GPAtlas | Privacy & Cookie Policy

Last updated: 14 November 2026

In short. GPAtlas is built by UK GPs for UK GPs, and we treat your information the way we would want ours treated. We collect what we need to run your account, your learning and your subscription, and nothing for advertising. We never sell personal data. Our AI tools process what you type only to answer you, never to train a model, and you must never enter anything that could identify a patient. You can see, correct, download or delete your data at any time, and you can close your account yourself. Where we write to someone we have not met, we say where we found them and how to make us stop.

Contents

1. Who we are and how to reach us
2. The information we hold, and where it comes from
3. Why we use it and our lawful basis
4. Your learning record and CPD
5. The AI tools
6. GPAtlas Whisper
7. Applications for reduced-price or free access
8. Booking a demo, live sessions and referrals
9. Educators who teach with us
10. People we write to professionally
11. Who we share information with
12. Transfers outside the UK
13. How long we keep information
14. Security
15. Your rights and how to use them
16. Cookies and similar storage
17. Children
18. Changes to this policy

1. Who we are and how to reach us

GPAtlas LTD is the data controller for the personal information described in this policy.

• Company number 16587886, registered in England and Wales.
• Registered address: Piccadilly Business Centre, Unit C Aldow Enterprise Park, Blackett Street, Manchester, M12 6AE.
• Registered with the Information Commissioner's Office as a data controller, registration number ZC021226. You can check this on the ICO register.
• Privacy questions and requests: [email protected].
• Support: WhatsApp +44 7884 099940.

This policy covers gpatlas.co.uk and everything you do within it. It does not cover other websites we link to; each has its own policy.

2. The information we hold, and where it comes from

Almost everything we hold comes from you, either because you entered it or because it was created while you used GPAtlas. Section 10 covers the one situation where it does not.

Information about patients. GPAtlas is not a clinical record. You must never enter anything that could identify a patient into any GPAtlas tool. The one deliberate exception is Whisper, which is designed for recorded consultations and is described in Section 6.

3. Why we use it and our lawful basis

UK data protection law requires a lawful basis for each purpose. Ours are set out here.

Where we rely on legitimate interests we have weighed them against your interests and rights, and you can object at any time (Section 15).

4. Your learning record and CPD

To make CPD certificates accurate and verifiable, we record engagement rather than take your word for it:

• Ocean articles: which sections were logged for CPD, and when, and how long the topic was open. A section is logged once you have stayed on it, or when you press Mark complete.
• Echo audio and podcasts: how much of a recording you played and for how long. Completion is automatic at 85 percent for summaries and 60 percent for podcasts.
• Scope infographics: how far you scrolled. Completion is automatic at 85 percent.
• Courses: which lessons you open and how long you spend on them, your answers and scores, and any certificate issued, which carries its own verification code.
• AKT Compass and AceTheSCA: your answers, scores, attempts and bookmarks. These modules involve no patient data and record no audio of you, except the simulator described in Section 5.

If you remove a CPD activity from your Hub, it disappears from your view and your certificate totals, but the underlying record is kept while your account is open so that a certificate already issued can still be verified. Custom titles you give activities are stored with them and change nothing else.

Certificates. Every CPD certificate carries an ID that an appraiser can check at gpatlas.co.uk/cpd/verify. When you close your account, your learning record and certificates are deleted and verification of those certificates stops working, so download any you need first. With your explicit action, you can connect your account to FourteenFish and send CPD records there through their official partner interface; nothing is sent unless you connect it, and you can disconnect at any time.

Mandatory Training. Anyone with a certificate's code can check it at gpatlas.co.uk/mandatory-training/verify, which shows only what is printed on it: your name, the course and level, the dates and the CPD hours. If you use Send certificates, we email them to the address you give us. We email you 60 days and 7 days before a refresher is due. If you choose the practice staff role, we use it only to open Mandatory Training to you and nothing else. When you close your account, your course progress is deleted within 30 days. Your certificates stay checkable until 12 months after their refresher date, so a practice you gave one to can still check it; ask us and we delete them sooner.

5. The AI tools

The AI Suite is Atlas Search, Ask Expert, Admin Copilot and the Portfolio & Appraisal Hub. The AI Consultation Simulator is part of AceTheSCA. All of them work the same way in principle: what you enter is processed, under contract, for the sole purpose of producing your response. None of it is used to train any AI model.

