Privacy notice

Last updated 22 October 2026.

This notice covers the public website at neolung.io and the app at app.neolung.io. It explains what personal data Neolung holds about you, why, who else handles it, how long it is kept and what rights you have.

Who we are

Neolung is a reporting tool for lung pathology. For anything in this notice, write to trust@neolung.io.

Two roles

Neolung has two roles, depending on the data.

If you use Neolung through your organisation, questions about case data go first to your organisation. It decides how that data is used and how long it is kept.

What we collect and why

Your account

When you sign in we hold your name, email and chosen language. Your role in each organisation is held for that organisation (see Two roles).

• Why: to let you sign in, keep each organisation's data apart and give you the right access.
• Lawful basis: Article 6(1)(f), legitimate interests: providing, securely, the service you or your organisation use.

Your pathologist profile

If you fill it in: title, display name, specialties, headline, biography, career, education, publications, languages, LinkedIn address, profile photo, CV file, and your professional registration body and number.

• Why: to show who you are to your colleagues.
• If you ask, the app reads your CV or LinkedIn PDF with an AI provider to fill the profile for you. The file and its text are not stored by that step.
• If an admin verifies or withdraws your registration number, the audit log records it, and that record cannot be changed or deleted.
• Lawful basis: Article 6(1)(f), legitimate interests: letting colleagues know who reports and signs.

The consultant directory

If you offer second opinions, we hold your listing, your GMC number, the results of our checks, and your certificate of indemnity (encrypted), with the insurer, your name as member and the expiry date as fields. We check your GMC number against a copy of the GMC's register, which we keep only for doctors on the specialist register in a pathology specialty.

• Other organisations see your name, photo, practice, subspecialties, languages, biography, fees and turnaround. They never see your email, GMC number or certificate.
• Lawful basis: Article 6(1)(b), the contract to be listed, and Article 6(1)(f), legitimate interests, for the register check.

Your activity

The app keeps an audit log of who did what and when in each organisation. It never holds dictated text, audio or field values. It can hold free text written in amendment reasons.

• Why: accountability for the organisation, and evidence of what Neolung did on its instructions.
• Lawful basis: Article 6(1)(f), legitimate interests: the security and accountability of a clinical record.

Emails we send you

Invitations, requests to join, notices about exports, closing an organisation, second opinions and the directory. They carry email addresses, organisation names and links. They never carry patient data or a case's words.

If you write to us

If you email trust@neolung.io, we hold your message and your contact details to answer you.

• Lawful basis: Article 6(1)(f), legitimate interests: answering you.
• How long we keep it: as long as we need to answer you and keep a record of what we agreed.

Patient data

• Patients are not identified in Neolung. No name, NHS number, date of birth or hospital number is collected. A case holds only the fields of its report template.
• Text that looks like a patient identifier blocks signing and is refused in dictations and other free text. Names, text inside images and identifiers spoken aloud are not detected, so users crop labels and do not say identifiers.
• Case data is still health data, which is special category data. Neolung processes it only as a processor for the organisation, which is the controller.
• The organisation's lawful basis, for it to confirm, is Article 6(1)(e), public task (NHS organisations), or 6(1)(f) for independent providers, with Article 9(2)(h), provision of health care, and the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2.
• No real patient data is used until the organisation is approved. Every new organisation is for invented cases only. Neolung approves patient data only after seeing the organisation's signed DPIA, its clinical safety sign-off (DCB0160) and its agreement with Neolung.
• If you are a patient, contact the hospital that reported your specimen. It is the controller and can answer for your data.

