Legal

Privacy policy

CESieR helps doctors organise and gap-check the documentary evidence for a GMC Portfolio Pathway application for specialist or GP registration. That means we handle sensitive material — clinical documents, professional declarations, and workplace assessments — so we take that responsibility seriously. This policy explains, in plain language, what we collect, why, how we protect it, and the rights you have over it.

Last updated: 11 August 2026

Who we are

CESieR is operated by Kinesis Consultants Ltd, a company registered in England and Wales, which is the data controller for the personal data described here. We are registered with the Information Commissioner’s Office under reference ZC116604. Our registered address is #406 Peppercorn Court, 18 Blair Street, London E14 0NY. Privacy enquiries should be directed to hello@cesier.uk.

CESieR is not affiliated with the General Medical Council (GMC) or any Royal College, deanery, or employing trust. Your specialty specific guidance (SSG) and the GMC’s own guidance remain the authoritative source for what your application must contain; we organise and gap-check your evidence, we do not assess it.

Who uses CESieR

The people who use CESieR are applicants — doctors who create an account, set up an application for a specialty, upload their evidence, and use the review and coverage views to organise it and export a bundle. Almost all of the personal data we process belongs to, or is uploaded by, an applicant.

CESieR has no separate accounts for supervisors, verifiers, or referees. Where your evidence or a verification pro-forma names a colleague, supervisor, verifier, or referee, that information lives inside your own private workspace — those people are not users of CESieR and cannot see or change anything.

What information we collect

Account data. We collect your name and email address when you sign up and use them to authenticate you. You sign in with your email and a password; the password is never stored in plain text — our authentication provider (Supabase) keeps only a salted cryptographic hash. If you forget it, we email a one-time recovery link. We also record activity you take in the product, such as applications you create and evidence you upload.

Application data. To build your portfolio structure we collect the specialty and curriculum version you are applying under, the institutions you provide evidence from, and the section descriptions, mappings, and statuses you create as you organise your application. This is professional information about your career and your application.

Evidence you upload. You upload the evidence for your application — certificates, ARCP outcomes, workplace-based assessments, multi-source feedback, logbooks, letters, appraisals, and similar files. These documents can contain information about you (including professional and, in some declarations, health and probity information) and may incidentally contain information about patients. How we screen and minimise that is described in the next two sections. When we read a document we also derive and store structured details from it — the document type, its dates, the institution it came from, the extracted text, any patient-identifiable-information flags, and the section mappings we suggest.

Your decisions. We keep the mappings you confirm or reject, the descriptions you write, and the flags you dismiss (with the reason you give), as an audit trail so your application record is defensible and so a re-run of the pipeline never overrides a decision you have made.

Payment data. If you unlock a paid tier, billing is handled by Stripe. We do not store your card details; we keep a record of your unlock and transaction history.

Technical data. We collect standard server logs, including IP address, device and browser type, and timestamps, to run and secure the service. We do not use advertising trackers, and we do not run behavioural analytics.

Correspondence. If you contact us — for example by emailing hello@cesier.uk — we process your email address, the name you give, and the content of your message in order to respond to you. Email sent to that address is delivered to our mailbox by ImprovMX, our email-forwarding provider (listed below). We keep correspondence only as long as needed to deal with your enquiry and keep a sensible record of it.

Patient-identifiable information (PID)

CESieR is designed to hold the evidence of your career, not patient records. You must anonymise clinical evidence before you submit it to the GMC — that is a GMC rule, and the responsibility for it stays with you.

As a safety net, every document we process is screened for patient-identifiable information (such as NHS numbers, dates of birth in a patient context, hospital numbers, and patient names) before any other processing, and — importantly — the first screen runs locally, before any text is sent to an external AI service. A document where identifiers are detected is blocked: it is not classified or mapped further and is excluded from your export until you redact and re-upload it, or record why the flag was a false positive. What the screen finds is shown to you and is never placed behind a paywall. We never use patient information for any purpose except telling you it is there.

Not every document is processed straight away. Screening and processing are free for your first 15 documents — counted per account and in documents, not uploads (one upload can contain several documents). Beyond that allowance, a document is stored but not processed: it is not read, not screened, and its content is not sent to any external service, until you unlock processing with a screening pass or a paid tier. Held documents are shown as “Not screened”, counted separately, and your export bundle excludes them and names them in its gap report — being unscreened is not the same as being clean, and we say so. A document identical in content to one we have already screened for you keeps that screening and does not use a slot of your allowance.

How we use artificial intelligence

After a document has been screened for patient-identifiable information, CESieR uses AI to read the remaining evidence text, record structured metadata (document type, dates, institution), and suggest which portfolio section each document supports, with a confidence score and a short rationale. This classification is provided by Anthropic (Claude), which is based in the United States; sending screened evidence text to Anthropic is a restricted international transfer, made under the safeguards described below. Your content is not used to train models.

