Legal

Privacy Policy

Last updated: September 2026 (clarified what the Clinic sends to AI providers, what it keeps in your browser, model downloads, the public MCP service, and data retention)

1. Data Controller

The data controller responsible for your personal data is:

• Eleanor Watson, EthicsNet Ltd (Company number 11412076)
• 11 Kingfisher Business Park, Arthur Street, Lakeside, Redditch, United Kingdom, B98 8LG

For data protection queries, please contact us.

2. What Data We Collect

When you contact us through our website form, we collect:

• Your name
• Your email address
• The content of your message
• Timestamp of submission
• A record that you gave consent
• Technical request data that Formspree receives with the submission, such as your IP address

3. How We Use Your Data

We process your personal data for the following purposes:

• Responding to inquiries: We use your contact information to respond to your questions or feedback about our research.
• Research collaboration: If relevant, we may contact you about research opportunities or collaborations.

4. Legal Basis for Processing

We rely on a single legal basis for each purpose described in section 3:

• Consent (Article 6(1)(a) GDPR): We process the name, email address, and message you submit through the contact form, in order to respond to your inquiry, on the basis of the consent you give when you tick the consent box and submit the form. You may withdraw this consent at any time (see section 7).
• Legitimate interests (Article 6(1)(f) GDPR): Where relevant, we may later contact you about research opportunities or collaborations. We rely on our legitimate interest in pursuing and managing research collaboration for this follow-up; you may object to it at any time (see section 7).

5. Data Sharing

Your data may be shared with:

• Formspree: Our form processor (see their privacy policy)
• Research team members: Only as necessary to respond to your inquiry
• No marketing third parties: We never sell or share your data for marketing purposes.

Clinic and third-party services

Some features of this site, including the Clinic (our interactive diagnostic tool), contact third parties directly from your browser. These services receive data as described below, not through us:

• Anthropic, PBC (Clinic): If you choose an Anthropic cloud model, the Clinic sends the complete provider request directly from your browser to Anthropic. This includes your messages, the Clinic's system instructions and tool definitions, tool calls and results, request settings, and your Anthropic API key. The request does not pass through our application server. Anthropic's role, retention, and permitted use are governed by the agreement attached to your API account, rather than determined by this website. See Anthropic's privacy policy and usage policies.
• OpenAI, L.L.C. (Clinic): If you choose an OpenAI cloud model, the same categories of request data and your OpenAI API key are sent directly to OpenAI. The Clinic sets store: false, but that option is not a promise of zero provider retention. OpenAI's role, retention, and permitted use are governed by the agreement attached to your API account. Only the selected provider receives a request, and each provider's key is held separately in page memory. See OpenAI's privacy policy and usage policies.
• Model hosts (Clinic): The Clinic's transformers.js and WebLLM code is served from this site. When you first use semantic search or a local model, your browser downloads model files from Hugging Face and, for some compiled WebLLM files, GitHub. Those hosts receive ordinary request metadata such as your IP address, user agent, requested file, and timing. The Clinic does not put conversation text into those download URLs or requests.

Public MCP service

If you query the public MCP service at mcp.psychopathia.ai from an MCP client, the service receives the tool name and arguments you send and ordinary request metadata such as your IP address. It does not require an account.

International transfers

Some recipients and model hosts may process data outside the United Kingdom or European Economic Area. This can include Formspree contact submissions, a user-directed Clinic request to the selected inference provider, and request metadata sent while downloading model files from Hugging Face or GitHub. The applicable location, role, retention, and transfer mechanism depend on the current terms for the account and service you use. We are still confirming Formspree's processing and transfer terms for the contact form, and will update this section when that review is complete.

6. Data Retention

Contact submissions can exist in Formspree and in recipient email or correspondence systems. This static site cannot enforce deletion in those systems. We retain a submission only for as long as needed to:

• Complete our correspondence with you
• Comply with legal obligations
• Fulfill your request, should you ask for deletion

The retention period and deletion procedure for contact submissions are pending controller review. You may ask for deletion at any time. Browser-local Clinic data is controlled separately as described in section 9.

7. Your Rights

Under GDPR, you have the right to:

• Access: Request a copy of your personal data
• Rectification: Correct inaccurate personal data
• Erasure: Request deletion of your personal data
• Restriction: Limit how we process your data
• Portability: Receive your data in a portable format
• Object: Object to certain types of processing
• Withdraw consent: Withdraw consent at any time

8. Security

We implement appropriate technical and organizational measures to protect your personal data, including:

• HTTPS encryption for data in transit
• Secure form processing through Formspree
• Limited access to personal data

9. Cookies and Browser Storage

This website does not set any cookies. We do not use analytics or marketing cookies. We do, however, use your browser's built-in Web Storage for functionality. Nothing stored in your browser is transmitted to us:

• Theme preference: Your dark-mode choice is saved under the pm-theme key in your browser's localStorage. It stays on your device and is never transmitted to us or any third party.
• Clinic conversation data: The Clinic stores a bounded, structured copy of messages, tool calls, and truncated tool results, together with model and interface preferences, in localStorage for reload recovery. It also removes any transcript saved by earlier versions of the Clinic. The conversation persists until you choose New Session or clear this site's data; the model and thinking-mode preferences persist until you clear this site's data. Cloud-mode requests transmit the current conversation to the selected provider as described in section 5, but the conversation is not transmitted to us.
• Clinic API key: A supplied Anthropic or OpenAI key is held only in the open page's memory, separately for each provider, and is cleared when you reload, leave the page, or close the tab. It is sent only in requests to the selected provider and is never transmitted to us. Earlier versions of the Clinic kept keys in sessionStorage; the Clinic now deletes those entries when it loads.
• Clinic model caches: Browser-managed HTTP Cache, Cache Storage, or IndexedDB may retain semantic-search and local-model files. Delete cached model removes the selected WebLLM model through its runtime. Clearing this site's data is the broader deletion route for caches that the interface cannot enumerate reliably.
• Book reader preferences: The Book reading view saves your reading position, last-visit time, bookmarks, and display settings (font size, line and paragraph numbers, sidebar state) in your browser's localStorage so the Book can restore where you left off. This data stays on your device and is never transmitted to us.
• Figure preference: The standalone framework overview stores its light or dark theme under pmfig-theme in localStorage.

10. Contact Us

For any privacy-related questions or to exercise your rights, please contact us, clearly stating your data protection request.

11. Complaints

If you're not satisfied with how we handle your data, you have the right to lodge a complaint with a supervisory authority. As we are established in the United Kingdom, our supervisory authority is the Information Commissioner's Office (ICO), which you can contact at ico.org.uk. You may also lodge a complaint with the data protection authority in your own country of residence.