GPAtlas | Privacy & Cookie Policy

Last updated: 23 September 2026

In short. GPAtlas is built by UK GPs for UK GPs, and we treat your information the way we would want ours treated. We collect what we need to run your account, your learning and your subscription, and nothing for advertising. We never sell personal data. Our AI tools process what you type only to answer you, never to train a model, and you must never enter anything that could identify a patient. You can see, correct, download or delete your data at any time, and you can close your account yourself. Where we write to someone we have not met, we say where we found them and how to make us stop.

Contents

1. Who we are and how to reach us
2. The information we hold, and where it comes from
3. Why we use it and our lawful basis
4. Your learning record and CPD
5. The AI tools
6. GPAtlas Whisper
7. Applications for reduced-price or free access
8. Booking a demo, live sessions and referrals
9. Educators who teach with us
10. People we write to professionally
11. Who we share information with
12. Transfers outside the UK
13. How long we keep information
14. Security
15. Your rights and how to use them
16. Cookies and similar storage
17. Children
18. Changes to this policy

1. Who we are and how to reach us

GPAtlas LTD is the data controller for the personal information described in this policy.

• Company number 16587886, registered in England and Wales.
• Registered address: Piccadilly Business Centre, Unit C Aldow Enterprise Park, Blackett Street, Manchester, M12 6AE.
• Registered with the Information Commissioner's Office as a data controller, registration number ZC021226. You can check this on the ICO register.
• Privacy questions and requests: [email protected].
• Support: WhatsApp +44 7884 099940.

This policy covers gpatlas.co.uk and everything you do within it. It does not cover other websites we link to; each has its own policy.

2. The information we hold, and where it comes from

Almost everything we hold comes from you, either because you entered it or because it was created while you used GPAtlas. Section 10 covers the one situation where it does not.

Information about patients. GPAtlas is not a clinical record. You must never enter anything that could identify a patient into any GPAtlas tool. The one deliberate exception is Whisper, which is designed for recorded consultations and is described in Section 6.

3. Why we use it and our lawful basis

UK data protection law requires a lawful basis for each purpose. Ours are set out here.

Where we rely on legitimate interests we have weighed them against your interests and rights, and you can object at any time (Section 15).

4. Your learning record and CPD

To make CPD certificates accurate and verifiable, we record engagement rather than take your word for it:

• Ocean articles: which sections you confirmed as complete, and when. Credit is only ever awarded when you confirm.
• Echo audio and podcasts: how much of a recording you played and for how long. Completion is automatic at 85 percent for summaries and 60 percent for podcasts.
• Scope infographics: how far you scrolled. Completion is automatic at 85 percent.
• Courses: which lessons you open and how long you spend on them, your answers and scores, and any certificate issued, which carries its own verification code.
• AKT Compass and AceTheSCA: your answers, scores, attempts and bookmarks. These modules involve no patient data and record no audio of you, except the simulator described in Section 5.

If you remove a CPD activity from your Hub, it disappears from your view and your certificate totals, but the underlying record is kept while your account is open so that a certificate already issued can still be verified. Custom titles you give activities are stored with them and change nothing else.

Certificates. Every CPD certificate carries an ID that an appraiser can check at gpatlas.co.uk/cpd/verify. When you close your account, your learning record and certificates are deleted and verification of those certificates stops working, so download any you need first. With your explicit action, you can connect your account to FourteenFish and send CPD records there through their official partner interface; nothing is sent unless you connect it, and you can disconnect at any time.

5. The AI tools

The AI Suite is Atlas Search, Ask Expert, Admin Copilot and the Portfolio & Appraisal Hub. The AI Consultation Simulator is part of AceTheSCA. All of them work the same way in principle: what you enter is processed, under contract, for the sole purpose of producing your response. None of it is used to train any AI model.

What is kept

• Ask Expert and the Portfolio & Appraisal Hub keep a history you can see inside the platform and delete at any time.
• Admin Copilot drafts are stored by us to run the service, prevent misuse and support troubleshooting. They are not shown to you as a browsable history and are deleted after 90 days.
• Voice dictation converts your speech to text and the audio is then discarded; only the text you choose to send is kept. Files you attach to a question are processed in memory to answer it and are never stored.
• The AI Consultation Simulator streams your spoken consultation for live transcription and then deletes the audio; the AI patient's replies are computer-generated speech for a fictional patient and are not kept. What is saved to your account is the text transcript, your marking, the attempt details, your credit ledger and any feedback you give. You must never describe a real patient in a practice consultation.

Where the processing happens

Answers are generated by specialist AI providers working under contract for us, mainly on servers in the EU. Some tasks, and fallbacks when the primary service is unavailable, run in the United States. Ask Expert also looks up current guidance on the open web: the search terms derived from your question are sent to a web-search provider; your name and account are never part of that. Section 11 lists the kinds of provider involved and Section 12 the safeguards that apply.