We treat every piece of document text as data, never as instructions, and apply prompt-injection guards before it reaches a model. Separately, we use OpenAI’s content-moderation service to screen extracted text for harmful or inappropriate material; OpenAI operates a zero-retention policy for moderation requests and does not use the content to train its models.

We describe our AI features by what they do, not by claims about the underlying technology. Every mapping the AI produces is a suggestion that you confirm or reject — see automated decision-making, below.

Special-category data (Article 9)

Two kinds of special-category data can arise in CESieR. First, your own health and probity information, which can appear in declarations, occupational-health documents, or ARCP outcomes. Second, health information about patients, which may remain in clinical evidence despite our expectation and the GMC’s requirement that it is anonymised before submission. Under UK GDPR both are special-category data (Article 9).

We process this data on the basis of explicit consent (Article 9(2)(a)), which you provide when you accept our terms and upload evidence, and we minimise it: the PID screen is designed to catch and block patient identifiers before any external processing, and you should not upload identifiable patient data. We do not use this content for any purpose beyond delivering the organising and gap-check service, and we never share it with insurers, employers, the GMC, a Royal College, your deanery, or anyone other than the sub-processors listed below.

Why we process your information

We process personal data under the following lawful bases:

Contract performance: managing your account and authentication, running the evidence pipeline and coverage view, and handling your unlock.

Legitimate interests: screening for patient-identifiable information to prevent unlawful disclosure, improving the product, preventing abuse, securing the service, and producing anonymised, aggregate analytics. We have assessed that these interests are not overridden by your rights.

Legal obligation: keeping financial records for the period required by UK law (currently seven years).

Consent: for optional processing such as reminder emails, and as the Article 9 basis for special-category data. You can withdraw consent at any time.

A note on control of your evidence. Kinesis Consultants Ltd is the data controller for your account and for operating the service. For the content of the documents you upload, you decide what is processed and why — CESieR reads, screens, and organises that content on your instructions to help you assemble your own application.

Automated decision-making

CESieR does not make automated decisions that produce legal or similarly significant effects. The pipeline only ever suggests a mapping between a document and a portfolio section; a human — you — confirms or rejects it, and confirmed decisions are immutable. A confidence score is a measure of whether a document belongs in a section, not a judgement of whether your evidence is sufficient. Nothing about your registration is determined by the software. The GMC decides your application, not us.

Who we share your information with

We do not sell your personal data and we do not allow advertisers to target you. We share data only with the service providers below, who process it on our behalf under data-processing agreements:

• Supabase — Database, authentication, and private file storage for your uploaded evidence. Your data is hosted in the United Kingdom (London / eu-west-2).
• Vercel — Hosting and deployment of the application; server functions that process your evidence run in the London region.
• Anthropic — AI classification of evidence — reading screened document text to record metadata and suggest which portfolio section it supports. Based in the United States; transfer governed by Standard Contractual Clauses with the UK addendum, under Anthropic’s Data Processing Addendum. Your content is not used to train models.
• OpenAI — Content-moderation screening of extracted document text for harmful or inappropriate material. Based in the United States; operates a zero-retention policy for moderation requests and does not use the content to train its models.
• Stripe — Payment processing and management of your unlock. We never see or store your card details.
• Resend — Delivery of account, recovery, and (if you opt in) reminder emails.
• ImprovMX — Forwarding of email sent to our contact address (hello@cesier.uk) to our mailbox. ImprovMX processes EU and UK customers’ email in the European Union (France) and does not read or sell email content.

If you choose to host a verifier evidence pack at a link, we serve that pack — the GMC pro-forma and the evidence files it names — to anyone who has the link, so it can be read by the verifier you send it to. You control this disclosure: you create the link, you can revoke it at any time from the verifiers screen, issuing a new version makes the old link stop working, and every link expires automatically after 30 days. We record when a hosted pack is opened (but not who opened it, and no account is required to open one) so you can see whether your verifier has received it.

We may disclose personal data if required by law, a court order, or a regulator, and would tell you unless legally prevented from doing so.

International transfers

Your account and evidence are stored in the United Kingdom. Two of our sub-processors — Anthropic and OpenAI — are based in the United States, so the screened text we send them for classification and moderation is transferred internationally. We rely on Standard Contractual Clauses with the UK addendum for these transfers (or the UK–US data bridge where the provider is certified under it), and have assessed them as necessary and proportionate, including for any special-category data involved. Email sent to our contact address is forwarded by ImprovMX, which processes it in the European Union; transfers from the UK to the EU are covered by the UK’s adequacy regulations.