What is kept

• Ask Expert and the Portfolio & Appraisal Hub keep a history you can see inside the platform and delete at any time.
• Admin Copilot drafts are stored by us to run the service, prevent misuse and support troubleshooting. They are not shown to you as a browsable history and are deleted after 90 days.
• Before text you type into Admin Copilot, Ask Expert or the Portfolio Hub is sent to the AI or stored, we remove NHS numbers, dates of birth and patient names that appear in a record header or beside those details. We keep the patient's age, because it changes what an answer or letter needs to say. Please still leave other patient details out.
• Voice dictation converts your speech to text and the audio is then discarded; only the text you choose to send is kept. Files you attach to a question are processed in memory to answer it and are never stored.
• The AI Consultation Simulator streams your spoken consultation for live transcription and then deletes the audio; the AI patient's replies are computer-generated speech for a fictional patient and are not kept. What is saved to your account is the text transcript, your marking, the attempt details, your credit ledger and any feedback you give. You must never describe a real patient in a practice consultation.

Where the processing happens

Answers are generated by specialist AI providers working under contract for us. Whisper, including questions you ask from inside Whisper, runs on servers in the EU. Our other AI tools run on servers in the United States or the EU. Ask Expert also looks up current guidance on the open web: the search terms derived from your question are sent to a web-search provider; your name and account are never part of that. Section 11 lists the kinds of provider involved and Section 12 the safeguards that apply.

What the tools are for

The AI tools provide educational and administrative support. Their output is not medical advice and does not replace your own judgement, official guidance or local policy; you are responsible for checking it before acting on it. GPAtlas includes an MHRA Class I registered medical device. No automated decision about you is ever made by these tools: they answer your questions, they do not assess you.

Content development and clinical review

GPAtlas educational content is developed using a combination of clinical expertise, evidence-based resources and AI-assisted tools where appropriate. Clinical content is subject to review and quality assurance by a GP.

We aim to keep our content accurate, relevant and aligned with current UK clinical guidance. Content is reviewed and updated as appropriate.

6. GPAtlas Whisper

Whisper, which is not yet generally available, drafts a consultation note from a recorded consultation for the clinician to review, edit and approve. It is the one place on GPAtlas where information spoken about a patient is processed, and it is built accordingly.

• The clinician must tell the patient and proceed only with their agreement, must avoid speaking identifiers that are not clinically necessary, and must never state the patient's name.
• The recording reaches us in short pieces during the consultation. It is passed to a specialist speech-recognition provider on EU servers, and we hold it only as long as it takes to produce the note.
• As soon as the note is saved we delete our copy and instruct the provider to delete both the audio and its copy of the transcript, and we record the time that deletion is confirmed so that it can be evidenced. A recording abandoned part-way is deleted automatically. Audio never becomes part of the stored record.
• What is kept: the drafted note and non-identifying metadata such as times and durations, saved to the clinician's account. The transcript text is kept for 30 days so the clinician can check or regenerate the note, then deleted automatically. The clinician can delete any consultation at any time, and all are deleted when the account is closed.
• Note drafting runs on EU-resident AI infrastructure. Where the code-suggestion feature is available, short clinical phrases from the note's own wording are sent to the NHS England Terminology Server to look up standard codes; they contain no patient identifiers and are not stored there.
• A trainee can ask for feedback on their own consultation skills from a consultation they recorded, only after confirming the patient agreed to it being used for their training. The transcript is read by the same EU-resident AI infrastructure, and the feedback is shown once to that trainee and is not stored. If the trainee taps Listen, the feedback is read aloud by an EU-resident voice service, and the audio goes straight to them and is not stored either.
• A clinician can also ask for a draft portfolio entry from their own note and two answers they give: a Clinical Case Review or reflection, or, for a GP, a Patient's Unmet Need (PUN) or Doctor's Educational Need (DEN). It is written by the same EU-resident AI infrastructure, written to leave out anything that identifies the patient, kept in the clinician's Portfolio history until they delete it or close their account (deleting the consultation does not remove it), and sent to FourteenFish only if they send it.
• Files attached to Ask Expert or Admin Copilot inside Whisper are read in the EU for that question only and are never saved. Before the AI that writes the answer reads them, we remove the names, dates of birth, NHS numbers, phone numbers, email addresses and street addresses we detect.

Our lawful basis is performance of a contract with the clinician. Nothing from Whisper is used to train any AI model.

7. Applications for reduced-price or free access

Some access is offered at a reduced price or free on proof of circumstances: Hardship Access for doctors who have sat an exam more than once, educator and training-programme rates, and rates for FY2 doctors and medical students. To decide an application we ask for your role and, where it applies, reasonable evidence such as a results letter, which you may redact.

• A person reviews every application, usually within 48 hours.
• Any document you upload is deleted the moment a decision is made, whichever way it goes. We keep the decision itself and the date while your account is open.
• Evidence is used only to decide the application. Falsified evidence ends the account, as our Terms of Use explain.

