Privacy policy.

Introduction

This privacy notice tells you what to expect TORTUS AI to do with your personal information when you make contact with us or use one of our services. It explains:

• why we are able to process your information;
• what purpose we are processing it for;
• whether you have to provide it to us;
• how long we store it for;
• whether there are other recipients of your personal information;
• whether we intend to transfer it to another country; and
• whether we do automated decision-making or profiling.

This privacy notice explains what personal information TORTUS AI collect about those who visit our website, use our products and communicate with us, how we use it, the circumstances in which TORTUS AI may disclose it to others and how we keep it secure.

TORTUS AI are committed to protecting and respecting your privacy. If you have any questions regarding this privacy notice and our approach to privacy, email us at support@tortus.ai.

Who we are

TORTUS AI LTD (‘TORTUS AI’) is registered as a limited company (Companies House No. 14487060) in the United Kingdom. To enable us to offer services that process personal data in the UK we have registered with the Information Commissioner’s Office (ICO) under registration no. ZB512995.

Our product

TORTUS is a web-based artificial intelligence (AI) software medical device developed by TORTUS AI Ltd. It supports healthcare professionals with real-time clinical documentation and workflow optimisation during patient consultations. The system passively listens to spoken Clinician-Patient interactions, transcribes the content, and uses large language models (LLMs) to generate structured, editable outputs such as clinical notes, referral letters, and suggested clinical codes (currently a restricted set of observable entity and findings SNOMED CT codes).

TORTUS is delivered as a web-based Software-as-a-Service (SaaS) application. It is securely hosted on cloud infrastructure located within the United Kingdom and accessed through standard web browsers in clinical environments such as general practices, outpatient clinics, or hospitals.

The software does not make autonomous clinical decisions. All generated documentation must be reviewed and approved by a qualified healthcare professional before it is entered into the medical record.

The information we process

TORTUS AI obtain information about you when you use our website, when you contact us about products and services, for example by email or telephone, or during business with you or an organisation you represent.

Most of the personal information TORTUS AI process is provided to us directly by you for one of the following reasons:

• You have made an enquiry to us.
• You have initiated or completed a commercial transaction with us.
• We are providing services to you or the organisation or entity you work for or represent.
• You have made a complaint to us.
• You wish to attend or have attended an event we have organised or attended alongside you.
• You have subscribed to our e-newsletter.
• You have applied for a job with us.
• You work with or for us.
• You visit our website and consent to our use of cookies.
• In limited circumstances, raw transcripts or consultation data may be temporarily collected to investigate and resolve technical issues, performance problems, or user-reported errors. This collection is strictly limited to defined triggers and all data is deleted once the issue is resolved.

TORTUS AI also receive personal information indirectly, in the following scenarios:

• Where we are providing services to the organisation or entity you work for or represent and they have provided your information to us.
• Where you have made your contact information available on your organisation’s website and we use this to contact you and your organisation.
• Where you have made your contact information available via a social media platform and we use this to contact you and your organisation.
• You have applied for a job with us and we seek a reference from an organisation or individual you have previously worked for or with.
• An employee of ours gives your contact details as an emergency contact or a referee.

Where TORTUS AI receives your personal data indirectly and acts as Data Controller for that data, TORTUS AI will provide you with the information set out in this Privacy Notice (including what data we hold, why, and your rights) within one month of receiving it, or earlier if TORTUS AI use it to contact you or intend to disclose it to another party, whichever comes first. TORTUS AI will do this by email (if we hold a valid email address for you).

Where providing this notice directly would involve disproportionate effort, for example if TORTUS AI do not hold accurate contact details for you, or the volume of Individuals involved makes individual contact impracticable, TORTUS AI will instead take appropriate steps to protect your rights, including publishing this information prominently on our website and, where applicable, informing the organisation that provided us with your data so they can pass this notice to you directly.

Data we collect in our product

Patient data (entered or captured during a consultation)

Your account data (the Clinician using the product)

Device and usage data

The lawful basis for the processing of personal data

The list below describes the personal data TORTUS AI collect and our lawful basis for processing this data. When TORTUS AI process data on the basis of legitimate interests, we apply the following test to determine whether it is appropriate:

• Purpose – is the purpose of processing personal data legitimate?
• Necessity – is the processing necessary to fulfil that purpose?
• Balance – do the individual’s interests, rights or freedoms override the legitimate interest?

TORTUS AI provides services across both NHS and independent / private healthcare settings, and relies on the following lawful bases depending on the setting in which the data is processed.

