VERSION 4.3
| Last Updated | 11 October 2026 |
| Company | Trikon Digital Ltd |
| Company Number | 16389383 |
| ICO Registration | ZB998606 |
| Registered Office | 86 Twinnies Road, Wilmslow, SK9 4BP, United Kingdom |
| admin@trikondigital.com | |
| Website | www.trikondigital.com |
1.1 Trikon Digital Ltd (“Trikon”, “we”, “us” or “our”) supplies software and technology services to providers and
their authorised staff. These include services supporting appointment administration, electronic records, medico-legal reporting, communications and account management, depending on the features selected by each provider.
1.2 We do not provide clinical care, medical examinations, treatment, psychological services or independent
medico-legal opinions. Providers are responsible for their professional services and decisions.
1.3 This policy explains our handling of personal information relating to providers, their staff and website visitors,
and how we process patient and claimant information on providers’ behalf. It applies to our website and provider software services, including supported applications where applicable.
1.4 “Provider” means an organisation or professional using our services. “Provider records” means personal
information a provider supplies or collects through the platform concerning patients, claimants or other individuals receiving that provider’s services.
1.5 Trikon is committed to handling personal information securely, lawfully, fairly and transparently in accordance
with the UK GDPR, the Data Protection Act 2018 as amended, applicable ICO guidance and its contractual data protection obligations. Our arrangements support providers’ MedCo obligations where applicable; Trikon remains a technology supplier and does not undertake the provider’s professional role.
2.1 Trikon identifies and documents lawful bases for its own controller activities and provides clear privacy
information. For provider records, Trikon follows documented instructions and assists the controller with its obligations. Providers identify the lawful basis and any additional condition required for health or other sensitive information.
2.2 Personal information is used for specified, explicit and legitimate purposes. Provider records are processed
only for authorised service purposes or as required by law. Trikon does not use patient or claimant records for its own advertising or unrelated marketing.
2.3 Trikon limits information collected, accessed and disclosed to what is adequate, relevant and necessary for
the purpose. Staff and suppliers receive only the access needed for their functions. Providers must avoid uploading unnecessary information.
2.4 Trikon enables correction of account information and assists controllers with authorised corrections to
provider records. Providers remain responsible for checking the accuracy of their records and AI outputs. Appropriate audit trails preserve the history of amendments where required.
2.5 Personal information is retained only as long as necessary. Provider records follow documented retention
instructions during the service. On termination, non-billing provider information is returned or deleted under the arrangements in section 9, with deletion within 30 calendar days, subject to specific legal preservation requirements. Necessary accounting information follows the statutory retention period. Temporary AI material is deleted after processing unless saving is instructed.
2.6 Trikon protects personal information through appropriate technical and organisational safeguards, including
restricted access, authentication, confidentiality obligations, security monitoring and protected backup arrangements. Hosting and processing locations are described in section 4, including UK AI processing and third-party service arrangements. Suspected incidents are investigated and breaches are notified where required.
2.7 Trikon maintains applicable processing records, risk assessments, supplier agreements, staff training records
and evidence of security and deletion procedures. It reviews these measures and assists controllers with rights requests, breaches, DPIAs and audits. The privacy notice supports this framework but does not replace the Article 28 processing agreement or demonstrate implementation by itself.
3.1 Depending on the relationship, we may collect:
• Names, business contact details, organisation and professional role information.
• Account identifiers, access permissions and authentication information.
• Subscription, licence, credit, invoice and transaction information.
• Support requests, correspondence and service feedback.
• Login, device, browser, IP address, security and service usage information.
• Marketing preferences where relevant.
3.2 We obtain this information from providers, account administrators, authorised users, enquiries, service
interactions and relevant service suppliers, such as payment processors. An administrator may create an account or assign access for another authorised user.
3.3 We do not store full payment card details. Payment processors handle card information under their applicable
terms and privacy notices.
3.4 Where professional registration is required for a provider’s role or use of relevant platform features, Trikon
may verify registration with the relevant regulatory body using its official register or other appropriate evidence. We may process and retain the regulatory body’s name, registration number, relevant registration status, verification date and verification outcome for provider account administration and verification purposes.
3.5 For these checks, Trikon acts as controller and relies on its legitimate interests in administering access to
relevant services and verifying applicable professional registration requirements. Information may be obtained from the provider and the relevant regulator’s official register. Providers should notify Trikon of material changes to their registration. A verification result reflects the status checked at that time and does not amount to an endorsement of clinical competence or continuous regulatory monitoring.
