Cogni.Dx Privacy Policy Notice

(For patients, carers and healthcare professionals using the Cogni.Dx digital assessment tool)

Last updated: 1st December, 2025

1. Who we are

Cogni.Dx is an electronic assessment tool that helps collect structured history and cognitive assessments remotely and provides preliminary diagnostic insights to your healthcare provider.

This service is operated by:

Cogni.Dx Limited

86–90 Paul Street London EC2A 4NE United Kingdom

In this notice, "Cogni.Dx", "we", "us" or "our" means Cogni.Dx Limited. We are the "controller" of your personal data under applicable data protection law (for example, the UK GDPR and Data Protection Act 2018 for UK users).

You can contact us about privacy at: support@cognidx.co.uk

2. What this notice covers

This Privacy Policy explains how we collect, use, store and share personal data when you:

• Use the Cogni.Dx web portal (e.g. as a Patient, Carer, Physician, Clinical/Research Coordinator, Local Lead, Clinical Administrator or Super Administrator), or
• Use our online cognitive history and assessment tools, questionnaires and reports, or
• Contact us about the Cogni.Dx service (for example, for support or feedback)

This notice does not cover how your hospital, clinic, GP practice, university or research sponsor uses your data. They are separate controllers and will have their own privacy notice.

3. What information we collect

The exact information we collect depends on how you use Cogni.Dx and your role.

3.1 Information about patients

When a patient uses Cogni.Dx (directly or via a carer or healthcare professional), we may collect:

Identification & contact details

• Name or initials
• Date of birth / age band
• Contact details (e.g. email, phone) – depending on the deployment
• Unique system ID assigned by Cogni.Dx or your clinic

Clinical & cognitive information (special category data)

• Medical history relevant to memory and cognition
• Answers to structured history questions
• Results of cognitive assessments and tasks
• Family history, risk factors and lifestyle information where relevant
• Information about mood, behaviour and functional abilities
• Clinician notes and diagnostic impressions (if entered in Cogni.Dx)

Technical & usage data

• IP address
• Device type, browser type, operating system
• Dates, times and duration of logins or assessments
• Log data about errors and performance of the platform

3.2 Information about carers / family members

If you are a carer or family member completing Cogni.Dx on behalf of someone else, we may collect:

• Your name and relationship to the patient
• Your contact details (if provided)
• Information you provide about the patient as part of the assessment
• Any notes or feedback you submit

Please only share information about the patient that you are authorised to provide (for example, where you have their consent or legal authority).

3.3 Information about healthcare professionals & site staff

If you are a healthcare professional, researcher or administrator, we may collect:

• Your name and contact details
• Role (e.g. physician, coordinator, local lead)
• Professional identifiers (e.g. employer, clinic, department)
• User account credentials (username, hashed password)
• Audit logs of your activity in the system (e.g. which records you viewed or edited, when, and from where)

3.4 Cookies and similar technologies

If you access Cogni.Dx through a web browser, we may use cookies and similar technologies to:

• Keep you logged in
• Remember your language or region
• Analyse usage (for example, which pages are most visited)

4. How we use your information and why

We process your personal data for the following purposes and, where required, rely on the legal bases set out below (examples assume UK/EU GDPR):

4.1 Providing the Cogni.Dx service

We use patient and clinician data to:

• Deliver remote cognitive history and assessments
• Generate structured summaries and preliminary diagnostic outputs for your healthcare provider
• Allow clinicians to review, interpret and act on the findings
• Provide you and your care team with secure access to your assessment results

Legal basis (UK/EU):

• Performance of a contract or steps taken at your request
• Provision of health or social care and management of healthcare systems (Art. 9(2)(h) GDPR, where applicable)
• Legitimate interests (e.g. operating a safe and effective diagnostic support tool)

4.2 Communication with you and your care team

We may use your details to:

• Send appointment / assessment links and reminders
• Answer queries or provide technical support
• Share information or documentation requested by your care provider

Legal basis:

• Performance of a contract
• Legitimate interests (ensuring the service functions and that patients receive expected communications)

4.3 Safety, quality improvement and audit

We may use your data (often in pseudonymised or aggregated form) to:

• Monitor the accuracy and performance of Cogni.Dx
• Validate and improve the underlying algorithms
• Conduct internal audits and quality assurance
• Protect against misuse, fraud and security incidents

Legal basis:

• Legitimate interests (monitoring and improving our service)
• Where health data is involved, healthcare quality and safety or research/public interest grounds, as permitted by law.

4.4 Research, service evaluation and statistics

In some deployments, Cogni.Dx may be used as part of:

• A service evaluation,
• A clinical study, or
• Other research projects with approved governance frameworks.

Where this is the case, you will be provided with additional information (for example, a study information sheet and consent form) explaining how your data will be used for research. We will follow the relevant ethics, regulatory and contractual requirements.

