1. Who we are
Kinetix AI Labs Ltd (“Kinetix”, “we”, “us”) is a company registered in England and Wales, company number 17117531, with its registered office at 1 Windermere Gardens, Ilford, England, IG4 5BZ. We are registered with the Information Commissioner’s Office (ICO), registration number ZC207181.
We build GPCopilot, clinician-facing software that helps NHS GP practices code clinical correspondence.
2. Scope of this notice
This notice covers two different relationships, and explains which applies in each case:
- This website. If you browse kinetix-labs.ai or submit an enquiry through our contact form, Kinetix is the data controller for that information.
- GPCopilot.Where GPCopilot is deployed at an NHS GP practice, that practice is the data controller for its patients’ data and is responsible for its own patient-facing privacy information (for example, a practice leaflet or website notice). Kinetix acts as a data processor, handling that data strictly on the practice’s instructions under a written agreement. This notice explains, at a general level, what personal data GPCopilot is designed to process and why, so that practices, clinicians and patients can understand how it works — it does not replace the practice’s own notice.
Important: as of the date at the top of this notice, GPCopilot processes only synthetic, non-patient development data. No real patient data is currently processed, and no live pilot involving real patients has begun. The description below of how GPCopilot handles clinical data describes what will apply once real-patient use begins, under a signed agreement with the practice concerned.
3. Personal data we collect, and why
Website enquiries
If you submit our contact form (for example, to request a demo), we collect the information you provide: your name, email address, organisation, role, and any message. We use this to respond to your enquiry, arrange a demo and, if you become a customer, to set up and manage that relationship.
GPCopilot, once live at a practice
GPCopilot is designed to process, on behalf of the GP practice:
- Clinical correspondence uploaded by an authenticated clinician (for example, hospital discharge summaries or clinic letters)
- Clinical facts extracted from that correspondence
- Candidate and confirmed SNOMED CT / dm+d clinical codes
- The identity of the clinician using the system and their decision to accept, reject or defer a suggested code
- System access and activity logs, used for security monitoring and audit
GPCopilot does not write to the GP clinical record or any other NHS system in its current release — a clinician always makes the final decision.
4. Our legal basis for processing
| Data | Kinetix’s role | Legal basis |
|---|---|---|
| Website enquiries | Controller | Legitimate interests (responding to your enquiry) and, where it leads to a contract, steps taken at your request before entering into one |
| GPCopilot clinical data | Processor | Determined by the GP practice as data controller — typically the provision of health or care, and, for special category data, health/care purposes under UK GDPR Article 9. Kinetix processes this data only on the practice’s documented instructions, under a written data processing agreement. |
We never rely on Kinetix’s own consent as the legal basis for processing patient data — that determination belongs to the GP practice.
5. Who we share data with
We use the following organisations to help us operate our website and GPCopilot. They only process personal data on our instructions, under contract:
- Microsoft Azure (UK South)— cloud hosting for GPCopilot’s systems and data storage.
- Azure OpenAI and Azure AI Foundry — used within GPCopilot to help extract and interpret clinical documents.
- GitHub — hosts our source code. No patient data is stored here.
- NHS TRUD — supplies the SNOMED CT / dm+d reference terminology we use; this does not involve any personal data.
We do not sell personal data, and we do not share it with any third party for their own marketing purposes.
6. Where your data is stored
Data processed through GPCopilot is stored in Microsoft Azure’s UK South region. We don’t transfer personal data outside the UK. If that changes, we’ll update this notice and put appropriate safeguards in place first.
7. Cookies and website tracking
This website does not currently use cookies, analytics, or any tracking technology beyond what’s strictly necessary for the site to function. If we introduce analytics or similar tools in future, we’ll update this notice and, where required, ask for your consent first.
8. How long we keep personal data
- Website enquiries:we keep your details for as long as needed to respond to your enquiry and follow up afterwards, and delete them when no longer needed — unless you become a customer, in which case we retain what’s needed for that relationship.
- GPCopilot clinical data: retention is set out in the data processing agreement with each GP practice customer, in line with NHS records management requirements, since the practice — not Kinetix — is the data controller responsible for that decision.
9. Automated decision-making
GPCopilot never makes a fully automated decision about a patient’s care or record. It presents suggested clinical codes for a human clinician to accept, reject or defer — the clinician always makes the final call.
10. Your rights
Depending on our role, you have the right to ask us to: confirm what personal data we hold about you and give you a copy (access); correct inaccurate data (rectification); delete it (erasure); restrict or object to processing; and receive data you provided to us in a portable format.
- If your query relates to this website or your enquiry to us, contact us using the details below and we’ll respond within one month.
- If your query relates to your own patient record and GPCopilot, please contact your GP practice first — they are the data controller and responsible for your request. We support the practice in responding, but can’t act on a patient request directly.
11. Contact us
Email us at ram.bade@kinetix-labs.ai. Kinetix’s Data Protection Officer, Radha Muthuswamy, oversees our compliance with data protection law and can be reached via the same address — please mark your message “for the attention of the DPO.”
12. Complaints
If you’re unhappy with how we’ve handled your personal data, we’d like the chance to put it right — please contact us first. You also have the right to complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113.
13. Changes to this notice
We review this notice at least once a year, and sooner if what we collect or why materially changes. We’ll update the date at the top of this page whenever we do.