Applicable across all healthcare settings

• UK GDPR Art. 9(2)(h) – healthcare purposes (applies regardless of whether the provider is an NHS body or an independent/private provider).
• Data Protection Act 2018, Condition 2 of Schedule 1 – Health and Social Care Purposes.
• For transcript debugging and troubleshooting, the lawful basis is Article 6(1)(f) UK GDPR (legitimate interests in ensuring the security, reliability and safety of the Service) and, where health data is included, Article 9(2)(h) (healthcare management purposes).
• Common Law Duty of Confidentiality – implied consent.

Where we provide services to an NHS body

Where TORTUS AI provides services to an NHS body exercising a public healthcare function, TORTUS AI additionally rely on legal powers such as those provided within the National Health Service and Community Care Act 1990, the NHS Act 2006 and the Health and Social Care Act 2012, together with Art. 6(1)(e) UK GDPR – Public task.

Where we provide services to an independent or private provider

Where TORTUS AI provides services to an independent or private healthcare provider (e.g. a private hospital, clinic, or a Partner organisation providing services to private clients), the NHS-specific statutory powers and public task basis above do not apply, since the provider is not exercising a public function. Instead, TORTUS AI rely on:

• Art. 6(1)(b) UK GDPR – Contract (processing necessary for the performance of a contract between the provider and the patient/service user, or to take steps at their request prior to entering into a contract), or
• Art. 6(1)(f) UK GDPR – Legitimate interests, where the contract basis does not apply.

The special category and confidentiality bases listed as applicable across all healthcare settings above continue to apply in the same way regardless of whether the provider is NHS or independent/private.

Automated decision-making or profiling

We do not undertake any automated decision-making or profiling in relation to your personal data.

Retention

Personal and special category data processed within TORTUS AI will be retained for as long as necessary and where applicable in line with the retention periods specified in the NHS England Records Management Code of Practice.

Transcript data collected for debugging is retained only for the minimum time required to resolve the issue and is then permanently deleted.

Your data protection rights

The rights available to you depend on our reason for processing your information. Under data protection law, you have rights including:

• Your right of access – You have the right to ask us for copies of your personal information.
• Your right to rectification – You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
• Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
• Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond.

You can contact us, including our Data Protection Officer (DPO), to take up any of these rights via email: support@tortus.ai

Sharing your information collected via our website

TORTUS AI will not share your information with any third parties for the purposes of direct marketing.

TORTUS AI use data processors, which are third parties that provide services for us. TORTUS AI have contracts in place with our data processors. This means that they cannot do anything with your personal information such as share it with other organisations unless we have instructed them to do so. They will hold your personal data securely and retain it for the period we instruct. When it is necessary for us to transfer your personal data outside of the UK, this will only be done in accordance with the UK GDPR and the Data Protection Act 2018 (DPA 2018).

In some circumstances, we are legally obliged to share information. For example, to comply with or under a court order. In any scenario, we’ll satisfy ourselves that we have a lawful basis on which to share the information and document our decision-making.

Sharing your information collected via our product

To deliver TORTUS’s core function, TORTUS AI share personal data with the following Third-Party service providers (sub-processors):

Transcription of the audio recording is performed using speech-to-text models hosted within TORTUS AI’s own secure infrastructure. This means the consultation audio recording is not shared with any Third-Party transcription provider.

TORTUS AI confirm that every Third Party with whom the product shares personal data is bound by a written contract (a Data Processing Agreement) that requires them to protect your personal data to the same or an equivalent standard as required by the UK GDPR and the Data Protection Act 2018. Third Parties may only process personal data on TORTUS AI’s documented instructions, must keep it secure and confidential, may not use it for their own purposes or share it with others, and must retain it only for the period we instruct. Where any of these providers process personal data outside the United Kingdom, TORTUS AI ensure that the transfer is protected by an appropriate safeguard recognised under the UK GDPR (such as an adequacy decision, the International Data Transfer Agreement, or Standard Contractual Clauses).

TORTUS AI do not share your information with any Third Party for the purposes of direct marketing, and TORTUS AI do not permit any Third-Party AI provider to retain your data or use it to train their models.

International transfers

When personal data is transferred outside of the UK, the appropriate technical and organisational safeguards will be in place. All international transfers will only occur if it complies with the relevant legislation.

Visitors to our website

TORTUS AI use Google Analytics to collect information and details of visitor behaviour patterns on our website. We do this to understand things such as the number of visitors to the different areas of the website. This information is only processed in a way which does not identify anyone. We do not make and do not allow Google to make any attempt to discover the identities of those visiting our website. Details of Google’s Privacy Policy can be found here: https://www.google.com/policies/privacy.