8. Booking a demo, live sessions and referrals

Booking a demo. The form asks for your name, email address, role and organisation, and optionally a phone number in case the call link fails. We use them to hold the call and send you the details. You are never added to a Google calendar as a guest; the invitation you receive carries the entry itself.

Live sessions. GPAtlas hosts free live sessions run by independent GP educators. To book a place you give your name and email address and tick a box naming the educator, who will see your name, your email address and whether you joined the session; a booking cannot be made without it. We also record which educator's page the booking came through and a hashed form of your IP address, which protects the booking form from abuse. We email you the joining details, a reminder before the session and a short feedback request after it. The session itself runs in a video meeting service we provide. Our joining link forwards you to the room, and while you are in the call the meeting service handles your name, voice and video. A session may be recorded by GPAtlas. If it is, the educator tells you before recording starts, and the meeting service shows on screen that it is recording; you can keep your camera off, stay muted, use your first name only, or leave. It belongs to GPAtlas and is seen by GPAtlas and the educator who ran the session; we may use it in GPAtlas teaching for our members, and we never publish it outside GPAtlas. Please never mention anything that could identify a patient in a session. Educators may not record sessions themselves. Your feedback reaches the educator anonymously unless you tick the box to share your name. The educator is never shown what you have bought or anything else you do on GPAtlas. You can ask us to remove a booking sooner than Section 13 sets out.

Referrals. If you join through a colleague's link, we record which account referred you so the introduction discount and any reward can be applied. Your referrer sees only anonymous counts, never your name or email address. You see the name of the colleague who invited you.

9. Educators who teach with us

Independent GP educators can apply to run free live sessions on GPAtlas and to introduce the trainees they teach to it. Section 7.8 of our Terms of Use and Sale sets out the arrangement; this section covers the information involved.

• What you give us when you apply: the name trainees will see, your email address, what you teach and where, your typical group size, a public page for your course or group if you have one, your confirmation that you teach independently of GPAtlas, and the date you accepted the partner terms.
• Being thanked for your work: if you choose, either the address of your own page where trainees can buy you a coffee, or a payee reference that we use to pay your share by bank transfer. We never hold your sort code or account number.
• Our decision: a person reviews every application. If we decline, we record the date and, privately, the reason. We may keep brief internal notes about the partnership.
• Your referral code and share ledger: each partner has a referral code, stamped on every booking made through your session page. When someone who came through it later pays for a plan, we record the payment reference, the amount paid, the tax and card fee, the share due to you and when it clears, is paid, or is voided after a refund.
• What is public: your display name and the sessions you run appear on your session pages and in our public list of sessions at gpatlas.co.uk/live, which search engines can show in their results.
• What you see: who booked your own sessions (name, email address, booking date and whether they joined), their feedback, which is anonymous unless they chose to share their name, and the amounts paid and due to you. You are never shown what an attendee has bought or anything else they do on GPAtlas, and you never see who subscribed.
• Your access: while you teach with us you use GPAtlas at no charge, and that access is recorded with your account like any other subscription.

Our lawful basis is performance of a contract with you.

10. People we write to professionally

From time to time we write to people in their professional role, for example training programme directors, GP educators and practice leads, to introduce GPAtlas. This is the one case where we hold information we did not get from you, and the law asks us to tell you the following.

• What we hold: your name, work email address, role and organisation.
• Where it came from: a page published by your organisation or training programme, and the letter itself tells you which one.
• Why: to tell you about a resource relevant to the trainees or clinicians you are responsible for. Our lawful basis is our legitimate interest in introducing GPAtlas to the people whose role it serves, weighed against yours; we write to work addresses only, one letter each, and never to personal addresses without consent.
• What we do not do: we do not add you to a marketing list, share or sell your details, or track whether you opened the letter.
• How to stop us: reply to the letter, or write to [email protected]. We will not contact you again, and we keep a note of your request for exactly that reason.
• How long: the record of the letter is kept for twelve months; a request not to be contacted is kept for as long as it is needed to honour it.

11. Who we share information with

We never sell personal data. We share it only with the providers we need to run GPAtlas, each under a contract that limits what they may do with it, and with our own authorised team where their work requires it. Our providers today are listed here; we update this list when suppliers change.

We may also disclose information where the law requires it, or to protect the rights, property or safety of GPAtlas, our members or others.

12. Transfers outside the UK

Where a provider processes information in the EU, the UK Government's adequacy decision applies. Where a provider processes information in the United States, we rely on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and on the provider's own security commitments. GPAtlas remains the controller and remains responsible for your information wherever it is processed. We keep these arrangements under review.

