Privacy Notice

Version 4.1, last updated: 27 October 2026

This notice explains how Continuo Health Ltd collects and uses personal data. It also explains your rights and how to use them.

Continuo Health provides patient education videos for healthcare providers. There are three kinds:

• Post-consultation videos (Stream A): a short video your clinician records after your appointment, summarising what was discussed.
• Condition explainer videos (Stream B): pre-recorded videos about a condition, presented by an AI-generated avatar of a clinician.
• Practice service videos (Stream C): videos your practice has made about its own services (such as how to use its health pod or where a clinic is held).

Please read the part that applies to you:

• Part A — if you are a patient who has received a video link.
• Part B — if you are a clinician or clinic staff member using Continuo.
• Part C — if you visit our website or contact us.
• Part D — information for everyone.

Who we are and how to contact us

Continuo Health Ltd is registered in England and Wales, company number 17412653. Our registered office is 66 Paul Street, London EC2A 4NA.

• Email: contact@continuo.health
• Data Protection Officer: Dr Nicholas Halsey (contact@continuo.health)
• ICO registration number: ZC236917

Our role: controller or processor

A controller decides how and why personal data is used. A processor acts only on a controller's instructions.

Patients: your healthcare provider is responsible for your data. Contact them first about your health records or your rights. See Part A.

Part A: Patients

For patient videos, your healthcare provider is the controller. Continuo is their processor. We only use your data to deliver the video, on their instructions.

A1 What data we hold about you

• Your post-consultation video (Stream A). Your clinician's video and audio summary of your appointment. It may include your diagnosis, management plan, medicines, test results and follow-up. This is health data, a special category of personal data.
• Your date of birth (Stream A only). Your clinician enters it when creating your link. We use it only to check it is you before the video plays. It is deleted with the video after 14 days.
• Which explainer video you were sent (Stream B). The video itself is general. But the choice of video may suggest a health condition.
• Link and playback records. Which clinic created the link, which video it opens, when it was created, when it was played, whether the date-of-birth check passed, and which version of the AI disclosure you accepted. These records hold no name, date of birth, NHS number or phone number.

What we do not collect:

• We do not receive your name, address, NHS number or phone number as separate data. Your clinician may say your name in a Stream A video.
• We do not collect any biometric data about patients.
• The video player uses no cookies, no tracking and no accounts. Your IP address and device details pass through our hosting network to deliver the video. We do not keep request logs on the patient video player.

A2 How we get it

• From your clinician. They record your Stream A video or choose a Stream B video in our Clinic App. For Stream A, they also enter your date of birth.
• From your healthcare provider. They send you the link using their own messaging system (for example, Accurx). Continuo does not send text messages and never receives your phone number. Your provider decides who receives the link.
• Automatically. When you open the link, we record that it was played, that you accepted the AI disclosure and, for Stream A, whether the date-of-birth check passed.

A3 How it is used and the legal basis

We use your data only to host the video and let you watch it securely. Your healthcare provider decides the legal basis:

Article 9(2)(h) is supported by the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2 (health or social care). Videos are chosen by health professionals bound by a duty of confidentiality.

• Identity check (Stream A). You enter your date of birth before your post-consultation video plays. After 5 wrong attempts the link locks, and your clinic can send a new one. This is the same kind of check used for documents your practice sends through Accurx.
• No automated decisions. Your clinician chooses every video. No algorithm makes decisions about you.
• AI disclosure. Some explainer videos use an AI-generated avatar of a real clinician. Where they do, this is shown clearly before the video plays. Videos your practice made about its own services are filmed by the practice.
• No other use. We do not use your data for marketing, profiling, research or training AI.
• Statistics. We may count things like how many videos were played. These counts contain no patient data and cannot identify you.

Prefer not to receive videos? Tell your clinician. They can give you the information another way, such as in writing.

A4 Who sees it

• Your healthcare provider and the staff they authorise.
• Our UK hosting provider (Supabase, London), which stores the videos.
• Your Stream A video is never sent to, or processed by, our AI providers (HeyGen or ElevenLabs). It is stored only in the UK.
• Anyone who has the link during its active period. Post-consultation videos also need your date of birth. Please do not forward it, and watch it somewhere private.

See Part D1 for the full list of providers.