Where TORTUS AI do want to collect personally identifiable information through our website, TORTUS AI will make this clear at the point that personal information is collected and TORTUS AI will explain what we intend to do with it.

Use of cookies

Like many other websites, our website uses cookies. ‘Cookies’ are small pieces of information sent by a website to your device and stored to enable that website to recognise you when you visit in the future. They can also be used to collect statistical data about your browsing activity and patterns of behaviour but do not identify you as an individual. This helps us to understand how people who visit our website use it, enabling us to improve the layout and content for visitors.

For more information about which cookies are used by our website, please refer to the Cookie Notice on our website.

It is possible to switch off cookies by setting your browser preferences and settings. Turning cookies off may result in a loss of functionality when using our website.

Links to other websites

Where TORTUS AI provide links to websites of other organisations, this privacy notice does not cover how that organisation processes personal information. TORTUS AI encourage you to read the privacy notices on the other websites you visit.

How to make a complaint

TORTUS AI strive to meet the highest standards when collecting and using personal information. For this reason, TORTUS AI take any complaints we may receive about this very seriously. TORTUS AI encourage people to inform us if they think that any collection or use of information by us is unfair, misleading or inappropriate. TORTUS AI would also welcome any suggestions for improving our procedures. You can do this by contacting us using the method below:

Email: support@tortus.ai

If you remain dissatisfied, you have the right to make a complaint to the Information Commissioner’s Office (ICO). Please see the ICO’s website for more information: www.ico.org.uk

Changes to this privacy notice

TORTUS reserve the right to modify this Privacy Notice at any time, so please make sure to review this frequently. Our most updated Privacy Notice is posted on our website. All changes will apply with immediate effect.

Addendum 1 – Alpha programme participant data collection

Purpose of this addendum

This addendum supplements the main TORTUS AI Privacy Policy. It describes how TORTUS AI Ltd. collects, uses, stores and deletes the personal contact data, specifically mobile and telephone numbers, of Individuals who voluntarily enrol in a TORTUS AI alpha testing programme.

It should be read alongside the main Privacy Policy. Where this addendum and the main policy conflict, this addendum takes precedence for alpha programme participants.

Who this addendum applies to

This addendum applies to Great Britain-based Clinicians and other authorised Individuals who have received a direct invitation from TORTUS AI to participate in an alpha testing programme, and have explicitly provided their phone number via the Alpha Programme Enrolment Form.

What personal data we collect

Lawful basis for processing

We process alpha programme participant phone numbers on the basis of consent (UK GDPR Article 6(1)(a)). Consent is freely given, specific, informed and unambiguous – captured via an explicit opt-in checkbox on the enrolment form with no pre-ticked boxes. Consent can be withdrawn at any time by contacting support@tortus.ai. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

How we use phone numbers

Phone numbers collected via the alpha enrolment process will be used only to: add Participants to the alpha testers WhatsApp group; schedule onboarding calls, training sessions, and check-in calls; provide direct technical support during the alpha testing period; and communicate urgent operational information. We will not use phone numbers for marketing, sales, outreach, automated calls, or any purpose unrelated to the alpha programme.

Who has access to your phone number

Access is restricted on a strict need-to-know basis to: the designated alpha programme manager or coordinator; product or engineering team members directly supporting a Participant’s technical issue; and our Data Protection Officer (8fold Governance Ltd. – support@tortus.ai). Phone numbers will not be shared with Third Parties or any organisation outside TORTUS AI except where required by law.

Where your data is stored

Alpha participants’ contact data is stored in a restricted Google Sheet within the TORTUS AI Google Workspace. This system is hosted within the UK/EEA, is access-controlled so that only authorised TORTUS AI staff can view it, and is covered by TORTUS AI’s ISO 27001 Information Security Management System.

Retention

Phone numbers and other alpha programme contact data will be retained for the duration of the alpha programme and deleted no later than 30 days after the programme formally closes or after a Participant withdraws consent, whichever is earlier.

Your rights

As a Data Subject under UK GDPR you have the right to access, rectify, erase, restrict, object to and port your personal data. To exercise any of these rights contact us at support@tortus.ai. We will respond within one calendar month. If you are dissatisfied with how we handle your request you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Changes to this addendum

We may update this addendum. Material changes will be communicated to active alpha participants by email before taking effect. The current version is always available at tortus.ai/privacy.