13. How long we keep information

Closing your account. You can close your account yourself from Account Settings. Closing it cancels any subscription and deletes your account, learning record, AI history, simulator attempts and Whisper consultations. We keep only the transaction records the law requires, the free-trial and once-per-person records described above, security and access records until they expire, and any live-session booking or educator ledger entry, which loses its link to you.

14. Security

All traffic to GPAtlas is encrypted in transit. Access to personal data within the team is limited to those who need it for their work, and passwords are stored only in one-way encrypted form. GPAtlas is Cyber Essentials certified, is registered with the Information Commissioner's Office, and has been independently penetration tested by a CREST-accredited provider. The assurance letter is available to practices and NHS organisations on request.

Security records. To protect the service and subscriber content we keep automated records of which account used which part of the platform and when: the account, the feature, the time and whether the request succeeded, never the content of your questions, documents, recordings or notes. They also record when you sign in, which items you open, and copy or print actions on protected pages, each with the IP address and browser. They are kept for no more than 90 days, used only to protect the service, for example to detect a shared account, automated copying or running up costs on AI features, and are never used to assess anyone's learning and never shared with employers, deaneries or training programmes. Links to subscriber audio and video are issued to you individually and expire after a few hours, which protects the library and has no effect on your own use.

Automatic limits and checks. Some protections act automatically, before a person has looked:

• Free and trial accounts have daily limits on how many different items can be opened in each part of GPAtlas, set well above what a person studying normally opens in a day. Opening an item again the same day is always allowed.
• Any account, including a paid one, is paused if it opens a very large number of different items within a few minutes, because that pattern comes from automated copying. While an account is paused, its content cannot be opened; Mandatory Training is not affected. A paid account's pause lifts by itself after 30 minutes, unless it is paused again within 24 hours.
• Free benefits can be held back while a person reviews an account, for example if its registration number is already used by another account, or its device or connection has already received free simulator consultations.
• A second free trial for the same email address, card or account is cancelled at once, with nothing charged.

A person reviews every pause and hold. You can ask for a review, and tell us anything we should know, through Contact Us; if a check was wrong, we restore access as soon as we have looked.

If something goes wrong. No system is perfectly secure. If a personal data breach is likely to put your rights and freedoms at risk we will notify the ICO without undue delay and, where feasible, within 72 hours of becoming aware of it, and where the risk to you is high we will tell you directly without undue delay.

15. Your rights and how to use them

Under UK data protection law you can ask us to:

• Access the personal data we hold about you, and receive a copy.
• Correct anything inaccurate or incomplete.
• Delete your data where we have no good reason to keep it. You can also do this yourself by closing your account.
• Restrict what we do with it in certain situations.
• Receive the data you gave us in a portable format, or have it sent to another provider.
• Object to processing based on our legitimate interests, including any professional outreach.
• Ask a person to review any decision made automatically, such as a pause or a hold, and tell us why you think it is wrong.
• Withdraw consent at any time where we rely on it, for analytics cookies.
• Stop our emails about GPAtlas at any time, with one click in any of them or in your account settings.

Write to [email protected]. We reply within one month, there is no fee, and we may need to confirm your identity first so that we do not give your information to someone else. You are not subject to any decision made solely by automated means.

If you are unhappy with how we have handled your information, please tell us first and we will try to put it right. You also have the right to complain to the Information Commissioner's Office at any time: ico.org.uk, or 0303 123 1113.

16. Cookies and similar storage

• Essential. Keeping you signed in, protecting the site from attack (Cloudflare's security cookies) and remembering your cookie choice. These are needed for the site to work and cannot be switched off.
• Functional. Your display and accessibility preferences, the cards you choose to hide, and an Ask Expert question you have started typing (kept only until you close the tab or sign out), stored in your own browser.
• Fraud prevention. A cookie holding a random identifier, set when you open the free simulator consultations, so they are given once per device. It lasts 12 months, can be read only by our own site, and is needed for the free consultations to be offered fairly, so it cannot be switched off.
• Before you join. Your browser keeps a note of the free topics you have read this month and of the CPD time you have built up. Neither leaves your browser while you are a visitor. When you join and first sign in, the CPD note is sent once to add that time to your record, then cleared.
• Analytics. Google Analytics, used to understand which pages help people most. These are set only if you accept them in the banner, and you can change your mind at any time using Manage Cookies at the foot of every page.

We use no advertising cookies and no tracking across other websites. You can also clear or block cookies in your browser settings, though some parts of the site may then not work.

17. Children

GPAtlas is for clinicians and clinicians in training. It is not intended for anyone under 18, and we do not knowingly collect information about children.

18. Changes to this policy

When this policy changes we update the date at the top and, for significant changes, tell members by email or with a notice on the platform. Earlier versions are available on request. This policy should be read with our Terms of Use and Sale.