A5 How long we keep it

Continuo is not your medical record. Your clinician records your consultation in your healthcare provider's own records. For a copy of your health record, contact your provider.

A6 Your rights

• Contact your healthcare provider first for access, correction, erasure or objection requests. They are the controller.
• If you contact us, we will pass your request to your provider promptly and help them respond.
• After 14 days we no longer hold a copy of your Stream A video.

See Part D4 for your full rights.

Part B: Clinicians and clinic staff

For your account and for avatar creation, Continuo is the controller. For the patient videos you record, your clinic is the controller and we are its processor.

B1 What data we hold about you

• Account data. Name, work email, clinic, role, account ID and multi-factor authentication (MFA) set-up.
• Sign-in and activity records. Sign-in times and an audit log of key actions, such as creating links or changing roles.
• Recordings you make for patients (Stream A). Your image and voice in post-consultation videos. These are processed for your clinic, as its processor.
• Avatar data — only if you choose to take part:
  • photos and video of your face, and recordings of your voice
  • the avatar and voice models made from them
  • the scripts your avatar presents
  • your signed Clinician Consent and Likeness Authorisation Record
• Practice videos you appear in (Stream C). If your practice uploads a video it has made about its own services and you appear in it, your practice is the controller of that recording and confirms to us that you agreed to appear; we store it, review it before publication and play it to the practice's patients as the practice's processor.

We treat your face and voice recordings for avatars as biometric data, a special category of personal data.

B2 How we get it

• From you, when you sign up, record videos, provide avatar material or contact us.
• From your clinic, when an administrator invites you.
• Automatically, from sign-in and audit records.
• From our AI providers. HeyGen and ElevenLabs return finished avatar videos and voice files. These contain your likeness only.

B3 How we use it and the legal basis

Avatar participation is voluntary. You can withdraw consent at any time. Withdrawing does not affect your use of the rest of the service, or any processing before you withdrew.

B4 Who sees it

• Your clinic's administrators can see your account and activity in their clinic.
• HeyGen (USA) and ElevenLabs (USA/EU) process avatar data only, to create your avatar and voice. They never receive patient data, including Stream A recordings.
• Our hosting and infrastructure providers (see Part D1).

B5 How long we keep it

B6 Your rights

• You have all the rights in Part D4.
• To withdraw avatar consent, email contact@continuo.health.
• For patient videos you recorded, requests go to your clinic, as controller.
• For a practice video you appear in, requests go to your practice, as controller.

Part C: Website visitors and enquiries

For our website, enquiries and marketing, Continuo is the controller.

C1 What data we hold

• Enquiry data. Name, work email, organisation, phone number and your message.
• Customer data. For practices that buy our service: contact details and billing details.
• Website analytics — only if you accept analytics cookies. Pages viewed, device and browser type, approximate location and a pseudonymous ID.
• Your preferences. Your cookie choice and your marketing preferences.

C2 How we use it and the legal basis

C3 Cookies

We only use cookies that are strictly necessary, unless you agree to analytics.

You can change your cookie choice at any time using the cookie link in our website footer. You can also block cookies in your browser.

C4 Marketing

• We will only send marketing with your consent, or to business contacts where the law allows it.
• You can opt out at any time using the unsubscribe link in any email, or by emailing contact@continuo.health.
• If you opt out, you will still receive essential service messages.
• We never share your data with third parties for their marketing.

C5 How long we keep it

Part D: Information for everyone

D1 Sharing your data

We do not sell personal data. We share it only with the providers below, under written data processing agreements. They may not use it for their own purposes.

Patient data never goes to HeyGen or ElevenLabs. This includes Stream A consultation videos, which are stored only in the UK.

Your healthcare provider's messaging system (for example, Accurx) sends patient links. It works for your provider, not for us.

We may also share data:

• Business changes. If Continuo is involved in a merger, acquisition or asset sale, data may transfer. We will tell you before it becomes subject to a different privacy notice.
• Law enforcement and legal duties. Where the law requires it, or a court or public authority makes a valid request.
• To protect people and the service. To prevent or investigate wrongdoing, protect someone's safety, or defend legal claims.

