Legal
Privacy Policy
This Privacy Policy explains how bio collects, uses and protects personal information when you use our website, apply for a bio profile, review a draft profile, manage your profile or contact us.
Last updated: 7 June 2026
This Privacy Policy explains how bio, a trading name of Mednesia Ltd, collects, uses and protects personal information when you use our website, apply for a bio profile, review a draft profile, manage your profile or contact us.
bio helps experts create trusted, AI-assisted professional profiles that showcase expertise, publications, speaking engagements, media appearances, roles and achievements.
This Privacy Policy is separate from our Terms & Conditions.
1. Who we are
bio is a trading name of Mednesia Ltd.
Registered / contact address:Mednesia Ltd
W8a Knoll Business Centre
325–327 Old Shoreham Road
Hove
United Kingdom
BN3 7GS
For data protection purposes, Mednesia Ltd is the controller of the personal information described in this Privacy Policy.
You can contact us about privacy matters at: team@at.bio
2. Website covered by this policy
This Privacy Policy applies to:
- at.bio
- any subdomains of at.bio, such as
name.at.bio - related bio profile, account, review and application pages operated by us
It does not apply to third-party websites that may be linked from bio profiles or from our website.
3. Personal information we collect
We may collect and use the following types of personal information.
Information you provide to us
This may include:
- name
- email address
- job title or headline
- organisation or institution
- location
- biography or professional summary
- profile photo or image
- areas of expertise
- publications, books, reports or research outputs
- speaking engagements, events, lectures or panels
- media appearances, interviews or articles
- awards, achievements and advisory roles
- professional links, such as LinkedIn, ORCID, Google Scholar, personal websites or social media profiles
- contact preferences
- information you submit through forms, profile edits, review comments, approval flows, change requests or support messages
Information from public sources
Where we prepare a private draft profile for review, we may use professional information that is already publicly available online. This may include information from:
- institutional profile pages
- publication pages
- event pages
- conference pages
- media pages
- professional websites
- public databases
- public social or professional profiles
We use this information to prepare a private draft profile for review. A draft profile is not intended to be published until it has been reviewed and approved.
Account and authentication information
If you sign in to manage your profile, we may process:
- your email address
- authentication identifiers
- sign-in records
- account status
- profile ownership links
- profile review, approval and update history
Technical information
When you use our website, we may collect limited technical information, such as:
- IP address
- browser type and version
- device type
- operating system
- pages visited
- dates and times of access
- referring and exit pages
- error logs
- security and authentication logs
We use this information to operate, secure and improve the service.
4. How we use personal information and our lawful bases
We only use personal information where we have a lawful basis under UK data protection law.
| Purpose | Examples of use | Lawful basis |
|---|---|---|
| Receiving applications and enquiries | Processing profile applications, replying to messages and managing invitations | Legitimate interests; steps before entering into a contract |
| Creating private draft profiles | Preparing a draft bio profile from submitted information and/or public professional information | Legitimate interests |
| Publishing approved profiles | Making an approved profile publicly available at an at.bio URL or subdomain | Contract and/or legitimate interests |
| Account access and profile management | Magic-link sign-in, owner portal access, profile review, edits, approvals and update history | Contract and/or legitimate interests |
| Profile update and review workflows | Saving drafts, submitting updates, reviewing changes, keeping audit records | Contract and/or legitimate interests |
| Service communications | Sending sign-in links, review links, profile status updates and account notifications | Contract and/or legitimate interests |
| Security, fraud prevention and service operation | Authentication logs, error logs, abuse prevention, account protection and service maintenance | Legitimate interests |
| Product improvement | Understanding how the service is used, fixing errors and improving user experience | Legitimate interests; consent where required for non-essential cookies |
| Marketing communications | Sending invitations, updates or promotional emails where permitted | Consent or legitimate interests, depending on the context and applicable electronic marketing rules |
| Non-essential cookies or similar technologies | Analytics, performance measurement or optional tracking | Consent where required under PECR |
5. Legitimate interests
Where we rely on legitimate interests, we consider our interests, the potential impact on individuals and any safeguards we can apply.
For example, we may rely on legitimate interests to prepare private draft profiles using public professional information. We consider this proportionate because:
- the information is professional in nature
- the draft profile is private before approval
- publication is not intended to happen before review and approval
- individuals can request changes, decline publication or ask us to delete the draft
- we aim to limit the information used to material relevant to a professional profile
Where we rely on legitimate interests, you can object to our use of your personal information. We will consider your objection and stop processing unless we have compelling legitimate grounds to continue or need the information for legal claims.