How long we keep your information

• Account and evidence data: kept while your account is active.
  • Deleting a document deletes it. The file, its extracted text, its thumbnail and any redacted copy are removed from storage immediately.
  • Deleting an application hides it and gives you 72 hours to change your mind. It does not erase anything straight away: the documents, the extracted text and the stored files all remain while the application sits in that state, so that you can undo it.
  • We do not keep a deleted application forever: after 90 days we erase it. That means the documents, the extracted text, the thumbnails, any redacted copies and the stored files themselves — permanently, and we check they are gone rather than assuming it. The 72 hours above is your window to change your mind; the 90 days is the longest we will hold evidence you have already told us you do not want. To be plain about how it happens: the erasure is carried out by our team rather than by an automatic timer, and our systems flag every application that reaches 90 days for action, every night, until it is done.
  • Erasing everything sooner is something you ask us for, and we do. We do not currently offer a self-service “delete my account” button. Email hello@cesier.uk and we will permanently delete your documents, extracted text, mappings and stored files and confirm when it is done — normally within a few days, and always within 30 days of your request.
  • Anonymised, aggregate statistics may be kept for product improvement.
• Audit trail: the record of your confirmations, rejections and dismissed flags. It holds references only — entity ids, counts and check names, never document content or personal data from your files — and is kept on a rolling 12-month retention, pruned nightly. Because it names no content and is not linked to your account record, it is not removed when an account is erased; it ages out on that 12-month cycle.
• Billing records: retained for seven years, as required by UK law. These are minimal (transaction ID, amount, date, tier) and never include card data, which is held by Stripe.
• Authentication logs: retained for 90 days for security purposes, then deleted.

Cookies and similar technologies

CESieR sets only cookies that are strictly necessary to deliver the product — the first-party Supabase authentication cookies (names beginning sb-) that keep you signed in. We have deliberately chosen not to add analytics, advertising, or behavioural tracking cookies, and we use no Google Analytics, Meta Pixel, or equivalent. Because there are no non-essential cookies, we do not show a cookie banner.

When you pay, Stripe sets cookies on its own checkout domain for fraud prevention; we do not embed Stripe’s scripts on our own pages. If we ever add cookies that require consent under UK PECR, we will add a proper consent mechanism and update this policy first.

Security

We take reasonable technical and organisational measures to protect your data: encrypted storage and transmission (TLS), row-level security on our database so that each user’s data is accessible only to them, a private storage bucket scoped per user, and UK data residency.

We are a small team at an early stage, and we want to be honest about what that means: we do not have the security apparatus of a large enterprise, and we keep improving as the product matures. If you find a vulnerability, please email hello@cesier.uk before disclosing it publicly, and we will respond promptly.

Your rights

Under UK GDPR you have the following rights over your personal data:

• Access — request a copy of the personal data we hold about you.
• Rectification — ask us to correct inaccurate or incomplete data.
• Erasure — ask us to delete your personal data, subject to any legal obligation to retain certain records.
• Restriction — ask us to restrict how we process your data in certain circumstances.
• Portability — request an export of your data in a structured, machine-readable format.
• Objection — object to processing we carry out on the basis of legitimate interests.
• Withdrawal of consent — where we rely on consent (such as reminder emails), withdraw it at any time without affecting processing already carried out.

To exercise any of these, contact hello@cesier.uk. We will respond within 30 days. If you are not satisfied, you can complain to the Information Commissioner’s Office at ico.org.uk.

Third parties in your evidence

Your evidence naturally mentions colleagues, supervisors, referees, and verifiers. You are responsible for being fair about whose information you upload. When our AI analyses who appears in a document it is instructed to record initials and roles only, never full names, and those details stay inside your private workspace — we do not build a profile of the third parties named in your evidence.

CESieR is not an assessment tool

CESieR organises and gap-checks evidence; it does not assess you and it does not guarantee any registration outcome. Your application is decided by the GMC against its published guidance and your specialty specific guidance (SSG). Any gap, substitution, or maintenance prompt CESieR shows you is procedural coaching grounded in the SSG — it is not a judgement that your evidence is or is not sufficient. Nothing CESieR shows you is a substitute for the GMC’s guidance, your SSG, or advice from a suitably experienced colleague or your Royal College.

Changes to this policy

We will update this policy as the product develops. When we make significant changes we will notify you by email and show a notice in the product; the date at the top always reflects the latest revision. Minor corrections and clarifications are made without specific notice.

Contact us

For any question about this policy, to exercise your rights, or to raise a concern, contact hello@cesier.uk.

Kinesis Consultants Ltd · ICO registration ZC116604 · Registered in England and Wales · #406 Peppercorn Court, 18 Blair Street, London E14 0NY