3.6 Professional registration and verification records follow the retention arrangements in section 9. They are
deleted with other non-billing provider information within 30 calendar days of contract termination, unless a specific legal preservation requirement applies.
3.7 Depending on the provider’s use of the platform, records may include identity and contact details,
appointment details, medical history, health information, medical records, assessments, treatment information, correspondence, reports and medico-legal claim information, including relevant solicitor, insurer and accident details. Some records may contain other sensitive information relevant to the provider’s service.
3.8 These records are supplied by providers or their authorised staff, or entered by individuals through
provider-controlled forms, questionnaires or portals where those features are enabled. Using such a feature does not mean Trikon supplies the underlying professional service.
3.9 Providers must limit the information processed to what is necessary and ensure they have appropriate
authority to collect and disclose it.
3.10 Financial information may include subscriptions, invoices, credits purchased, payment references,
transaction histories and accounting records. Trikon does not store full payment card details.
3.11 Technical information may include IP addresses, browser and device details, login records, access
permissions, service usage and audit or security logs. Access and retention are limited to the relevant service, security and accountability purposes.
3.12 We may process information submitted in enquiries and technical information needed to operate and protect
the website. Any optional cookies or similar technologies are explained in the applicable cookie information and managed as required by law.
4.1 Trikon is a UK-based technology company. Its primary platform records are hosted using Amazon Web
Services (AWS) infrastructure in the United Kingdom. This hosting statement does not mean that every supporting supplier processes every category of information exclusively in the UK.
4.2 AI functions use Anthropic’s Claude models through Amazon Bedrock, configured for processing within the
United Kingdom only. Trikon does not use EU or global cross-region inference for this processing. Claude is the model supplied through AWS; Trikon does not send provider records directly to Anthropic’s API. Under the applicable Bedrock arrangements, model inputs and outputs are not shared with Anthropic as the model provider. AWS automated email services, Microsoft business email, FireText messaging and Google address lookup operate under their applicable service and data protection terms. Their processing and support arrangements may differ from the primary platform’s hosting location.
4.3 Where supplier processing involves a restricted transfer outside the UK, Trikon remains responsible for the
transfer arrangements it initiates. It uses an applicable lawful mechanism, such as UK adequacy regulations or appropriate contractual safeguards, and completes any required assessment. Information about current supplier locations and relevant safeguards, including how to obtain information about them, is available from admin@trikondigital.com.
4.4 Providers are responsible for transfers they independently undertake after exporting information or through
separately selected systems. This does not remove Trikon’s responsibility for its own processing, supplier arrangements or transmissions.
4.5 We apply technical and organisational measures appropriate to the nature of the information and the risks of
processing. These include controlled access, confidentiality obligations, security monitoring and procedures for handling incidents. Our Information Security and Data Protection Policy sets out the requirements for authentication, encryption, access management, development, backups and incident handling.
4.6 Providers and users must protect their login credentials, use authorised accounts, follow available
authentication safeguards and promptly report suspected misuse. Providers must manage their users’ permissions and secure their own devices, premises and working practices.
4.7 Where we become aware of a personal data breach affecting records processed on a provider’s behalf, we
notify the relevant controller without undue delay and assist under the processing agreement. For our controller activities, we notify the ICO and affected individuals when legally required. We maintain records of breaches and notification decisions.
4.8 We assist controllers with individual-rights requests, security obligations, breach notifications, Data Protection
Impact Assessments and any required consultation with the ICO, taking account of the nature of processing and information available to us. We maintain applicable processing records and make relevant information available to demonstrate compliance with our processor obligations. We allow and contribute to audits and inspections by the controller or its appointed auditor under the processing agreement, with appropriate safeguards for other customers’ information.
4.9 Our assurance evidence includes relevant risk assessments, access controls, staff confidentiality and training
records, incident records, supplier reviews and backup or deletion testing. MedCo customers may request relevant supplier evidence to support their own audits. Trikon does not represent this policy as ICO certification or MedCo approval, and providers remain responsible for their own practice-specific compliance documentation.
5.1 We act as a controller when we decide why and how personal information is used for our own business
activities. These include managing provider subscriptions and accounts, billing, business enquiries, our business communications and website administration. We explain the purposes and lawful bases below.
