliability.

7. Lawful bases

Where Psychiatry Ink Ltd acts as controller, we rely on one or more of the following lawful bases, depending on context:

• Contract: to provide the service, manage accounts, process subscriptions, and provide support.
• Legal obligation: to comply with tax, accounting, company, security, and regulatory obligations.
• Legitimate interests: to secure, maintain, improve, and administer the service, prevent fraud or misuse, and communicate with professional users.
• Consent: for non-essential cookies, optional marketing communications, or optional features where consent is required.

Where we process clinical or patient-related data as a processor, the customer is responsible for identifying the applicable lawful basis and any Article 9 or equivalent condition for special category health data.

8. Special category data and clinical data

Psychiatry.Ink is intended for psychiatric documentation and may process health data if users enter it. Health data is sensitive. We apply technical and organisational measures intended to reduce unnecessary exposure, including encryption, access control, audit logging, minimisation, and de-identification features where available.

Users must ensure that real patient data is processed only where they have the required legal basis, professional authority, patient information framework, institutional approval, and data-processing agreement.

9. AI providers and model processing

Psychiatry.Ink may use external AI providers to provide dictation, transcription, summarisation, drafting, editing, document generation, and clinical text-support functions. Depending on the selected feature and model, providers may include:

• OpenAI;
• Google / Gemini;
• DeepSeek;
• Mistral;
• other providers listed in our sub-processor documentation.

The data sent to AI providers depends on the feature used, the model selected, and the user’s privacy settings. We aim to minimise identifiers and unnecessary clinical details. Users must review all AI-generated outputs before clinical use.

We do not authorise AI providers to use customer clinical content for unrelated purposes. Provider-specific retention, abuse-monitoring, and security controls are described in the applicable provider terms and contractual documents.

10. Cookies and similar technologies

We use strictly necessary cookies to operate the website and service. We use non-essential cookies, such as analytics or marketing cookies, only where enabled and where required consent has been obtained.

11. Sharing personal data

We may share personal data with:

• hosting and infrastructure providers;
• database and authentication providers;
• AI, transcription, and language-model providers;
• payment and billing providers;
• email and communication providers;
• security, logging, monitoring, and analytics providers;
• professional advisers, auditors, insurers, and legal representatives;
• public authorities where required by law.

A current list of sub-processors is available on request and in the applicable Data Processing Agreement.

12. International transfers

Psychiatry Ink Ltd is based in the United Kingdom. Some providers may process data in the UK, EEA, United States, or other countries. Where data is transferred internationally, we use appropriate safeguards where required, such as adequacy decisions, the UK International Data Transfer Agreement, the UK Addendum to EU Standard Contractual Clauses, EU Standard Contractual Clauses, or other legally recognised safeguards.

13. Retention

We retain personal data only for as long as necessary for the purposes described in this notice, unless a longer period is required by law or needed to establish, exercise, or defend legal claims.

Indicative retention periods by data category:

• Account and organisation data: for the life of the account, then deleted or anonymised after closure according to our retention schedule.
• Billing, invoice, and tax records: for the statutory tax and accounting retention periods.
• Support correspondence: kept only as long as needed to handle the enquiry, unless needed longer for legal or security reasons.
• Security and audit logs: kept for a limited period appropriate to security needs, unless needed longer for investigation.
• Clinical workspace data: controlled by the customer’s configuration, retention settings, deletion requests, and applicable Data Processing Agreement.
• Backups: overwritten or deleted on a rolling basis according to the backup retention schedule.
• Dictation or audio data: not stored by default where technically configured; if stored for processing or troubleshooting, deleted within a short, defined period.

Account closure and deletion windows: if you cancel your subscription, your account becomes dormant and you can reactivate it within 90 days; if you do not, your account and all associated personal data are permanently deleted at the end of that 90-day period. If you request account deletion directly, your subscription is cancelled immediately and your account enters a 30-day grace period during which you can cancel the deletion; after 30 days your account and all associated personal data are permanently deleted. Data shared into organisations you do not solely control, and records subject to statutory retention duties, are handled separately as described in this notice.

14. Security

We use technical and organisational measures designed to protect personal data, including encryption in transit, access controls, audit logs, infrastructure security controls, role-based access, and product-level privacy settings. Some modes include client-side encrypted local storage so that direct patient identifiers and mappings remain on the user’s device.

No internet service is completely secure. Users must protect their own devices, passwords, local encryption keys, browser profiles, and institutional access controls.

15. Your rights

Depending on your location and the applicable law, you may have rights to:

• access your personal data;
• correct inaccurate data;
• delete data;
• restrict processing;
• object to processing;
• receive a portable copy of data;
• withdraw consent where processing is based on consent;
• complain to a data protection authority.

To exercise these rights, contact:

data-protection@psychiatry.ink

If we process patient-related data only as a processor, we may need to forward the request to the relevant doctor, clinic, or organisation acting as controller.

16. Supervisory authorities

For UK-related data protection matters, you may contact the Information Commissioner’s Office (ICO).

For EU/EEA-related matters, you may contact your local supervisory authority. If an EU/EEA representative is required and appointed, their details will be shown above.

17. Children

Psychiatry.Ink is not directed at children and is intended for professional users. Clinical users may document care relating to minors only where legally and professionally authorised.

18. Changes to this notice

We may update this Privacy Notice from time to time. The latest version will be published on this page with the updated date. Material changes may also be communicated by email, in-app notice, or account notice.