6. How we use personal information
We use personal information to:
- create draft expert profiles
- structure professional information into profile sections
- display published profiles
- allow profile owners to review, approve and publish profiles
- allow profile owners to edit profiles or submit updates for review
- process change requests
- manage profile status, including draft, review, published and pending-update states
- provide account access and authentication
- communicate with users and profile owners
- operate, secure and improve the service
7. Use of AI
bio may use AI-assisted tools to help generate, organise, summarise or improve draft profile content.
AI may be used to:
- turn submitted or public professional information into a structured draft profile
- summarise professional biographies
- identify possible expertise areas
- organise publications, speaking engagements, media appearances and achievements
- improve clarity, formatting and presentation
AI-assisted content may be inaccurate, incomplete or out of date. For that reason, profiles are intended to be reviewed before publication. AI outputs should not be treated as verified unless they have been reviewed and approved.
We do not intend to use AI to make solely automated decisions with legal or similarly significant effects about individuals.
We do not knowingly use your profile information to train public AI models unless we clearly tell you and have a lawful basis to do so.
8. Special category data
We do not intentionally collect special category data, such as information about health, ethnicity, religious beliefs, political opinions, trade union membership, sex life or sexual orientation.
However, professional profiles may sometimes include information that indirectly reveals sensitive information, for example through research areas, publications, institutional affiliations, media appearances or public speaking topics.
Please avoid submitting sensitive personal information unless it is necessary for your professional profile and you are comfortable with it being used for that purpose.
Where we need to process special category data, we will only do so where we have an appropriate lawful basis and a condition under data protection law.
10. International transfers
Some of our service providers may process personal information outside the United Kingdom.
Where personal information is transferred outside the UK, we will take steps designed to ensure it receives appropriate protection. This may include using adequacy regulations, standard contractual clauses, the UK International Data Transfer Agreement, the UK Addendum or other lawful transfer mechanisms.
11. How long we keep personal information
We keep personal information only for as long as reasonably necessary.
In general:
- account information is kept while your account or profile remains active
- published profile information is kept while the profile remains published
- draft profile information is kept while it is being reviewed, edited or managed
- submitted profile updates and change requests may be kept for support, audit and record-keeping purposes
- technical logs are kept for a limited period for security, debugging and operational purposes
- enquiry and application information may be kept for a reasonable period so we can respond, manage applications and maintain records
If we create a private draft profile and you do not want to proceed, you can ask us to delete it.
If your profile is published, you can ask us to unpublish, correct or delete it, subject to any lawful retention needs.
We may retain limited information where necessary for legal, security, accounting or legitimate business purposes.
12. Your rights
Under UK data protection law, you may have rights to:
- access your personal information
- correct inaccurate or incomplete information
- request deletion of your personal information
- object to certain uses of your personal information
- restrict how we use your personal information
- request transfer of your personal information
- withdraw consent, where we rely on consent
- complain to a supervisory authority
These rights are not absolute and may depend on the circumstances.
To exercise your rights, contact us at: team@at.bio
We may need to verify your identity before responding.
13. Public profiles
If you approve publication of a bio profile, the information on that profile will be publicly accessible.
This may include your name, professional role, organisation, location, biography, publications, speaking engagements, media appearances, achievements, professional links and contact preferences.
You can request updates, corrections, unpublication or removal of your profile by contacting us or using your account tools where available.
14. Accuracy of profile information
We aim to help create accurate and useful professional profiles, but draft profiles may contain errors, omissions or outdated information.
You are responsible for reviewing your profile before publication and telling us about corrections or updates.
We may review submitted updates before they appear publicly.
16. Security
We use reasonable technical and organisational measures to protect personal information.
These may include access controls, encryption where appropriate, logging, backups and limiting access to people or providers who need it.
No website or online service can be guaranteed to be completely secure.
17. Third-party links
bio profiles and website pages may contain links to third-party websites, such as LinkedIn, ORCID, Google Scholar, publishers, institutions, event pages or media sites.
We are not responsible for the privacy practices, content or security of third-party websites. You should read their privacy notices before providing information to them.
18. Changes of business ownership or control
If Mednesia Ltd or the bio service is involved in a sale, merger, reorganisation, transfer of assets or similar transaction, personal information may be transferred as part of that transaction where lawful and appropriate.
Any new owner or operator may use the information only in line with this Privacy Policy or another notice provided to you.
19. Children
bio is intended for professional users and is not directed at children.
We do not knowingly collect personal information from children.
20. Complaints
If you have concerns about how we use your personal information, please contact us first so we can try to resolve the issue.
You also have the right to complain to the UK Information Commissioner's Office.
ICO website: ico.org.uk
21. Changes to this Privacy Policy
We may update this Privacy Policy from time to time.
When we make material changes, we will update the date at the top of this page and, where appropriate, notify users.