Privacy Notice
DRAFT, not yet in force. Prepared from standard GDPR Art. 13 / UK GDPR structure. This is not legal advice; have it reviewed before you publish it. Placeholders look like
[[THIS]]. Last drafted: 2026-10-23.
Effective date: October 23, 2026
Forward for Health ("we", "us") runs forwardforhealth.org. It is a public catalog of acute health problems where AI research could help. This notice explains what personal data we collect, why, and the choices and rights you have.
1. Who is responsible for your data
The data controller is Matthew Kaili, operating Forward for Health, [[MAILING_ADDRESS: virtual mailbox address]]. Contact: [email protected].
We have not appointed a Data Protection Officer; we are not required to. [[EU_UK_REPRESENTATIVE: name and contact, if one is appointed. See the legitimate-interests assessment §5.]]
2. What we collect and why
| Data | When | Purpose | Lawful basis (GDPR Art. 6) |
|---|---|---|---|
| Email address | Sign-up and sign-in | Creating your account and sending one-time sign-in codes | Legitimate interests: running a secure, passwordless service |
| Sign-in codes and session cookie | Each sign-in | Keeping you signed in securely | Legitimate interests (security) |
| Authenticator (TOTP) secret and recovery codes | Staff accounts only | Multi-factor protection for admin access | Legitimate interests (security) |
| Verification information: real name, country, professional role, specialty or field, professional identifier or registry link, institutional email address (we send it a confirmation link), publications or affiliation | When you apply for verification | Confirming that you are an eligible physician or researcher before you can submit, vote or discuss | Legitimate interests: keeping contributions limited to verified professionals |
| Extra credential evidence, such as a document you choose to upload | Only if we ask and you agree | Same as above, when public registers are not enough | Legitimate interests; kept in restricted private storage |
| Public profile: real name, credentials, role, specialty, country, optional affiliation, and your email address only if you choose to show it | When verified | Attributing your submissions and assessments | Legitimate interests; your email is shown only if you tick the box, and you can untick it at any time |
| Submissions, assessments, comments and edits | When you contribute | Publishing and moderating the catalog | Legitimate interests |
| Username | When you create your profile | Your discussion pseudonym, letting you comment without showing your real name. It is never shown next to your real name | Legitimate interests |
| Votes | When you vote | Counting community support. Only totals and voter-group counts are public; who voted is private | Legitimate interests |
| Bookmarks | When you bookmark | Your personal reading list | Legitimate interests |
| Reports and moderation records | When you report content or are reported | Handling abuse, privacy and accuracy concerns | Legitimate interests |
| Audit records of privileged actions | Editorial and verification decisions | Accountability and appeals. These store an internal account ID, not your email | Legitimate interests |
| Technical logs: IP address, browser user agent, request path and time | Every visit | Security, abuse prevention and debugging | Legitimate interests (security) |
We do not use advertising, analytics or tracking cookies. We do not sell or rent personal data, and we do not use it for automated decision-making that has legal or similarly significant effects. Verification decisions are made by a person.
Do not post patient-identifiable information. The catalog is about conditions and research opportunities, not individual cases. If we find patient-identifiable content, we restrict it promptly.
3. Cookies
We use only cookies that the service needs to work: a session cookie that keeps you signed in, and a security cookie that protects forms against cross-site request forgery. Because these are strictly necessary, we do not ask for cookie consent. Our network provider, Cloudflare, may set its own security cookies to block attacks.
4. Who we share data with
Public content, such as published entries, assessments, comments and your public profile, is visible to everyone and licensed under CC BY 4.0 (see the Contributor Terms).
We use these service providers (processors), each under a data-processing agreement:
| Provider | Role | Location |
|---|---|---|
| Render Services, Inc. | Application hosting and database | United States (Ohio) |
| Resend, Inc. | Sending sign-in and notification emails | United States |
| Cloudflare, Inc. | DNS, TLS, and network security | Global network; United States company |
We may also disclose data when the law requires it, or to protect the safety of people or the service.
5. International transfers
Our service is hosted in the United States. If you are in the EU, EEA, UK or Switzerland, your data is transferred to the US. Render, Resend and Cloudflare are each certified under the EU–US Data Privacy Framework and its UK extension; Render and Cloudflare are also certified under the Swiss–US framework. Where a transfer is not covered by the framework, we rely on the European Commission's Standard Contractual Clauses, with the UK Addendum, in our providers' data-processing agreements.
6. How long we keep data
| Data | Retention |
|---|---|
| Raw verification evidence, such as uploaded documents | Deleted within 30 days of the final verification decision |
| Verification decision record (outcome, basis, reviewer, dates) | For as long as your account exists, plus 90 days; longer only under a documented dispute hold |
| Account email and profile | Until you delete your account |
| Published named content | Kept under CC BY 4.0. If you delete your account or ask, your name is replaced with "Former contributor" |
| Comments | Until you or a moderator deletes them. A placeholder remains if others have replied |
| Votes | Removed from public counts as soon as your account is deleted, suspended, or your credentials expire |
| Rate-limit counters | About 1 day |
| Sessions | Up to 2 weeks after your last sign-in, or until you sign out |
| Technical logs | 7 days in our hosting provider's log system |
| Database backups | A rolling 3-day point-in-time recovery window. Deleted data drops out of backups within 3 days. Manual exports, if we make any, are kept for at most 7 days |
| Audit records | For the life of the service. They contain an internal ID, not your email |
7. Your rights
Wherever you live, you can ask us to:
- give you a copy of your personal data (access and portability);
- correct inaccurate data (rectification);
- delete your account and personal data (erasure). Published named content is anonymized rather than removed, as explained above;
- restrict or object to processing based on legitimate interests. We will stop unless we have compelling grounds, such as preventing abuse;
- withdraw any consent you gave, such as for public contact details, at any time.
You can delete your account from your account settings, or email [email protected]. We respond within one month. If you are in the EU, EEA or UK, you also have the right to complain to your local data-protection authority.
8. Eligibility
The service is meant for adult professionals. We do not knowingly collect data from anyone under 18.
9. Security
We use encryption in transit (HTTPS everywhere, with HSTS), encryption at rest provided by our hosting provider, passwordless sign-in, multi-factor authentication for staff, least-privilege access, an append-only audit log, and logs that mask emails and credentials. No system is perfectly secure. If a breach affects your data, we will notify you and the relevant authorities as the law requires.
10. Changes
We will post changes here with a new effective date. For material changes, we will also email account holders before the changes take effect.