Privacy Policy

1. Who we are

Clonvs(“we”, “us”, “our”) is a specialized AI engineering and advisory firm serving organizations in the financial services and healthcare sectors. Our registered address is 23-26 Oldbury Pl, London, England, W1U 5PN. This policy explains how we collect, use, govern, and protect personal data through clonvs.com and in the course of delivering our services.

For the purposes of UK GDPR and the Data Protection Act 2018, Clonvs is the data controller for personal data collected through this website. In client engagements we generally act as a data processor on behalf of our client. Privacy enquiries can be sent to hello@clonvs.com.

2. Data we collect

• Information you provide — name, business email, organization, role, and message content submitted through our contact form, by email, or in a job application.
• Technical data — IP address, browser type, device characteristics, pages visited, and approximate region, processed by our hosting and analytics providers to operate and secure the site.
• Engagement data — data that clients make available to us during an engagement, which may include regulated financial or health-related information. We process this only under documented client instructions and a signed data processing agreement.

3. How we use personal data

• To respond to enquiries and manage client relationships
• To deliver contracted engineering and advisory services
• To operate, secure, and improve our website
• To evaluate job applications
• To meet legal, accounting, and regulatory obligations

We do not sell personal data. We do not use client data to train, fine-tune, or evaluate models for any purpose other than the engagement for which it was provided, and never for another client.

4. Legal bases for processing

We rely on performance of a contract, our legitimate interests in operating and securing our business, compliance with legal obligations, and — for non-essential cookies and marketing — your consent, which you may withdraw at any time. Where special category data (such as health data) is involved in an engagement, it is processed only where the client has established an appropriate condition under Article 9 UK GDPR.

5. Data handling in regulated engagements

Because our clients operate in heavily regulated industries, we apply controls that go beyond baseline privacy requirements:

• Data minimization — we request only the data strictly necessary for the engagement and prefer de-identified, pseudonymized, or synthetic data wherever the objective allows.
• Client-controlled environments— where possible, sensitive data remains within the client's own infrastructure and is not transferred to systems we control.
• Access controls — access is role-based, least-privilege, time-limited, and logged for audit.
• Sector alignment — our practices are designed to support client obligations under frameworks such as UK GDPR, HIPAA, FCA and PRA expectations, and applicable financial services model risk guidance.

6. Data lineage and traceability

For every dataset used in an engagement, we maintain documented lineage covering its source, the legal basis or contractual authority for its use, every transformation applied, and each system or model that consumed it. This record allows our clients to demonstrate to regulators and auditors exactly how data moved through an AI system, and allows us to honor deletion and correction requests across all downstream artifacts.

7. Model risk management

Where personal data informs the design, training, or validation of a model, we apply structured model risk management practices, including:

• Documented model inventories with defined ownership and intended use
• Independent validation, bias and fairness testing, and performance thresholds
• Assessment of privacy risks such as memorization and re-identification
• Ongoing monitoring for drift, with defined escalation and retirement procedures
• Human oversight for decisions with legal or similarly significant effects

8. Sharing and international transfers

We share personal data only with vetted sub-processors (such as hosting, email, and analytics providers) bound by written contracts, with professional advisers where necessary, and with authorities where legally required. Where data is transferred outside the UK, we rely on adequacy regulations or appropriate safeguards such as the UK International Data Transfer Agreement.

9. Retention and deletion

Website enquiries are retained for up to 24 months after our last contact. Job applications are retained for 12 months unless you ask us to delete them sooner. Engagement data is retained only for the period defined in the applicable services agreement, after which it is securely deleted or returned to the client, with deletion recorded in the data lineage log.

10. Security

We protect personal data with encryption in transit and at rest, multi-factor authentication, role-based access controls, audit logging, and secure development practices. We maintain an incident response procedure and will notify affected clients and, where required, the Information Commissioner's Office without undue delay following a personal data breach.

11. Your rights

You may have the right to access, correct, delete, or port your personal data, to restrict or object to processing, to withdraw consent, and not to be subject to solely automated decisions with significant effects. To exercise these rights, contact hello@clonvs.com. We respond within one month. You may also lodge a complaint with the Information Commissioner's Office (ico.org.uk).

12. Changes to this policy

We review this policy at least annually and update the date above whenever it changes. Material changes will be highlighted on this page in advance where practicable.

13. Contact

Clonvs, 23-26 Oldbury Pl, London, England, W1U 5PN. Email: hello@clonvs.com.