Privacy notice

Version 2026-11-draft. This notice explains how AskBert collects and uses your information, including information about your health.

Who we are

AskBert is the data controller for the information you give us. Contact: [email protected].

What we collect

• Account details: your name, email address and password (stored hashed).
• Health information for each person you ask about: medical history, medicines, supplements, allergies, diet, lifestyle, family history, goals and your answers to topic and safety questions.
• Your questions, our answers, follow-ups and messages.
• Payment records. Card details are handled by Stripe; we never see them.

Why we use it, and our lawful basis

• To provide the advice you pay for: performance of our contract with you (UK GDPR Article 6(1)(b)).
• Health information is special category data. We process it with your explicit consent (Article 9(2)(a)), which you give when you create your profile and can withdraw at any time.
• To keep records we must keep, such as payments: legal obligation (Article 6(1)(c)).

How AI is used

To help your practitioner prepare, an AI service summarises your health history and drafts notes and a possible answer for them. This happens only inside AskBert: the AI never contacts you, and your practitioner reviews, edits and approves everything you receive. We don't send your name, email address or date of birth to the AI service, and our provider doesn't use your information to train its models.

Who we share it with

Only the service providers that help us run AskBert, under contracts that protect your data:

• Our hosting provider (servers in the UK/EU).
• Anthropic (AI summaries and drafts for your practitioner).
• Our transcription provider (when your practitioner dictates an answer).
• Stripe (payments) and our email provider (account and notification emails, which never contain health information).

How long we keep it

We keep your health records and answers while you have an account, and for up to 8 years after your last question, in line with professional record-keeping guidance, unless you ask us to delete them sooner where the law allows. Payment records are kept for 6 years.

Your rights

You can access, correct, download or delete your information, withdraw consent, and object to or restrict how we use it. Download your data or ask for deletion from Account settings, or email [email protected]. You can complain to the Information Commissioner's Office (ico.org.uk).

Security

Health information is encrypted in our database and only your practitioner can see it. Practitioner accounts use two-factor authentication, and every access to your case is logged.