User Privacy Policy

1. About Us

This privacy notice applies to Monmedical Limited, trading as Cinapsis, company registration number: 09728098 (“Cinapsis”, “we”, “us”, “our”). It relates to the use of your personal data when you interact with the Cinapsis system (“the System”) as an authorised user and/or our website (www.cinapsis.org). We are committed to safeguarding your privacy and ensuring your personal information is protected. We are the Data Controller and are responsible for your personal data.

2. Information we collect

Personal data, or personal information, means any information about an individual from which that person can be identified. We may collect, use, store and transfer different kinds of personal data about you:

Identity Data – first name, last name, username or similar identifier.
Contact Data – email address and telephone numbers.
Technical Data – IP address, login data, browser type/version, time zone, plug-in types/versions, OS/platform, and other device/technology details.
Profile Data – username, password, your employer’s name, and any feedback you provide.
Usage Data – information about how you interact with our website and/or System.

We do not collect Special Categories of Personal Data (e.g., race, religion, health data) or criminal conviction data.

3. If you fail to provide personal data

Where we need to collect personal data by law, or for performance of a contract, if you fail to provide it when requested, we may not be able to perform that contract or permit you access to our website/System (or certain parts).

4. How we collect your personal data

We collect data via:

Direct interactions – you provide Identity, Profile and Contact Data when you create an account, give feedback, or contact us.
Automated technologies – as you use our website/System, we collect Technical and Usage Data via cookies and similar tools.
Third parties – e.g., analytics providers (Google) and your employer who authorises your access.

5. How we use your personal data

We only use your personal data when the law allows. Most commonly:

To perform a contract with you.
To comply with legal obligations.
On the basis of our legitimate interests (e.g., running our business, improving our services).

Purpose/Activity	Type of Data	Lawful Basis
Register you as a user and enable use of website/System	Identity, Contact, Profile	Performance of contract; Legitimate interests
Manage our relationship (e.g. notify changes, respond to feedback)	Identity, Contact, Profile	Performance of contract; Legal obligation; Legitimate interests
Administer & protect business, website & System	Identity, Contact, Technical	Legitimate interests; Legal obligation
Deliver relevant content & measure effectiveness	Identity, Contact, Profile, Usage, Technical	Legitimate interests
Use analytics to improve website/System	Technical, Usage	Legitimate interests

6. Change of purpose

We only use data for the purposes collected, unless a compatible new purpose arises. If we need to use your data for an unrelated purpose, we will notify you and explain the legal basis.

7. Sharing your personal data

We may share with:

Third-party service providers (Hubspot, Typeform, Mailchimp, etc.).
Professional advisers (lawyers, accountants, insurers).
Regulators (HMRC, other authorities).
Prospective or actual buyers/mergers of our business.

All third parties must process data per our instructions and with appropriate safeguards.

8. International transfers

When we transfer data outside the UK, we ensure adequate protection (e.g., adequacy decisions or standard contractual clauses).

9. Data retention and security

We retain personal data only as long as necessary:

Identity, Contact, Profile & Usage Data: 6 years after you cease to be a user (or longer if litigation or related data requires).
Technical Data: 1 year (unless cookies specify otherwise).

We apply security measures and have breach-response procedures in place.

10. Changes to this notice

We review and may update this notice. Last updated: 28 June 2023. Please review periodically.

11. Third-party links

Our site may link to external sites—please review their privacy notices. We’re not responsible for their content or practices.

12. Data Protection Officer

Our DPO oversees this policy. Contact details below.

13. Contact Us

Email: support@cinapsis.com
Postal: Cinapsis, Profile West, Suite 2, Great West Road, Brentford, England TW8 9ES

14. Your Rights Under GDPR

Under data protection laws, you may:

Request access to your personal data.
Request correction or erasure.
Object or restrict processing.
Request data portability.
Withdraw consent (where relied upon).

No fee is required unless requests are unfounded or excessive.

15. NHS Care Identity credentials

If you sign in via NHS Care Identity, NHS Digital is the controller; we act as processor under their instructions. See their Privacy Notice & Terms.

16. Use of Cookies

We use cookies & similar technologies to personalize content, analyze use, and support the System. By using our site/System, you consent to their use.

Essential Cookies – required for core functionality (e.g., login).
Analytical/Performance Cookies – to monitor & improve performance.
Functionality Cookies – to remember preferences & personalize content.
Targeting Cookies – to deliver relevant content & ads.

Specific cookies we set:

User session cookie – expires on session end.
Mixpanel cookie – expires in 1 year.
Device ID cookie – expires in 3 months.
“Remember me” login cookie – expires in 3 months.

Most browsers accept cookies by default; you can disable them in your browser settings (help) but may lose functionality.