Privacy policy. What we collect and why.

ORYNX LTD (“Orynx”, “we”, “us”) is a company registered in Scotland, company number SC809987, with its registered office at 9 Bullfinch Row, Edinburgh, EH17 8XE, United Kingdom.

This policy explains how we handle personal data when you visit orynx.ai, contact us, hear from us, or use our products. For questions or requests about your data, email support@orynx.ai.

• Contact form and email. Your name, work email, company and the message you send when you contact us or book a demo.
• Business contact data for outreach. Names, job titles, work email addresses, company details and public professional profiles (for example on LinkedIn) of people at organisations we think may benefit from our products, and records of our messages and your replies.
• Customer account data. Names, work emails and roles of the people who use our products, plus billing and support records.
• Data in our products. Calls, messages, schedules, records and clinical notes that our customers process through Orynx Desk and Orynx Clinic (see our products).
• Technical data. Our hosting provider records standard server logs such as IP address, browser type and the pages requested, to keep the site secure and working.

Under UK GDPR we rely on these lawful bases:

• Contract: to provide our products and support to customers, and to take steps you ask for before a contract, such as a demo.
• Legitimate interests: to reply to enquiries, to contact business prospects about relevant products (you can object at any time and we will stop), to keep our services secure, and to improve them.
• Legal obligation: to keep financial records and respond to lawful requests.
• Consent: where we ask for it, for example for optional marketing emails to individuals. You can withdraw consent at any time.

Every outreach email includes a way to opt out, and you can always ask us to stop by emailing support@orynx.ai.

We use AI models to draft and analyse marketing content, research the questions people ask online, and power our products. Personal data sent to an AI provider is used only to produce the requested output, under contracts that stop the provider from training its models on it.

We do not make decisions with legal or similarly significant effects about you based solely on automated processing. In our products a person stays responsible for decisions that need judgment.

We do not sell personal data. We share it only with service providers that process it on our behalf:

• Hosting providers, including Amazon Web Services for this website.
• Form handling for this website (Web3Forms), which forwards contact form messages to us by email.
• AI model providers, including Anthropic, and OpenAI and Google where enabled.
• Email delivery, communications and payment providers we use to run the business.
• Professional advisers, and authorities where the law requires it.

Each provider is bound by a contract that limits its use of the data to providing its service to us.

Our internal marketing tool, Orynx Marketing, connects to the Google Ads API with an Orynx-owned Google account. It reads keyword planning data (search volumes and keyword ideas for topics we choose) to research the questions people search for. It does not read personal data about Google users, and it does not change any Google Ads account.

Orynx’s use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Data from Google APIs is used only to provide that feature, is not sold, is not used for advertising, and is not read by people except with consent, for security, or where the law requires it.

Access can be revoked at any time from the Google account’s third-party access settings, and we delete stored Google data on request.

When our customers use Orynx Desk or Orynx Clinic, they decide what personal data is processed and why. For that data, including patient information, the customer is the controller and Orynx acts as their processor, following their instructions under a data processing agreement.

If you are a customer’s client or patient, please contact that organisation first about your data. We will help them respond to your request.

Some of our providers process data outside the UK, for example in the United States. Where they do, we rely on UK adequacy regulations or the UK International Data Transfer Agreement or Addendum, with additional safeguards where needed.

• Enquiries: up to 2 years after our last contact, unless you become a customer.
• Outreach records: up to 2 years after our last contact, or until you ask us to stop. We keep a minimal suppression record so we do not contact you again.
• Customer account and billing records: for the contract and up to 6 years afterwards, as UK law requires.
• Product data: as set out in each customer's agreement, then deleted or returned.

We use encryption in transit, role-based access, reviewable logs, and encrypted storage of the access tokens for services we connect to. Only people who need data to do their job can reach it.

You can ask to access, correct, delete or move your data, to restrict or object to how we use it, and to withdraw consent. Email support@orynx.ai and we will respond within one month.

You can also complain to the UK Information Commissioner’s Office at ico.org.uk. We would appreciate the chance to resolve your concern first.

This website does not use advertising or analytics cookies. If that changes, we will update this policy and ask for your consent where the law requires it.

Our website and outreach are aimed at businesses and are not directed at children under 16.

We will post any changes on this page and update the date below. For significant changes we will tell customers directly.