1. Who we are
Chirone is a product of Okomfo Ltd, a company registered in England and Wales (company number 16671039), registered office 128 City Road, London, EC1V 2NX, United Kingdom (“Okomfo”, “we”, “us”).
For anything in this policy, write to ciao@chirone.io.
2. Two different roles
We handle personal data in two different capacities, and the rules are different for each:
- This website (chirone.io) and the contact form. Here Okomfo decides why and how data is used, so we are the controller. Sections 3 to 7 cover this.
- The Chirone service used by a hospital. Here the hospital or training centre decides what data goes in and why; it is the controller and Okomfo processes the data on its behalf as a processor, under a written data processing agreement. Section 8 covers this.
3. What we collect on this website
When you use the contact form
Your name, work email, hospital or centre, role (if you give it), the topics you tick and your message. You choose what to write; please do not include patients’ data or other sensitive information.
When you visit any page
Our hosting provider records technical data needed to deliver the site and keep it secure: IP address, browser and device type, the page requested and the time. We do not combine this with anything else or use it to identify you.
What we do not do
This website sets no cookies, uses no analytics, advertising or tracking tools, and loads nothing from third parties: fonts and images are served by the site itself. We do not sell personal data and we do not add you to mailing lists.
4. Why we use it, and on what legal basis
We apply the UK General Data Protection Regulation and the Data Protection Act 2018, and, for people in the European Union, the EU General Data Protection Regulation.
- To reply to you and, if it goes further, to discuss Chirone with you: steps taken at your request before entering into a contract (Art. 6(1)(b)) and our legitimate interest in answering enquiries about our service (Art. 6(1)(f)).
- To run the website securely and stop abuse: our legitimate interest in keeping the site available and safe (Art. 6(1)(f)).
- To keep records we are required to keep: legal obligation (Art. 6(1)(c)), once you become a customer.
6. International transfers
Okomfo is based in the United Kingdom, and some of our providers are based in the United States. Where data leaves the UK or the EU we rely on an adequacy decision (including the EU–US Data Privacy Framework and its UK extension, where the provider is certified) or on the European Commission’s Standard Contractual Clauses with the UK Addendum. You can ask us for a copy of the relevant safeguards.
7. How long we keep it
| Data | How long |
|---|---|
| Contact form messages and our replies | Up to 24 months after our last exchange, unless you become a customer |
| Customer correspondence and invoices | For the contract, then 6 years (UK record-keeping rules) |
| Hosting logs | Kept by our hosting provider for a short period under its own policy; we keep no copies |
Ask us at any time and we will delete your messages sooner, unless the law requires us to keep them.
8. Inside Chirone (for hospitals and their clinicians)
Chirone holds information about clinicians in training (for example names, countries, enrolments, documents and correspondence) and about the centre’s staff and faculty who use it. It never holds patient data.
- Controller: the hospital or training centre using Chirone. Its own privacy notice explains why it holds your data. If you are a clinician or staff member and want to exercise your rights, write to the hospital; we will help it answer.
- Where it lives: in the European Union. Access is restricted by role and, where the centre wants it, by department, and enforced by the database itself.
- Sub-processors: Supabase (database, sign-in and files, EU region), Vercel (serves the application) and Anthropic (the AI model behind the assistant, used only when someone asks it something; it sees the question, restricted reporting views without contact details, and any file a person deliberately attaches, and Anthropic’s commercial terms exclude using it to train models). Voice (ElevenLabs) and email sending (Resend) are used only if the centre switches them on.
- The assistant proposes, a person decides: it does not change records on its own.
The data processing agreement with each customer sets the full details, including retention, security measures and the current list of sub-processors. Customers can ask us for our compliance pack.
9. Your rights
You can ask us to:
- give you a copy of the personal data we hold about you (access);
- correct it if it is wrong (rectification);
- delete it (erasure), unless the law requires us to keep it;
- limit how we use it while a question is resolved (restriction);
- send it to you or another organisation in a usable format (portability);
- stop using it where we rely on legitimate interests (objection).
Write to ciao@chirone.io. It is free, and we answer within one month. We may ask you to confirm who you are.
10. Complaints
Please tell us first and we will try to put it right. You also have the right to complain to a supervisory authority: in the UK, the Information Commissioner’s Office (ico.org.uk, 0303 123 1113); in Italy, the Garante per la protezione dei dati personali (garanteprivacy.it); or the authority where you live or work.
11. Security
Data is encrypted in transit (TLS) and at rest. Access inside Chirone is limited by role and checked by the database on every request; contact details and identity documents are visible only to people allowed to see them. If a breach affected data we control, we would notify the regulator within 72 hours where required, and you if it put you at high risk. If it affected data inside Chirone, we would tell the hospital without undue delay so it can do the same.
12. Children
This website and Chirone are meant for professionals. We do not knowingly collect data from anyone under 18.
13. Changes to this policy
If we change this policy, we will update the date at the top. If a change matters to how we use your data, we will say so clearly on this page and, for customers, in writing before it takes effect.
14. Contact
Okomfo Ltd, 128 City Road, London, EC1V 2NX, United Kingdom
Registered in England and Wales, company number 16671039
ciao@chirone.io