Legal basis:

• Performance of a task carried out in the public interest, including research
• Legitimate interests
• Your explicit consent, where required by law

4.5 Legal and regulatory obligations

We may process and retain your data where necessary to:

• Comply with legal and regulatory obligations (for example, medical device regulations, health records legislation, tax and corporate requirements)
• Respond to court orders, law enforcement or regulators
• Exercise or defend legal claims

Legal basis:

• Compliance with legal obligations
• Establishment, exercise or defence of legal claims

5. Automated decision-making and profiling

Cogni.Dx uses structured algorithms and scoring logic to interpret your responses and cognitive assessments and to generate preliminary diagnostic outputs. These outputs are:

• Intended to support, not replace, clinical judgement
• Always to be interpreted by a qualified healthcare professional

We do not use Cogni.Dx to make final, fully automated decisions about your treatment or care.

Depending on your local law, you may have rights relating to profiling and automated decision-making, including the right to request human review, to express your point of view and to contest the outcome.

6. Who we share your information with

We do not sell your personal data. We may share it with:

6.1 Your healthcare providers and care team

• Clinicians and authorised staff involved in your care
• Site coordinators and administrators at your clinic, hospital or research site
• Other members of your care team, where permitted by law and clinical practice

6.2 Our service providers (processors)

We may use carefully selected third parties who help us deliver the service, such as:

• Secure cloud hosting and data storage providers
• IT support and maintenance services
• Email and communication service providers
• Analytics and monitoring tools

These providers act on our instructions and are bound by contractual obligations to keep your data secure and confidential.

6.3 Research and evaluation partners

In some cases, we may share pseudonymised or anonymised datasets with:

• Academic partners
• Research institutions
• Healthcare organisations

This is done under clear contracts, governance, and (where appropriate) ethics approvals.

6.4 Legal, regulatory and corporate events

We may disclose your data where necessary:

• To comply with laws, regulations or court orders
• To protect your vital interests or those of others
• In connection with a corporate transaction (e.g. merger, acquisition, reorganisation), subject to appropriate safeguards

7. International transfers

Cogni.Dx may be used in several countries (for example, the UK, EU, Saudi Arabia, North America and others).

Where personal data is transferred outside your country (for example, to cloud services located in another jurisdiction), we will:

• Ensure that the destination country is recognised as providing an adequate level of protection or
• Put appropriate safeguards in place, such as standard contractual clauses, additional technical protections and strict access controls.

You can contact us if you would like more information about these safeguards.

8. How long we keep your information

We keep personal data only for as long as necessary to:

• Provide the Cogni.Dx service
• Support your healthcare provider
• Meet legal, regulatory, audit and research obligations
• Resolve disputes and enforce our agreements

Retention periods may differ depending on:

• Local health records laws
• The terms of our contract with your healthcare provider or study sponsor
• Whether the data is used for direct care, service evaluation or research

We may retain anonymised or aggregated data indefinitely, as it no longer identifies you.

9. How we protect your information

We use a combination of technical and organisational measures to protect your data, including:

• Encrypted transmission (e.g. HTTPS/TLS)
• Access controls and role-based permissions
• Secure authentication and password policies
• Regular backups and system monitoring
• Staff training and confidentiality obligations
• Data protection by design and default in our development processes

No system is completely secure, but we work to reduce risk and respond promptly to incidents. If we become aware of a personal data breach that poses a risk to your rights and freedoms, we will notify you and the relevant authorities, where required by law.

10. Your data protection rights

Depending on your location and the applicable law (for example, UK/EU GDPR), you may have the following rights:

• Right of access – to obtain a copy of your personal data we hold
• Right to rectification – to correct incomplete or inaccurate information
• Right to erasure – to ask us to delete your data in certain circumstances
• Right to restriction – to ask us to limit how we use your data
• Right to data portability – to receive certain data in a structured, commonly used, machine-readable format and/or have it transmitted to another controller
• Right to object – to object to processing based on legitimate interests or to direct marketing
• Rights relating to automated decision-making and profiling, where applicable
• Right to withdraw consent – where we rely on your consent, you can withdraw it at any time (this will not affect processing already carried out)

To exercise any of these rights, please contact us at support@cognidx.co.uk. We may need to verify your identity before responding.

You also have the right to lodge a complaint with your local data protection authority. In the UK, this is the Information Commissioner's Office (ICO).

11. Children and vulnerable adults

Cogni.Dx is primarily designed for adults with suspected cognitive impairment and their carers. In some cases, carers or family members may provide information on behalf of a patient with reduced capacity.

Where required, we will:

• Follow applicable laws and guidance on consent and capacity
• Work with your healthcare provider, who will be responsible for ensuring appropriate legal basis and authorisations are in place

12. Links to other services

Cogni.Dx may contain links to websites or services operated by third parties (for example, hospital portals, research sites or information resources). We are not responsible for the privacy practices of those third parties. You should read their privacy notices before using their services.

13. Changes to this Privacy Policy

We may update this Privacy Policy from time to time, for example if:

• We add new features to Cogni.Dx
• The law or regulatory guidance changes
• We change our data processing practices

When we make significant changes, we will take reasonable steps to notify you (for example, via the portal or by email) and will update the "Last updated" date at the top of this notice. We encourage you to review this page regularly.

14. How to contact us

If you have any questions, concerns, or requests about this Privacy Policy or how we handle your data, please contact:

Email: support@cognidx.co.uk

Post:

Cogni.Dx Limited 86–90 Paul Street London EC2A 4NE United Kingdom