AI processing

• AI is off by default. An organisation's admin turns it on with the organisation's own AI provider account, under its own contract. That provider is the organisation's processor, not Neolung's.
• What is sent: the dictated text, slide photos (reduced in size) with captions and the zones a pathologist marked, and, at your request, the text of your CV or LinkedIn PDF. If you list yourself in the consultant directory, your certificate of indemnity is read by your practice's own AI account. CT images are never sent. Neolung does not store dictation audio.
• For patient data, the only provider allowed is the organisation's own Azure OpenAI in the UK or EU. Neolung checks the region on setup and on each answer that reports one, and turns the AI off if an answer comes from elsewhere.
• Organisations that use invented cases only may be lent Neolung's demo OpenAI account, which processes in the United States. It is never lent to an organisation approved for patient data and will be removed before Neolung handles patient data.
• Nothing is used to train AI models. The AI learns only from the organisation's own history, as option values (what was suggested, what was signed), never free text from other cases. Requests to the demo account are sent with store: false. What an organisation's own provider may do with its data is set by that organisation's contract with it.
• The AI only fills what was said or seen. The pathologist reviews, decides and signs. No decision is made about anyone by automated means alone.

Who we share data with

We use these providers.

• GitHub holds Neolung's source code. It holds no personal data.
• When someone registers or looks for a hospital, the search text goes to the NHS Organisation Data Service, a public directory. It is never your name or email.
• If your organisation asks an outside pathologist for a second opinion, that pathologist sees one case, read-only, for 30 days at most. This happens under your organisation's control and its own agreement with them.
• We disclose data when the law requires it.

International transfers

All of Neolung's data is stored in London or the EU. Fly.io, Tigris, Okta and Resend are US companies, so data could be accessed from the United States. We rely on:

• Fly.io, Okta (Auth0 included) and Resend: the UK Extension to the EU-US Data Privacy Framework. Each was checked as active on the official list on 22 October 2026.
• Tigris: the EU standard contractual clauses with the UK Addendum, provided for in its data processing addendum. Tigris only ever holds encrypted files without the key.
• OpenAI (demo account): no transfer mechanism is assessed, because it never carries patient data. Your CV text can reach it if your organisation uses the demo account.
• The EU has UK adequacy regulations, so data stored in the EU needs no extra mechanism.

You can ask us for a copy of the safeguards at trust@neolung.io.

How long we keep data

Data we hold for organisations (as processor)

At the end of a contract, the organisation is locked for 30 days with only its export open. Then every record and photo is erased and the organisation receives a certificate of deletion. Neolung keeps a record of the organisation (name, country, dates, reason, who closed it) and the closing, export and erasure events of its audit log.

Data we hold as controller

Backups and logs

• Database backups are kept 30 days, so erased data is gone from them 30 days after erasure.
• Server logs on Fly.io are short-lived. They can include your IP address, and are kept for security and to keep the service running.
• If there is an incident, a breach or a claim, erasure of the affected data can be paused until it is resolved.

Security

In short: HTTPS only; the database is encrypted, and every photo and file is encrypted (AES-256-GCM) before it leaves the server; sign-in needs a second factor; each organisation's data is kept apart on every request; staff who do not report cases see no case content; every action is recorded. Details, and what is not done yet, are in the Trust center.

Your rights

Under UK GDPR you have the right to:

• be informed about how we use your data (this notice);
• get a copy of your data;
• have inaccurate data corrected;
• have your data erased;
• restrict how we use it;
• get your data in a portable form;
• object to how we use it, where we rely on legitimate interests;
• not be subject to a decision based only on automated processing.

Some rights are limited. For example, a signed report and the audit log cannot be changed, and a verified registration number in the audit log cannot be erased.

To use a right, write to trust@neolung.io. We answer within one month. If the data belongs to your organisation's records, we pass your request to the organisation and help it answer.

You can complain to the Information Commissioner's Office (ICO) at ico.org.uk. We would like the chance to help first.

This website

• neolung.io is a static site served by the same Fly.io app in London.
• It sets no cookies, uses no analytics and loads no third-party scripts. Its font is served from our own server.
• Contact links open your email app to write to trust@neolung.io.
• The server's short-lived logs, described above, cover the website too.

Changes to this notice

We will update this notice when what we do with personal data changes, and change the date at the top. If a change matters to account holders, we tell them in the app or by email.

Contact

Email trust@neolung.io.