Privacy Policy

This Privacy Policy explains how Mermaid Health ("we", "us", "our") handles information when you use our clinical document summarisation tool ("Mermaid Health"). We have written this in plain English because we believe you should be able to understand it easily.

Mermaid Health is designed specifically for clinical professionals in the UK. We take your privacy, and the privacy of your clients, extremely seriously.

1. Who we are

Mermaid Health is a clinical productivity tool operated in the United Kingdom. Our ICO registration number will be added here once registration is complete.

Contact us: hello@mermaid.health

2. What Mermaid Health does — and does not do

Mermaid Health allows clinical professionals to upload background documents (such as GP letters, school reports, EHCPs, and assessment reports) and receive an AI-generated structured summary of those documents.

We do not share your data with third parties, except as described in Section 5 below.

3. What information is processed

3a. Documents you upload

When you use Mermaid Health, you upload clinical documents containing personal data relating to your clients. This may include special category data under UK GDPR (health and education information). This data is processed solely for the purpose of generating a summary and for no other purpose. We do not store it; section 5 explains how long our AI provider keeps it.

3b. Account and usage information

We collect information when you subscribe and create an account: your name, email address, professional discipline, country, postcode, and professional registration number. We also record basic usage information, such as how many documents you have summarised. This is used to operate the service, to apply your plan's limits, and to identify accounts being shared in breach of our terms.

3c. How documents reach the AI model

Details that could identify your client are removed before anything reaches our AI, and names are put back into your summary afterwards if you choose that option.

Reading your files. To read a Word file or a PDF with typed text, the file is first sent, over an encrypted connection, to our own server-side function, which extracts its text in memory and returns it to your browser. It is not stored and does not reach the AI at this stage. Scanned documents and photos are read in your browser instead.

Removing details. In your browser, before anything is sent to the AI, the tool finds and replaces the client's name (including common nicknames and small misspellings) and date of birth, and also looks for: NHS numbers; hospital, record and insurer numbers; phone numbers; email and web addresses; postcodes and addresses; the names of parents, carers and siblings; the names of teachers, clinicians and other staff; school and GP practice names; and hospital, clinic and street names in a letter's heading. Each document is sent to the AI as "Document 1", "Document 2" and so on, never under its file name. Names of family members, staff, schools, GP practices and places are put back into your summary afterwards; contact details, NHS numbers, record numbers, addresses and web addresses are never put back.

Scans and photos. Text recognition in your browser finds these details on each page and blacks them out before the page is sent. If it can't confirm the client's name was found and removed, the document is left out and you're told why — it is never sent unredacted. A document that can't be read at all is also left out and reported; it is never summarised.

What this is and isn't. This works by recognising labels and patterns (for example "Mother:", "Dr" or a postcode), not by understanding the text, so it will miss some details, such as a name mentioned only in passing. It is replacement of details, not anonymisation. The clinical content itself, and any other detail the tool does not recognise, is transmitted as it appears in the source document.

Sending to the AI. The text with details removed is sent, over an encrypted connection, to our server-side function, which passes it to the Anthropic API using our own API key. You do not need to provide an API key of your own. Document content is held only in memory for the duration of the request and is not written to disk or to any database.

4. Our role under UK GDPR

You (the clinician) are the data controller — you decide what documents to upload and are responsible for ensuring you have the right to share that information with a third-party tool.

We (Mermaid Health) act as a data processor — we process the documents on your instruction, solely to generate a summary.

By using Mermaid Health, you confirm that you have the appropriate authority, consent, or professional basis to share the documents you upload. This includes ensuring your clients know that AI-assisted tools are used to help summarise their records.

5. Third parties we work with

The following organisations process data on our behalf as sub-processors. We do not sell or share your data with anyone else.

Anthropic (AI processing)

Mermaid Health uses the Anthropic API to generate summaries. Document content you upload is transmitted to Anthropic's servers for processing. Anthropic retains API data for up to 30 days under its standard commercial terms — not indefinitely, but not zero either; a stricter zero-retention option exists only at Anthropic's enterprise tier. Your documents are not used to train Anthropic's models unless a customer separately opts in, which we do not. Anthropic's Data Processing Addendum, Standard Contractual Clauses and UK Addendum apply automatically as part of their Commercial Terms. Their privacy policy is available at anthropic.com/privacy.

Supabase (accounts and authentication)

Your account details — name, email address, professional registration number and related profile information — are stored by Supabase, in the European Union (Ireland). Supabase does not receive the documents you upload. Their privacy policy is at supabase.com/privacy.

Netlify (hosting)

Our application is hosted by Netlify. Netlify may process standard web request data (such as IP addresses) as part of hosting. Our server-side functions also run on Netlify: they read the text of Word files and typed PDFs, and pass text with details removed to Anthropic, in memory only (see section 3c). Netlify does not store the documents you upload. Their privacy policy is at netlify.com/privacy.

Resend (account emails)

Transactional emails, such as your welcome email and password reset links, are sent using Resend, in the European Union (Ireland). Resend receives your email address and the content of those emails only. Their privacy policy is at resend.com/legal/privacy-policy.

MailerLite (onboarding emails)

Onboarding and product update emails are sent using MailerLite, which receives your name and email address. You can unsubscribe from these at any time without affecting your account. Their privacy policy is at mailerlite.com/legal/privacy-policy.

ThriveCart and Stripe (payments)

Subscriptions are processed by ThriveCart using Stripe. They receive your name, email address, billing country and payment details. We never see or store your card details. Their privacy policies are at thrivecart.com/privacy and stripe.com/privacy.

6. Legal basis for processing

We process personal data on the basis of legitimate interests (to provide the summarisation service you have requested) and contract (to fulfil our agreement with you as a user of Mermaid Health). You, as data controller, are responsible for identifying your own legal basis for sharing client data with Mermaid Health.

7. Data retention

Mermaid Health does not retain the documents you upload or the summaries generated from them. Our AI provider retains API data for up to 30 days (see section 5).

Account-related data (such as your email address and subscription details) is retained for as long as your account is active, and for up to 12 months after account closure for legal and administrative purposes.

8. Your rights under UK GDPR

You have the right to access, correct, delete, or restrict the data we hold about you (your account information). You also have the right to data portability and to object to processing. To exercise any of these rights, contact us at hello@mermaid.health. We will respond within 30 days.

You have the right to lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk if you believe we have not handled your data correctly.

9. Security

All data is transmitted over encrypted HTTPS connections. Documents are never written to disk on our servers. Only members can use the service: our system automatically blocks any request from someone who isn't signed in. We recommend using Mermaid Health only on secure, private networks and in accordance with your organisation's information security policies.

10. Children's data

Mermaid Health is designed for use by clinical professionals and is not intended to be accessed directly by children. Clinical documents relating to children may be uploaded by professionals as part of their work. Such documents are processed in the same way as all uploads: we do not store or retain them (see section 5 for our AI provider's retention).

11. Changes to this policy

We may update this Privacy Policy from time to time. We will update the "last updated" date at the top when we do. If we make significant changes, we will notify users by email where possible.

12. Contact us

If you have any questions about this Privacy Policy, please contact us:

Email: hello@mermaid.health
Website: mermaid.health

If you have a complaint, you also have the right to contact the ICO directly at ico.org.uk or by calling 0303 123 1113.