Your information.
Handled carefully.

Last updated: October 2026

About this notice

This privacy notice explains how Cernwell handles personal information when you visit this website, contact us, or communicate with us about our services.

Information we may collect

If you contact Cernwell, we may receive information such as your name, email address, organisation, job role and any information you choose to include in your message or subsequent correspondence.

The website may also generate limited technical information associated with normal web hosting and security, such as IP addresses, browser information and server logs.

How we use your information

Personal information may be used to respond to enquiries, communicate with you, understand your requirements, provide or discuss services, maintain appropriate business records, and protect the security and operation of the website.

We do not sell your personal information.

Workflow Scan field trial

If you choose to use the Cernwell Workflow Scan, we collect the industry or sector, organisation-size band and role you provide, together with the Scan conversation, its structured diagnostic state, any result generated, whether the Scan was completed or abandoned, and a record of the privacy notice shown to you. Each Scan has a unique identifier.

We use this information to provide the Workflow Scan you requested and to evaluate how effectively the field-trial diagnostic works. Our lawful basis for this processing is legitimate interests. Those interests are delivering the requested diagnostic and identifying failures or improvements before any wider use. We limit the information collected, give you a notice before the Scan begins and apply the retention periods below.

Your organisational context and Scan conversation are sent to OpenAI's API to generate the questions and result. They are also stored using Cernwell's hosting provider. Routine human access to field-trial diagnostic and contact records is restricted to Richard. Service providers may process information only where needed to provide and secure the relevant service.

You do not need to give us your name, company or email to start or complete a Scan. Please do not enter health or other sensitive personal details, unnecessary information about identifiable people, confidential information or trade secrets into the Scan.

After a result, you can separately ask Richard to contact you about that Workflow Scan. If you do, we may collect your name, company and email and link them to the Scan so that you do not have to explain the workflow again. These optional contact details are stored separately and are not sent to OpenAI. Entering an email address does not by itself give permission to contact you. If you do not explicitly request contact, we do not retain the name, company or email entered. Workflow Scan contact information is used only to respond about that Scan and is not used for newsletters or general marketing.

Incomplete or abandoned Scans are kept for 30 days after their last activity. Completed Scans are kept for 90 days after their last activity. Where contact was requested and no substantive follow-up relationship begins, the permitted contact details are kept for 90 days from the contact request. If a substantive relationship begins, information needed for that relationship is handled as an ordinary business record; this does not extend how long we keep the diagnostic transcript.

Correction and deletion requests are handled manually during the field trial. Long-term field-trial learning uses genuinely de-identified findings rather than retaining identifiable diagnostic transcripts indefinitely.

Legal basis

Depending on the circumstances, personal information may be processed because it is necessary to respond to a request, take steps towards or perform a contract, comply with a legal obligation, or pursue legitimate business interests where those interests do not override your rights and freedoms.

Sharing information

Information may be shared with service providers where this is necessary to operate Cernwell or provide its services, for example providers of website hosting, email or other business systems.

Information may also be disclosed where required by law or where necessary to establish, exercise or defend legal rights.

How long we keep information

Personal information is retained only for as long as reasonably necessary for the purpose for which it was collected, including any legal, accounting or reporting requirements.

Your rights

UK data protection law provides rights in relation to personal information. Depending on the circumstances, these may include rights to access, correct or erase information, restrict or object to processing, and request the transfer of certain information.

You may also have the right to complain to the UK Information Commissioner's Office if you are concerned about how your personal information has been handled.

Cookies and analytics

Cernwell aims to keep the website straightforward and privacy-conscious. If analytics, cookies or other technologies that require additional disclosure or consent are introduced, this notice and the website's consent arrangements will be updated accordingly.

Contact

Questions about this privacy notice or the way Cernwell handles personal information can be sent to enquiries@cernwell.com.