What the tools are for

The AI tools provide educational and administrative support. Their output is not medical advice and does not replace your own judgement, official guidance or local policy; you are responsible for checking it before acting on it. GPAtlas includes an MHRA Class I registered medical device. No automated decision about you is ever made by these tools: they answer your questions, they do not assess you.

6. GPAtlas Whisper

Whisper, which is not yet generally available, drafts a consultation note from a recorded consultation for the clinician to review, edit and approve. It is the one place on GPAtlas where information spoken about a patient is processed, and it is built accordingly.

• The clinician must tell the patient and proceed only with their agreement, must avoid speaking identifiers that are not clinically necessary, and must never state the patient's name.
• The recording reaches us in short pieces during the consultation. It is passed to a specialist speech-recognition provider on EU servers, and we hold it only as long as it takes to produce the note.
• As soon as the note is saved we delete our copy and instruct the provider to delete both the audio and its copy of the transcript, and we record the time that deletion is confirmed so that it can be evidenced. A recording abandoned part-way is deleted automatically. Audio never becomes part of the stored record.
• What is kept: the transcript text, the drafted note and non-identifying metadata such as times and durations, saved to the clinician's account. The clinician can delete any consultation at any time, and all are deleted when the account is closed.
• Note drafting runs on EU-resident AI infrastructure. Where the code-suggestion feature is available, short clinical phrases from the note's own wording are sent to the NHS England Terminology Server to look up standard codes; they contain no patient identifiers and are not stored there.

Our lawful basis is performance of a contract with the clinician. Nothing from Whisper is used to train any AI model.

7. Applications for reduced-price or free access

Some access is offered at a reduced price or free on proof of circumstances: Hardship Access for doctors who have sat an exam more than once, educator and training-programme rates, and rates for FY2 doctors and medical students. To decide an application we ask for your role and, where it applies, reasonable evidence such as a results letter, which you may redact.

• A person reviews every application, usually within 48 hours.
• Any document you upload is deleted the moment a decision is made, whichever way it goes. We keep the decision itself and the date while your account is open.
• Evidence is used only to decide the application. Falsified evidence ends the account, as our Terms of Use explain.

8. Booking a demo, live sessions and referrals

Booking a demo. The form asks for your name, email address, role and organisation, and optionally a phone number in case the call link fails. We use them to hold the call and send you the details. You are never added to a Google calendar as a guest; the invitation you receive carries the entry itself.

Live sessions. GPAtlas hosts free live sessions run by independent GP educators. To book a place you give your name and email address and tick a box naming the educator, who will see your name, your email address and whether you joined the session; a booking cannot be made without it. We also record which educator's page the booking came through and a hashed form of your IP address, which protects the booking form from abuse. We email you the joining details, a reminder before the session and a short feedback request after it. The session itself runs in a video meeting service we provide. Our joining link forwards you to the room, and while you are in the call the meeting service handles your name, voice and video. A session may be recorded by GPAtlas. If it is, the educator tells you before recording starts, and the meeting service shows on screen that it is recording; you can keep your camera off, stay muted, use your first name only, or leave. It belongs to GPAtlas and is seen by GPAtlas and the educator who ran the session; we may use it in GPAtlas teaching for our members, and we never publish it outside GPAtlas. Please never mention anything that could identify a patient in a session. Educators may not record sessions themselves. Your feedback reaches the educator anonymously unless you tick the box to share your name. The educator is never shown what you have bought or anything else you do on GPAtlas. You can ask us to remove a booking sooner than Section 13 sets out.

Referrals. If you join through a colleague's link, we record which account referred you so the introduction discount and any reward can be applied. Your referrer sees only anonymous counts, never your name or email address. You see the name of the colleague who invited you.

9. Educators who teach with us

Independent GP educators can apply to run free live sessions on GPAtlas and to introduce the trainees they teach to it. Section 7.8 of our Terms of Use and Sale sets out the arrangement; this section covers the information involved.

• What you give us when you apply: the name trainees will see, your email address, what you teach and where, your typical group size, a public page for your course or group if you have one, your confirmation that you teach independently of GPAtlas, and the date you accepted the partner terms.
• Being thanked for your work: if you choose, either the address of your own page where trainees can buy you a coffee, or a payee reference that we use to pay your share by bank transfer. We never hold your sort code or account number.
• Our decision: a person reviews every application. If we decline, we record the date and, privately, the reason. We may keep brief internal notes about the partnership.
• Your referral code and share ledger: each partner has a referral code, stamped on every booking made through your session page. When someone who came through it later pays for a plan, we record the payment reference, the amount paid, the tax and card fee, the share due to you and when it clears, is paid, or is voided after a refund.
• What is public: your display name and the sessions you run appear on your session pages.
• What you see: who booked your own sessions (name, email address, booking date and whether they joined), their feedback, which is anonymous unless they chose to share their name, and the amounts paid and due to you. You are never shown what an attendee has bought or anything else they do on GPAtlas, and you never see who subscribed.
• Your access: while you teach with us you use GPAtlas at no charge, and that access is recorded with your account like any other subscription.