5.2 Where we host, store, transmit or otherwise handle provider records solely on the provider’s documented
instructions, we act as a data processor. The relevant provider determines its controller responsibilities, including lawful bases, privacy information, disclosures and retention. Some customers may themselves be processors; the contractual processing chain must reflect the actual arrangement.
5.3 We process these records under the applicable data processing agreement and documented instructions,
except where law requires otherwise. Our supply of software does not transfer a provider’s professional or controller responsibilities to Trikon.
5.4 Our controller-processor agreement specifies the subject matter, duration, purposes and nature of
processing, categories of information and individuals, and the controller’s rights and obligations. It also covers confidentiality, security, subprocessors, assistance with individual rights, breach handling, data protection impact assessments, return or deletion of records, and audit cooperation. This privacy policy supplements that agreement; it does not replace it.
5.5 We inform the controller if, in our opinion, an instruction infringes applicable data protection law. Where law
requires processing beyond the controller’s instructions, we notify the controller before processing unless the law prohibits notification.
5.6 For questions about an examination, treatment, medical report or the provider’s use of your records, contact
that provider. Providers should make their own privacy notice available. This notice does not replace it.
| Purpose | Relevant lawful basis |
|---|---|
| Set up and supply services to an individual contracting provider | Contract, where necessary to perform that contract or take requested steps before it |
| Manage accounts and communicate with staff or contacts of an organisational customer | Legitimate interests in supplying and administering our business services |
| Manage subscriptions, invoices, transactions and debt recovery | Contract where applicable; legitimate interests in business administration and recovery; legal obligation for required financial records |
| Respond to enquiries and support requests | Contract where applicable; otherwise legitimate interests in responding and supporting users |
| Maintain service security, prevent misuse and investigate technical issues | Legitimate interests in protecting our systems and users; legal obligation where applicable |
| Comply with legal duties or respond to lawful requests | Legal obligation where a specific duty applies |
| Send relevant business marketing | Consent where required; otherwise legitimate interests where permitted by applicable electronic marketing law |
6.1 We assess legitimate interests against individuals’ rights and reasonable expectations. You may contact us
for information about a relevant assessment. A contract with a corporate customer is not automatically a contractual lawful basis for processing all information about that customer’s employees.
6.2 We do not use patient or claimant records for our own advertising or unrelated marketing.
6.3 Information necessary to create an account, supply contracted services or meet a legal obligation must be
provided for those purposes. If it is not supplied, we may be unable to provide the relevant service or complete the transaction. Optional marketing preferences are not a condition of receiving the core service.
7.1 For records processed on a provider’s behalf, the controller must identify an appropriate Article 6 lawful basis
and, where health or other special category information is involved, an Article 9 condition. Where criminal offence information is involved, the controller must also satisfy the applicable additional requirements.
7.2 For medico-legal work, Article 9(2)(f) may apply where processing is necessary for establishing, exercising or
defending legal claims. The provider must assess the actual purpose and necessity; this condition does not automatically apply to every use of the platform.
7.3 Consent to examination, treatment or release of confidential medical records is a separate matter from the
choice of GDPR lawful basis. Our contract with the provider is not, by itself, a sufficient legal basis for every use of an individual’s health information.
7.4 Trikon does not independently determine medical opinions or disclose provider records to solicitors, insurers,
compensators, courts or MedCo simply because they are involved in a claim. Such processing must follow the controller’s authorised instructions or an applicable legal requirement.
8.1 Trikon uses the following services where relevant to the provider’s selected features. Only information necessary for the relevant function is supplied.
| Supplier or service | Purpose | Relevant information |
|---|---|---|
| Microsoft email services | Business email, enquiries and support communications | Email addresses, messages and attachments included in correspondence |
| AWS UK hosting and storage | Platform hosting, record storage and backups | Provider accounts and records stored through the platform |
| Stripe | Payment processing | Billing contact details, transaction information and payment details submitted to Stripe; Trikon does not retain full card numbers or card security codes |
| FireText | SMS notifications and reminders | Recipient telephone numbers, message content and delivery information |
| Amazon Bedrock using Anthropic Claude models (UK processing) | AI scanning, transcription, scribing and document processing | Material submitted for the requested AI task and resulting output |
| Google address lookup | Address search and completion | Address search text and associated technical information required by the service |
| AWS automated email services | Automated platform emails and notifications | Recipient addresses, message content and delivery information |
8.2 Microsoft processes email service data under the applicable Microsoft data protection terms, including its
Data Protection Addendum where applicable. Supplier GDPR commitments support Trikon’s obligations but do not, on their own, establish compliance for every configuration or use.