Addendum 2 – TORTUS Mobile App

Purpose of this addendum

This addendum supplements the main TORTUS AI Privacy Policy. It describes how the TORTUS Mobile App available via the Apple App Store collects, uses, stores, shares with Third Parties under a Data Processing Agreement and deletes any personal information.

It should be read alongside the main Privacy Policy. Where the main Privacy Policy and this addendum conflict, this addendum should take precedence for TORTUS Mobile App Users.

Who this addendum applies to

This addendum applies to Customers and Partners of TORTUS AI who engage with the TORTUS product via the iOS mobile app.

Patient data (entered or captured during a consultation)

Your account data (the clinician using the app)

Device and usage data

Please note that the data we collect in the TORTUS Mobile App is the same data that is collected via the web app version of our product.

Sharing your information

The general commitments set out in ‘Sharing your information’ above apply in full to the TORTUS Mobile App. This addendum sets out, specifically for the Mobile App, the Third Parties with whom TORTUS AI share personal data in order to provide the Mobile App’s features, and confirms the protections in place.

Transcription of the audio recording is performed using speech-to-text models hosted within TORTUS AI’s own secure infrastructure. This means that the consultation audio recording is not shared with any Third-Party transcription providers.

TORTUS AI confirm that every Third Party with whom the Mobile App shares personal data is bound by a written contract (a Data Processing Agreement) that requires them to protect your personal data to the same or an equivalent standard as required by the UK GDPR and the Data Protection Act 2018. Third Parties may only process personal data on TORTUS AI’s documented instructions, must keep it secure and confidential, may not use it for their own purposes or share it with others, and must retain it only for the period we instruct. Where any of these providers process personal data outside the United Kingdom, TORTUS AI ensure that the transfer is protected by an appropriate safeguard recognised under the UK GDPR (such as an adequacy decision, the International Data Transfer Agreement, or Standard Contractual Clauses).

TORTUS AI do not share your information with any Third Party for the purposes of direct marketing, and TORTUS AI do not permit any Third-Party AI provider to retain your data or use it to train their models.

Lawful basis for processing

The general commitments set out in ‘The lawful basis for the processing of personal data’ section above apply in full to the TORTUS Mobile App. Consent is freely given, specific, informed and unambiguous, captured through confirmation of reading and understanding this policy when you first sign up to the TORTUS Mobile App. Consent can be withdrawn at any time by contacting support@tortus.ai. Withdrawal does not affect the lawfulness of processing prior to withdrawal.

Your rights

As a Data Subject under UK GDPR you have the right to access, rectify, erase, restrict, object to and port your personal data. To exercise any of these rights contact us at support@tortus.ai. We will respond within one calendar month. If you are dissatisfied with how we handle your request you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk.

Changes to this addendum

TORTUS AI may update this addendum. Material changes will be communicated to active TORTUS app users before taking effect. The current version is always available at tortus.ai/privacy.

Addendum 3 – California privacy rights (CCPA/CPRA)

If you are a California Resident, the California Consumer Privacy Act (CCPA), as amended by the California Privacy Rights Act (CPRA), gives you specific rights regarding the personal information which TORTUS AI collects through this website.

Categories of personal information collected, and retention periods

TORTUS AI do not sell personal information and do not share personal information for cross-context behavioural advertising, as those terms are defined under CCPA.

Protected Health Information (PHI) that TORTUS AI processes on behalf of healthcare providers is governed by the Health Insurance Portability and Accountability Act (HIPAA) and, where applicable, the California Confidentiality of Medical Information Act (CMIA), not the CCPA. This CCPA section applies only to personal information collected through this website (e.g. contact forms, cookies, job applications), not to any clinical or health information processed via TORTUS AI products.

TORTUS AI’s website may collect limited categories of sensitive personal information, such as information you voluntarily provide in free-text form fields (which may incidentally reference health-related context). TORTUS AI use sensitive personal information solely for purposes permitted under the CCPA/CPRA, including providing the services you request and ensuring the security of our systems, and do not use it to infer characteristics about you or for advertising purposes. As TORTUS AI’s use is limited to these permitted purposes, a separate right to limit does not apply; however, you may still exercise your right to know what personal information TORTUS AI hold about you, the right to delete it, the right to correct inaccurate information, the right to opt out of sale/sharing, the right to limit use of sensitive personal information and the right to non-discrimination for exercising these rights as described above.

To exercise these rights, contact support@tortus.ai, consistent with the process outlined in the GDPR Compliance Policy.

Version 3.0 · Last updated 30 July 2026 · Copyright ©2026 Tortus AI LTD