Our lawful basis is performance of a contract with you.

10. People we write to professionally

From time to time we write to people in their professional role, for example training programme directors, GP educators and practice leads, to introduce GPAtlas. This is the one case where we hold information we did not get from you, and the law asks us to tell you the following.

• What we hold: your name, work email address, role and organisation.
• Where it came from: a page published by your organisation or training programme, and the letter itself tells you which one.
• Why: to tell you about a resource relevant to the trainees or clinicians you are responsible for. Our lawful basis is our legitimate interest in introducing GPAtlas to the people whose role it serves, weighed against yours; we write to work addresses only, one letter each, and never to personal addresses without consent.
• What we do not do: we do not add you to a marketing list, share or sell your details, or track whether you opened the letter.
• How to stop us: reply to the letter, or write to [email protected]. We will not contact you again, and we keep a note of your request for exactly that reason.
• How long: the record of the letter is kept for twelve months; a request not to be contacted is kept for as long as it is needed to honour it.

11. Who we share information with

We never sell personal data. We share it only with the providers we need to run GPAtlas, each under a contract that limits what they may do with it, and with our own authorised team where their work requires it. Our providers today are listed here; we update this list when suppliers change.

We may also disclose information where the law requires it, or to protect the rights, property or safety of GPAtlas, our members or others.

12. Transfers outside the UK

Where a provider processes information in the EU, the UK Government's adequacy decision applies. Where a provider processes information in the United States, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and on the provider's own security commitments. GPAtlas remains the controller and remains responsible for your information wherever it is processed. We keep these arrangements under review.

13. How long we keep information

Closing your account. You can close your account yourself from Account Settings. Closing it cancels any subscription and deletes your account, learning record, AI history, simulator attempts and Whisper consultations. We keep only the transaction records the law requires, the free-trial record described above, and any live-session booking or educator ledger entry, which loses its link to you.

14. Security

All traffic to GPAtlas is encrypted in transit. Access to personal data within the team is limited to those who need it for their work, and passwords are stored only in one-way encrypted form. GPAtlas is Cyber Essentials certified, is registered with the Information Commissioner's Office, and has been independently penetration tested by a CREST-accredited provider. The assurance letter is available to practices and NHS organisations on request.

Security records. To protect the service and subscriber content we keep automated records of which account used which part of the platform and when: the account, the feature, the time and whether the request succeeded, never the content of your questions, documents, recordings or notes. They are kept for no more than 90 days, used only to detect misuse such as automated copying or running up costs on AI features, and are never used to assess anyone's learning, never shared with employers, deaneries or training programmes, and never the basis of an automated decision; a person reviews anything unusual first. Links to subscriber audio and video are issued to you individually and expire after a few hours, which protects the library and has no effect on your own use.

If something goes wrong. No system is perfectly secure. If a personal data breach is likely to put your rights and freedoms at risk we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, and where the risk to you is high we will tell you directly without undue delay.

15. Your rights and how to use them

Under UK data protection law you can ask us to:

• Access the personal data we hold about you, and receive a copy.
• Correct anything inaccurate or incomplete.
• Delete your data where we have no good reason to keep it. You can also do this yourself by closing your account.
• Restrict what we do with it in certain situations.
• Receive the data you gave us in a portable format, or have it sent to another provider.
• Object to processing based on our legitimate interests, including any professional outreach.
• Withdraw consent at any time where we rely on it, for the newsletter and for analytics cookies.

Write to [email protected]. We reply within one month, there is no fee, and we may need to confirm your identity first so that we do not give your information to someone else. You are not subject to any decision made solely by automated means.

If you are unhappy with how we have handled your information, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk, or 0303 123 1113.

16. Cookies and similar storage

• Essential. Keeping you signed in, protecting the site from attack (Cloudflare's security cookies) and remembering your cookie choice. These are needed for the site to work and cannot be switched off.
• Functional. Your display and accessibility preferences, stored in your own browser.
• Analytics. Google Analytics, used to understand which pages help people most. These are set only if you accept them in the banner, and you can change your mind at any time using the cookie icon on the site.

We use no advertising cookies and no tracking across other websites. You can also clear or block cookies in your browser settings, though some parts of the site may then not work.

17. Children

GPAtlas is for clinicians and clinicians in training. It is not intended for anyone under 18, and we do not knowingly collect information about children.

18. Changes to this policy

When this policy changes we update the date at the top and, for significant changes, tell members by email or with a notice on the platform. Earlier versions are available on request. This policy should be read with our Terms of Use and Sale.