8.3 Suppliers may act as processors or subprocessors for relevant service data, and as controllers for specified
activities under their terms. Google address lookup is governed by the terms applicable to the particular Google service; For relevant Maps services, Google may act as a separate controller under its applicable controller-controller terms. Trikon maintains a supplier register identifying the exact services used, applicable roles, contractual arrangements, processing locations, relevant retention arrangements and any required international transfer safeguards. This register is reviewed when suppliers or configurations change. Providers may request the current information using our data protection contact details.
8.4 Google address lookup is used for address searching and completion, not for clinical or medico-legal
analysis. Providers should not enter names, medical details, claim narratives or other unnecessary sensitive information into address-search fields. Appointment messages should likewise contain only the information necessary for their purpose.
8.5 Access is restricted to authorised personnel and suppliers who need it for their assigned functions, subject to
confidentiality and appropriate safeguards.
8.6 For our controller activities, relevant recipients may include hosting, communications and payment suppliers;
professional advisers, insurers and auditors; and authorities where disclosure is legally required or otherwise lawfully justified.
8.7 For provider records, authorised subprocessors may provide hosting, backups, communications or technical
support under the applicable processing agreement. Their use requires the controller’s prior specific or general written authorisation and a contract imposing equivalent data protection obligations. Where general authorisation applies, we notify the controller of intended changes and provide an opportunity to object in accordance with the processing agreement. Trikon remains responsible to the controller for its subprocessors’ performance of their data protection obligations. Providers may contact us for the current subprocessor list, functions and processing locations.
8.8 Where a provider uses platform features to send information to a recipient, we process that transmission on
its instructions. Providers are responsible for confirming the recipient and authority to disclose.
8.9 If there is a business sale or restructuring, any disclosure or transfer must comply with applicable law and
relevant processing agreements. We do not sell patient or claimant records for advertising.
9.1 Trikon retains provider records for the duration of the service in accordance with the provider’s documented
instructions. The provider determines the appropriate retention period for its clinical, patient and medico-legal records and remains responsible for its legal and professional record-keeping obligations. Data is not kept merely because storage remains available.
9.2 At the controller’s choice, Trikon returns or securely deletes the personal information processed on its behalf.
Providers must arrange the required export or return of their information before deletion. They should request return arrangements before the contract ends; termination does not extend their clinical record-retention duties to Trikon.
9.3 Trikon securely deletes provider records and non-billing provider account information within 30 calendar
days of the effective contract termination date. This includes patient and claimant records, uploaded documents, stored provider reports, saved AI content, staff accounts and other non-billing information associated with the terminated service. Records awaiting deletion remain protected and are used only as needed for authorised return/export, secure closure or a legal requirement.
9.4 Existing backup copies must also be securely deleted within the same 30-day period. Until deletion, they
remain protected and beyond routine use. Where restoration is necessary during that period, deletion instructions must be reapplied. These return and deletion arrangements form part of the applicable processing agreement. We document completion of deletion and provide confirmation to the controller on request. The confirmation concerns Trikon and its authorised subprocessors; it does not cover copies that providers independently export or retain.
9.5 Following termination, Trikon ordinarily retains only billing and accounting information needed for its own
accounts and tax obligations, such as invoices, payment and transaction records and the minimum provider identification and contact details necessary to support those records. These records do not include patient or claimant clinical information or copies of medical reports.
9.6 Billing and accounting records are normally retained for six years from the end of the company financial
year to which they relate, or longer where applicable tax or other law requires. They are restricted to the relevant accounting, tax and compliance purposes and securely deleted when the retention requirement ends.
9.7 If law specifically requires other information to be preserved, Trikon retains only what is required, restricts its
use, documents the reason and deletes it once the requirement ends. A statutory requirement takes precedence over the normal 30-day deletion commitment.
9.8 Website enquiries and related correspondence are retained while the enquiry remains open and for as long
as reasonably needed to address follow-up questions or resolve a related complaint or dispute. We assess continued retention by reference to whether the matter remains unresolved, the likelihood of relevant follow-up and any applicable legal requirement; information is deleted or anonymised when those purposes end. Support correspondence associated with a provider service is subject to the 30-day termination deletion arrangements above unless it forms part of a necessary billing record or must be preserved by law.
