askTheco Privacy Policy

What is the purpose of this policy?

Your privacy is important to us, and we are committed to protecting the privacy and security of your information.

This Privacy Policy applies to the askTheco connector, operated by MMRG Limited (“we”, “us”, “our”), trading as Thecosystems, and registered with the UK Information Commissioner’s Office. It applies when you or your organisation access askTheco through Claude, ChatGPT, Microsoft Copilot or another supported platform, rather than through our website.

Claude, ChatGPT, Microsoft Copilot and other supported platforms are operated by their own providers, under their own privacy policies, which govern what happens to your data on their side. This policy covers only what happens once a request reaches askTheco.

We ask you to read this Privacy Policy carefully. By using the askTheco connector, you agree to this use.

What the connector can and cannot do

Every tool made available through the connector is read-only. No tool creates, changes or deletes data, sends a message, makes a purchase, or takes any other external action. During a tool call, the connector reads only its own PostgreSQL, graph and vector data; it does not browse the web.

A tool result cannot itself trigger another tool call. A host platform’s model may choose to make a further call based on what it receives, but every call is independently authenticated, scoped to your permitted therapeutic areas, and rate limited. There is no mechanism by which one result can widen what a later call is allowed to access.

What information do we gather?

You sign in through our authentication provider, using OAuth. Your verified email address must match an active, named-person access record, scoped to specific therapeutic areas, before any query can be made.

When you use the askTheco connector, we receive the structured tool arguments you submit, not your complete conversation or prompt. We do not receive your name, email address or other personal account details beyond what is needed to verify your access record.

How will we use this information?

We use the query you submit to return the relevant results from our therapeutic ecosystem. We keep a short-term record of queries made through the connector to maintain service quality, diagnose faults and prevent misuse. We retain this record for up to 12 months, after which it is deleted or kept only in an aggregated, anonymised form that cannot be traced back to an individual query or user.

We do not use the content of your queries, or the results we return, to train our own AI models or any third-party AI model. Query data is used only to operate and support the service.

Security of your information

We use industry-standard security measures to protect data passing through the connector, including: secrets and credentials held as deployment configuration rather than in source code; all client traffic over HTTPS; connections to our database rejected unless a secure (SSL) connection is used; browser-based access restricted to a configured set of approved origins; and error monitoring configured not to capture request arguments or other personal data by default.

Authentication credentials are managed through our authentication provider, and access is revoked when a named-person access record is deactivated. Related account records are then deleted within 30 days.

Where is your information hosted, and do we share it with anyone else?

The askTheco connector infrastructure is hosted by Railway, within The Netherlands, Europe.

We use a small number of specialist subprocessors to host and operate the connector, including Railway for infrastructure hosting. We require every subprocessor to meet the same standard of protection set out in this policy, under a written agreement that complies with data protection law. An up-to-date list of our subprocessors is available on request.

We may also share information where required by law, for example in response to a lawful request by a public authority.

How long do we keep this information?

We retain connector usage data as set out above. If your organisation’s subscription ends or you disconnect the connector, we delete or anonymise your account and authentication data within 30 days, save where we are required to keep records for legal, accounting or dispute-resolution purposes.

Do we transfer information outside the UK or EEA?

Where we or our subprocessors transfer information outside the UK or European Economic Area (“EEA”), we take steps to ensure that recipients apply the necessary level of protection for personal information, and abide by strict agreements and measures, set out in our business contracts, to protect data and comply with relevant data protection laws.

What are your rights under data protection laws?

If you reside in the EEA, you have the right under the General Data Protection Regulation to:

• access your personal data (also known as a “subject access request”);
• correct incomplete or inaccurate data we hold about you;
• ask us to erase the personal data we hold about you;
• ask us to restrict our handling of your personal data;
• ask us to transfer your personal data to a third party;
• object to how we are using your personal data; and
• withdraw your consent to us handling your personal data, where consent is our basis for processing.

If you reside outside the EEA, you may have similar rights under your local laws.

If you wish to exercise your rights, please contact us at peter.joshua@mmr-g.com.

Access to information

If you require us to supply you with details of the information that we hold about you, we will provide this within 30 days of your request, unless the request is complex or contains numerous requests. If this is the case, we will inform you within 30 days of your request about the reason for the extension of time.

If we receive a request from you to exercise any of the above rights, we will ask you to verify your identity before acting on your request. This is to ensure that your data is protected and kept secure.

If you have a concern about the way we are collecting or using your personal data, if we do not address your request, or we fail to provide you with a valid reason why we have been unable to do so, you have the right to contact the Information Commissioner’s Office to make a complaint. They can be contacted via their website ico.org.uk/concerns or by phone: +44 303 123 1113.

Changes to this Privacy Policy

We will amend this Privacy Policy from time to time. If we make any changes to the way we use your information, we will make that information available by posting a notice on this page.

Contact us

Questions regarding this Privacy Policy and access requests should be directed to the MMRG Compliance Officer, Peter Joshua, via e-mail at peter.joshua@mmr-g.com or by post to MMRG Ltd, 16 Trinity Churchyard, Guildford, Surrey GU1 3RR, UK.

If you have any complaints regarding our compliance with this Privacy Policy, please contact us at the address noted above.