Your data, handled with care.

Cypher (“Cypher”, “we”, “us”) provides software for UK community pharmacies, clinics and independent prescribers: online booking, consultations, private e-prescriptions, a WhatsApp Agent and Phone Agent, a check-in kiosk, dispensing data and related tools. This policy explains how we handle personal data under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations (PECR).

For any question about this policy or your personal data, email hello@cypheros.uk.

Data protection law gives different responsibilities to a “controller” (who decides why and how data is used) and a “processor” (who handles it on a controller’s behalf).

If you’re a patient and want to see, correct or delete your information, contact the pharmacy, clinic or prescriber you dealt with. They are responsible for your record, and we help them respond.

Your pharmacy, clinic or prescriber uses Cypher to book and run your appointments, keep your record and talk to you. The information they hold depends on the services you use, and can include:

• Your name, date of birth, sex, address and postcode, phone number and email address, and optionally your NHS number.
• Your GP surgery’s name and email address, if you give them.
• Bookings: the service, time and place, booking references, and the answers to any eligibility questions (such as the NHS Pharmacy First pre-check).
• Pre-consultation forms and consultation records, including health information such as symptoms, medical history, allergies, medicines, vitals (for example blood pressure or weight), outcomes, vaccinations and recalls.
• Private e-prescriptions and the record of when and where they were dispensed.
• WhatsApp messages you send to the pharmacy, and transcripts of calls answered by the Phone Agent. Calls are transcribed, not recorded: no audio is kept.
• Check-ins at the pharmacy’s kiosk, repeat prescription requests the pharmacy sends to your GP surgery, and Apple or Google Wallet cards if your pharmacy issues them.
• Payment details if you pay a booking fee. Payments are taken by Stripe on the pharmacy’s own Stripe account: your card details go to Stripe, not to us.

Booking for someone else

If you book for family members, you give us their details and they’re linked to your contact details. Please only book for people who have agreed, or whom you care for.

Messages and calls

• The Phone Agent tells every caller it’s the pharmacy’s automated assistant. You can ask for a person at any time.
• On WhatsApp, reply STOP to stop messages from the pharmacy, and START to turn them back on. The pharmacy should only send you marketing messages if you’ve agreed to them.
• If you describe an emergency on a call, you’ll hear a fixed message telling you to call 999 or NHS 111, and the pharmacy is alerted.

• Your account: name, email, phone, role and job title, professional registration number (such as GPhC), and your settings.
• Sign-in and security: a hashed password, an optional two-factor authentication secret, sign-in times, and the IP address and browser details of your sessions.
• Activity: an audit log of actions you take on patient records and settings, for safety and accountability.
• If you’re an independent prescriber: your registration with the GMC, GPhC, NMC or another regulator, your indemnity details, your signature, and documents you upload for verification, such as your registration certificate and photo ID. A member of the Cypher team checks these against the public registers before you can prescribe.
• If your employer uses Cypher’s clock-in: your clock-in and clock-out times and, at those two moments only, your location, to confirm you’re at the pharmacy. Location points are deleted after your employer’s retention period.
• Staff documents your employer asks you to read and sign, and training certificates you upload.

Cypher staff can view a pharmacy’s account to give support. This access is limited to the people who need it, lasts 30 minutes at a time, and can’t be used to carry out clinical tasks.

• Book a demo: your name, work email, phone, pharmacy name and ODS code, number of branches, the systems you use now, what you’d like to see, and anything else you tell us.
• Contact and waitlist forms: your name, email address, message and any details you choose to give.
• Page visits: we count visits and clicks on our marketing pages without cookies, without storing your IP address and without identifying you.
• Pharmacy pages show a map from OpenStreetMap, which receives your IP address when the map loads.

Where we are the controller, we rely on these lawful bases:

For patient information, the pharmacy, clinic or prescriber decides the lawful basis. In healthcare this is usually providing care (UK GDPR Article 6(1)(e) or 6(1)(b), with Article 9(2)(h) for health information).

AI features are optional. Each pharmacy decides whether to switch them on.