9.9 Technical and security logs are retained only while needed to investigate relevant activity, detect abuse or
resolve a security incident. Retention is assessed by reference to the log’s purpose, whether an investigation remains open and any legal preservation requirement. Logs associated with a terminated provider service are subject to the same 30-day deletion commitment, except where law requires preservation. Cookie-specific periods are set out in the cookie notice.
10.1 Depending on the circumstances, individuals may have rights to access, rectification, erasure, restriction,
objection and data portability, and to withdraw consent where processing relies on it. The rights are subject to their statutory conditions and exemptions. Withdrawal does not affect the lawfulness of earlier consent-based processing.
10.2 For information controlled by Trikon, contact us using the details below. We may request proportionate
identity verification. We respond within the applicable statutory timescale, normally one month, and explain any lawful extension or applicable pause. If refusing or limiting a request, we explain the reason and relevant complaint rights where required.
10.3 Requests are normally free. A reasonable fee or refusal is permitted only in the circumstances allowed by
law, including where a request is manifestly unfounded or excessive; repetition alone does not automatically justify refusal.
10.4 For provider records, contact the relevant provider. If we receive a request about those records, we refer it to
the appropriate controller and assist under our agreement. We do not independently decide disclosure, correction or deletion of those records unless authorised or legally required.
10.5 You may object to direct marketing at any time or use the unsubscribe option in a marketing message.
Essential service or account communications may continue.
11.1 Provider accounts are intended for providers and their authorised staff, not direct registration by children to
obtain services from Trikon. Providers may process children’s records where lawful and must address capacity, parental responsibility, confidentiality and appropriate privacy information.
11.2 Where an enabled application uses camera, microphone, location or device permissions, it should explain
the specific function when access is requested. Permission settings can generally be changed through the device or browser. A device permission is not a substitute for a lawful basis for processing recorded information. Providers remain responsible for the professional service and for any recording they initiate.
11.3 Where providers use AI-assisted scanning, transcription, scribing or document processing, Trikon processes
the information on the provider’s instructions using the UK-only Bedrock arrangements described in section 4.
11.4 Trikon does not automatically save AI input files, audio, transcripts, scripts or generated content.
Temporary material is used only to complete the requested processing and is deleted from the processing servers when that operation completes. Saving AI content requires an instruction from the provider.
11.5 AI scans read the supplied material and perform the requested update. Temporary scanning material is then
deleted; this does not delete the original document already stored in the provider’s record or the resulting record update that the provider instructed Trikon to make. Any content the provider explicitly chooses to save becomes part of its provider records and is governed by the provider’s retention instructions and the termination arrangements in section 9.
11.6 The provider remains responsible for reviewing outputs, correcting inaccuracies and deciding their
professional use. Trikon deletes its temporary processing copies and identifiable temporary content in its processing logs and caches when the requested operation completes.
11.7 Trikon uses Anthropic’s Claude models through Amazon Bedrock in the UK, with settings configured not to
retain the submitted inputs or generated outputs after processing. Routine prompt and response content logging is not enabled to save that material. This arrangement is separate from any original document or record update the provider instructs Trikon to store. AWS processing remains subject to the applicable service terms and any legally required exceptions.
11.8 AI outputs support the provider’s work. They do not replace the provider’s review, professional judgement or
responsibility for decisions about patients and claimants.
Trikon Digital Ltd
Company number: 16389383
ICO registration reference: ZB998606
Registered office: 86 Twinnies Road
Wilmslow
SK9 4BP,
United Kingdom
Email: admin@trikondigital.com
12.2 Please contact us with questions or concerns about our handling of information. You also have the right to
complain to the Information Commissioner’s Office at https://ico.org.uk or by telephone on 0303 123 1113.
12.3 If we formally appoint a statutory Data Protection Officer, we will publish their relevant contact details.
Describing our contact as a Data Protection Contact does not claim that a statutory DPO has been appointed.
13.1 The policy owner is Trikon Digital Ltd’s Data Protection Contact. We review this policy at least annually and
sooner when our services, processing arrangements or applicable requirements change. The next scheduled review is 11 October 2027. The current version and last-updated date will appear here. We notify providers of material changes through appropriate communications and provide additional privacy information where required before introducing a new use of personal information.