Privacy Policy

Last updated: 19 July 2026

CDMtools provides clinical decision support tools for NHS primary care clinicians. This policy explains what information is processed when the tools are used, and how it is protected.

What we collect

Pseudonymised reference identifiers generated at the point of use, for audit and continuity purposes only
Session and usage data (which tool was used, when, and by which authenticated clinician account)
Clinician account details (NHS email address) for access control via Cloudflare Access

What we do not collect

No NHS numbers
No patient names, dates of birth, or postcodes are transmitted or stored on CDMtools servers
No identifiable patient data of any kind

Where a tool needs to confirm a patient's identity (for example, to resume a review), identifying details are hashed on the clinician's device before anything is sent, and the hash itself cannot be reversed to recover the original details.

Where data is stored

Infrastructure	Cloudflare (edge network) and Neon Postgres
Region	UK only — no data leaves the UK
Retention	Session and audit data retained only as long as needed for clinical continuity and service audit

Data controller

SynaptAI Limited (registered in Scotland) is the data controller for CDMtools, registered with the Information Commissioner's Office (ICO).

Your rights

If you are a clinician using CDMtools and have questions about your account data, or wish to make a data subject request, contact us using the details below.

Contact

For privacy or data protection enquiries: admin@synaptai.co.uk