• Consultation scribe: it uses your web browser’s built-in speech recognition to turn the conversation into text (in Google Chrome this is provided by Google, in Microsoft Edge by Microsoft). The patient’s name and date of birth are removed in the browser before the text is sent to our AI provider, which suggests answers for the consultation form. The pharmacist or prescriber accepts or changes every answer.
• WhatsApp Agent: answers general questions from the pharmacy’s own information. Messages that look like they contain personal details are never sent to the AI.
• Phone Agent: call audio is converted to text by our speech provider (Deepgram, on its EU service), the reply is written by our AI provider and spoken by our voice provider (ElevenLabs). Identity details such as your date of birth are collected in a scripted step the AI doesn’t see.
• Business insights use totals and figures, not patient details.

Our AI provider is Anthropic. Under its commercial terms it doesn’t train its models on data sent through its API, and we don’t use patient data to train AI models. We keep a log of each AI use (model, cost and the checked result), not the text you said or typed. The scribe’s transcript is saved, encrypted, with the consultation, where the pharmacy can view or delete it.

Decisions made automatically

A person makes clinical decisions. A few steps are automatic, to keep things quick and safe:

• The NHS Pharmacy First pre-check follows the NHS clinical pathways. If your answers suggest an emergency, you can’t book and you’re told to call 999 or go to A&E.
• The WhatsApp Agent answers a question only when it’s confident, and otherwise passes you to the menu or the pharmacy team.
• Prescription status (such as “ready to collect”) can be sent to you automatically once you’ve confirmed who you are.

You can always ask to speak to a person at the pharmacy, or ask them to review anything that was decided automatically.

We use these suppliers (sub-processors) to run Cypher. Each one only gets what it needs for its job, under a contract that protects your data.

We also share information:

• With the pharmacy, clinic or prescriber you deal with, and with others they choose to send it to, such as your GP surgery, a dispensing pharmacy for an e-prescription, or a sister pharmacy that delivers a service.
• With systems a customer connects to Cypher, such as their calendar feed or their own software, on their instructions.
• With professional advisers, insurers and auditors, under confidentiality.
• With regulators, the police or courts when the law requires it.
• With a buyer or successor if our business is sold or reorganised, who would have to protect your data in the same way.

We will tell our customers before we add or replace a sub-processor.

Cypher’s app and database are hosted in the EU, which the UK recognises as protecting personal data adequately. Some suppliers process data in the US or elsewhere. When they do, we rely on safeguards approved under UK law: the UK–US data bridge where the supplier is certified, or the UK International Data Transfer Agreement or Addendum to the EU standard contractual clauses. Email us for more detail.

When a customer leaves Cypher, we return or delete their data as our terms set out. Deleted data leaves our backups as they expire.

• All connections use HTTPS. The most sensitive fields, such as NHS numbers, email addresses, prescription details, clinical notes, transcripts and messages, are also encrypted by the app (AES-256).
• Hosting and backups are in the EU. Backups are encrypted and kept off-site.
• Role-based access, so people only see what their job needs, with an audit log of actions on patient records.
• Passwords are hashed, accounts lock after repeated failed sign-ins, and two-factor authentication is available.
• Clinical safety is managed to the DCB0129 standard, and information security runs to an ISO 27001-aligned system.

If a personal data breach happens, we’ll tell the affected customer without undue delay so they can meet their own legal duties, and we’ll tell the ICO and affected people where we are the controller and the law requires it.

Under UK data protection law you can ask to:

• see a copy of your personal data
• correct anything that’s wrong
• delete your data, where we have no reason to keep it
• restrict or object to how we use it
• receive your data in a format you can take elsewhere
• withdraw consent, where we rely on it
• have a person review a decision made automatically

If you’re a patient, contact your pharmacy, clinic or prescriber, who is responsible for your record. For anything else, email hello@cypheros.uk. We’ll reply within one month. It’s free, and we may need to check who you are first.

You can also complain to the Information Commissioner’s Office at ico.org.uk or on 0303 123 1113. We’d appreciate the chance to put things right first.

We only use cookies and browser storage that are needed for Cypher to work. We don’t use advertising or analytics cookies, so we don’t ask for cookie consent.

Stripe’s payment pages and OpenStreetMap’s maps are run by those companies and may set their own cookies under their own policies.

Cypher is used by professionals. Pharmacies and clinics may book and treat children, usually with a parent or carer making the booking; they are responsible for those records and for checking who can consent. Our own website and services are not aimed at children.

We’ll update this policy when the product or the law changes, and show the date it took effect at the top. We’ll tell customers about important changes by email.

Email hello@cypheros.uk about anything in this policy. You can also read our terms of service and how we approach clinical safety and security.