D2 International transfers

• Patient data stays in the UK. It may briefly pass through Cloudflare's network on its way to you, encrypted.
• The EU is recognised by the UK as giving adequate protection.
• HeyGen and ElevenLabs (USA) receive clinician avatar data only. Transfers rely on the UK Extension to the EU-US Data Privacy Framework (the "UK-US data bridge"). We check their certification every year. If a provider is not certified, we use the UK International Data Transfer Addendum to the EU Standard Contractual Clauses.
• Google Workspace transfers rely on the same safeguards.
• Resend (a US company) sends staff sign-in codes and invitations from its EU region. No patient data is involved.

For a copy of these safeguards, email contact@continuo.health.

D3 How we protect your data

We follow three security principles: confidentiality, integrity and availability.

People

• Access to personal data is limited to people who need it for their role.
• Everyone with access completes data security training every year.
• Our founders are doctors, bound by professional duties of confidentiality.
• Our own administrators cannot browse clinic or patient data through our apps.

Infrastructure and resilience

• We run no servers of our own. Our apps run on Cloudflare. Our database and files are on Supabase in London.
• These providers handle physical security, patching and network protection.
• The database is backed up daily. Explainer videos have a separate locked backup that cannot be altered.
• We keep a written restore procedure.

Technology

• Encryption in transit: HTTPS with TLS 1.2 or higher on every connection.
• Encryption at rest: by our providers (Supabase uses AES-256).
• Staff sign-in: individual accounts with strong passwords (12+ characters), and we email you a 6-digit sign-in code through Resend; no patient data is in that email. No shared logins.
• Access control is enforced inside the database. Staff only ever see their own clinic's data.
• Patient videos open only through short-lived secure links, after the AI disclosure has been accepted. Post-consultation videos also require the patient's date of birth, and the link locks after 5 failed attempts. Open public links are not used.
• Audit log: key actions are recorded in a log that cannot be edited.
• Secure development: every code change goes through automated testing and security checks before release. Secret keys are never stored in code.
• Independent testing: we commission a penetration test before launch and after major changes.

D4 Your legal rights

Under UK data protection law you have the right to:

• Access your personal data (a "subject access request").
• Correct data that is wrong or incomplete.
• Erase your data in certain circumstances. We may not always be able to, for legal reasons; we will tell you why.
• Object to processing based on legitimate interests or public task. You can always object to direct marketing.
• Restrict processing, for example while accuracy is checked.
• Data portability, where processing is based on consent or contract and is automated.
• Withdraw consent at any time, where we rely on consent. This does not affect processing before you withdrew.
• Not be subject to automated decisions. We make no automated decisions about anyone.

Who to contact:

• Patients: contact your healthcare provider first. They are the controller of your video data. If you contact us, we will pass your request to them and help them respond.
• Everyone else: email contact@continuo.health.

No fee usually required. We may charge a reasonable fee, or refuse, if a request is clearly unfounded, repetitive or excessive.

What we may need from you. We may ask you to confirm your identity. This stops data going to the wrong person.

Time limit. We respond within one month. Complex requests may take up to two more months; we will tell you if so.

D5 Contact details

• Email: contact@continuo.health
• Post: Data Protection Officer, Continuo Health Ltd, 66 Paul Street, London EC2A 4NA
• Data Protection Officer: Dr Nicholas Halsey

D6 Complaints

You can complain to us at any time. You also have the right to complain to the Information Commissioner's Office (ICO), the UK data protection regulator:

• Website: www.ico.org.uk
• Phone: 0303 123 1113

We would welcome the chance to resolve your concern first.

D7 Changes to this notice

We review this notice regularly. This version was last updated on 27 October 2026. Please tell us if your own details change, for example your email address.

D8 Third-party links

Our website may link to other websites. We do not control them and are not responsible for their privacy practices. Please read their privacy notices.

D9 Payments

Practices pay for our service through a third-party payment provider. We do not store card details. Payment data is handled under the provider's own privacy notice.

D10 National Data Opt-Out (UK)

We do not use confidential patient information for research or planning, so the national data opt-out does not apply to our processing. We review this every year. Find out more at www.nhs.uk/your-nhs-data-matters.

D11 Children

• Our website is not aimed at children under 18.
• Patient videos may be sent to children, or to their parents or carers, when their healthcare provider decides this is appropriate. The provider is the controller and follows its own rules on children's confidentiality and consent.
• We create no accounts for patients, including children, and collect no extra data about them.

See also our Terms & Privacy page, which covers the medical disclaimer and conditions of use.