Privacy Policy

Last updated: 14 July 2026

Who we are

4Cori Ltd (“4Cori”, “we”, “us”) is a company registered in England and Wales. We are the data controller for personal information submitted through www.4cori.com.

We also operate the clinician-branded patient library pages at video.4cori.com and clinician subdomains, which deliver each clinician's video library to their patients. This policy explains the data those pages collect so it is transparent to patients. The responsibilities between 4Cori and each clinician for that data are set out in a separate agreement.

For data protection enquiries, write to us at info@4cori.com.

What we collect

• Information you submit through the contact form: your name, email, speciality, practice setting, the message you send us and whether you opted in to receive the 4Cori clinician-led video guide.
• Operational logs from our hosting provider: IP address, browser headers, referrer and timestamps. These are recorded only for site security and reliability.
• Cookies & analytics: with your consent, we use Google Analytics. We also use cookieless Vercel Analytics. Analytics load only after you accept the cookie banner. See our Cookie Policy for the full list, including the 4Cori patient library pages.
• Patient library pages: when a patient views a clinician's library, we collect anonymous, aggregate usage data: which videos and pages are viewed, how far each video is watched, the language chosen, and the device, browser and operating system reported by your browser. To show the clinician roughly where views come from (city and country), we look up a shortened, non-identifying form of your IP address. We never store your full IP address, and these pages do not ask patients to create an account. If the clinician has switched on Google Analytics, it collects usage data too, but only after you accept the cookie banner.

How we use your data, and why we're allowed to

Under UK GDPR and the Data Protection Act 2018, we need a lawful basis for every use of your data. Ours are:

• To respond to your enquiry. Lawful basis: legitimate interests in running our business and replying to people who get in touch.
• To send you the 4Cori clinician-led video guide, if you submitted your email for the download. Lawful basis: consent. You can withdraw at any time by replying “unsubscribe” or emailing info@4cori.com.
• To send you product updates and marketing about 4Cori, only if you opted in. Lawful basis: consent.
• To keep the site secure and operational. Lawful basis: legitimate interests.
• To give clinicians anonymous statistics about their library. Lawful basis: legitimate interests, using pseudonymised data with no full IP address stored.
• To load Google Analytics or Vercel Analytics on the library pages. Lawful basis: consent, given through the cookie banner on those pages and withdrawable at any time.
• To comply with the law, for example tax, accounting and statutory record-keeping. Lawful basis: legal obligation.

Who we share it with

We use a small number of carefully chosen processors to run the marketing site and the patient library pages. Personal data is only shared with them where they need it to deliver their service to us:

• Vercel: hosting, content delivery, and cookieless analytics.
• Cloudflare: DNS and edge security.
• Supabase: database and platform storage.
• Brevo: transactional and marketing email.
• Vimeo: hosts and plays the videos shown in the patient libraries.
• Google Analytics: usage analytics on pages where a clinician has enabled it, and only after you accept the cookie banner.
• ip-api.com: looks up approximate location (city and country) from a shortened IP address, for library statistics.
• Upstash: rate limiting that protects the platform from abuse.

We never sell or rent your personal data, and we don't share it for advertising-targeting purposes.

International transfers

Some of our processors are based outside the UK, including in the United States (for example Google, Vimeo, Vercel and the geolocation lookup) and the European Union. Where we transfer personal data outside the UK, we rely on the UK International Data Transfer Agreement, the EU Standard Contractual Clauses with the UK Addendum, or another lawful safeguard.

How long we keep it

• Contact form submissions: up to 24 months from your last interaction with us, then deleted, unless you ask us to delete sooner.
• Marketing email subscribers: until you unsubscribe.
• Operational logs: retained by our hosting provider for a short rolling window for security purposes.
• Patient library statistics: kept for up to 13 months, then automatically deleted.

Your rights

Under UK GDPR you have the right to:

• access the personal data we hold on you;
• have inaccurate data corrected;
• have your data erased, subject to limited exceptions;
• restrict or object to how we process it;
• have your data ported to another provider;
• withdraw any consent you previously gave;
• complain to the UK Information Commissioner's Office at ico.org.ukif you think we've got something wrong.

To exercise any of these, email info@4cori.com. We'll respond within one calendar month.

The patient library statistics are anonymous and aggregate, so in most cases we cannot link them to a named individual and may be unable to single out your data. Where we genuinely cannot identify you, some of the rights above may not apply, but we will always explain why.

Changes to this policy

We'll update this page when our practices change. The date at the top reflects the most recent revision. Material changes will be communicated to active subscribers by email.