Privacy Policy & ICO Compliance

1. Data Controller & Contact Information

Under the UK GDPR and the Data Protection Act 2018, the Data Controller responsible for your personal information is:

Entity Name: DiseaseWatch UK Surveillance Initiative

Territory: United Kingdom (England, Scotland, Wales & Northern Ireland)

Designated Data Protection Lead: Data Privacy Officer (DPO)

Email: privacy@diseasewatch.co.uk

General Support & Enquiries: support@diseasewatch.co.uk

Supervisory Authority: UK Information Commissioner’s Office (ICO)

2. Lawful Bases for Processing (UK GDPR Article 6)

We only process personal data when we have an identifiable lawful basis under Article 6 of the UK GDPR. The specific lawful bases we rely on include:

Processing Activity	Categories of Data	Lawful Basis (UK GDPR)
Account Creation & Authentication	Email address, password hash, display nickname, account role	Contractual Necessity (Art. 6(1)(b))
Professional Veterinary Verification	RCVS registration number, veterinary practice name	Legitimate Interests (Art. 6(1)(f)) – maintaining the integrity and clinical reliability of disease surveillance alerts
Postcode Alerts & Notifications	Subscribed outward postcode (e.g., SW1A), notification email	Consent (Art. 6(1)(a)) – withdrawable at any time in profile settings
Platform Security & Fraud Prevention	IP address (hashed/truncated), rate limiting telemetry, user-agent	Legitimate Interests (Art. 6(1)(f)) – protecting platform availability and defending against abuse
Clinic Postcode Sponsorships & Billing	Practice business contact, clinic name, payment tokens, billing history	Contractual Necessity (Art. 6(1)(b)) & Legal Obligation (Art. 6(1)(c)) for statutory VAT and accounting compliance
Public Epidemiological Mapping	Species, disease type, clinical outcome, randomised fuzzed coordinates	Anonymised Data (Outside UK GDPR scope pursuant to Recital 26)

3. Data Protection by Design & Geo-Fuzzing Anonymisation

In line with UK GDPR Article 25 (Data Protection by Design and by Default) and the ICO Code of Practice on Anonymisation, DiseaseWatch UK incorporates irreversible technical mechanisms to prevent identification of pet owners or veterinary premises:

The Geo-Fuzzing Protocol:

Centroid Conversion: When a reporter enters a postcode, only the centroid coordinate of that outward postcode area (covering dozens to hundreds of addresses) is retrieved.
Random Direction & Distance Offset: Before saving to the database, our mathematical algorithm applies a pseudo-random jitter displacing the point by 300 to 600 metres in an unpredictable vector.
Immediate Deletion of Original Location: The original postcode string and exact coordinates are immediately destroyed in temporary application memory. Only the perturbed, randomized coordinate is written to disk.
Anti-Triangulation & Revision Persistence: When a report is subsequently updated or revised, database triggers lock and preserve the existing fuzzed coordinates. Re-fuzzing on revision could enable multi-sample statistical averaging to reconstruct the true centroid. Locking the offset permanently prevents differential triangulation attacks.
Non-Reversibility: It is mathematically impossible for third parties, platform administrators, or automated tools to reverse-engineer a map pin back to an individual household, dog walking route, or specific clinic.

Strict No-PII Policy in Reports

Reporters must not input animal names, owner names, microchip numbers, clinical case files, or residential street addresses into report notes. Any report found containing personally identifiable information will be redacted and permanently purged immediately.

4. Third-Party Processors & Data Recipients

We do not sell, rent, or trade your personal data to marketing brokers. We only share necessary data with trusted third-party service providers (data processors) bound by strict Data Processing Agreements (DPAs) in compliance with UK GDPR Article 28:

Supabase, Inc. — Cloud database, user authentication, and persistent data storage. Hosted in secure AWS data centers with encryption at rest (AES-256) and in transit (TLS 1.3), backed by the UK Addendum to Standard Contractual Clauses.
Vercel, Inc. — Application hosting, edge Content Delivery Network (CDN), and operational server logs. Processes client IP addresses and HTTP request headers strictly for network routing and DDoS security.
MailerSend (MailerLite Group) — Transactional email delivery service used exclusively for account confirmation, password recovery, and user-subscribed outbreak notification alerts.
Stripe Payments UK Ltd / Stripe Technology Europe Ltd — Payment gateway and recurring subscription management for veterinary clinic postcode sponsorships. Card details are processed directly by Stripe under PCI-DSS Level 1 compliance; DiseaseWatch UK never stores complete card numbers.
OpenStreetMap Foundation (OSMF, United Kingdom) — Delivers public map tile imagery directly to the client browser. When loading map tiles, OSMF web servers receive and process the requesting browser's IP address and user-agent string solely for technical image delivery.
Postcodes.io — Open-source UK geocoding API used during location search to convert outward postcodes into geographical district centroid coordinates.
External Sponsor & Clinic Assets: Partner and veterinary clinic logos are rendered using strict referrerPolicy="no-referrer" under restrictive browser sandboxing. Host servers hosting partner logos cannot track visitor browsing paths or receive DiseaseWatch UK referrer headers.

5. International Data Transfers & Safeguards

Our core database instances and authentication servers are hosted within the UK and European Economic Area (EEA), benefiting from UK adequacy regulations. Where any sub-processor infrastructure processes data outside the UK/EEA (such as global CDN edge nodes), transfers are safeguarded under:

The UK International Data Transfer Agreement (IDTA); or
The UK Addendum to the EU Standard Contractual Clauses (SCCs) pursuant to UK GDPR Article 46; or
The UK Extension to the EU-US Data Privacy Framework for certified entities; and
Technical encryption (TLS 1.3 in transit, AES-256 at rest) preventing unauthorized access.

6. Data Retention & Storage Limitation

In compliance with the Storage Limitation principle (Article 5(1)(e)), we retain personal data only for as long as strictly necessary:

Account Credentials & Profile: Retained for the active duration of your account. Upon user-requested account deletion, all personal credentials, email addresses, display nicknames, and profile audit diffs are permanently purged from database tables. In compliance with the ICO Accountability Principle, system audit trail entries are pseudonymized (setting actor_id = NULL and stripping identifying descriptors), preserving an immutable record of historical administrative events without retaining linkable individual personal data.
RCVS Verification Records: Retained while the professional account remains active, plus 12 months for compliance auditing.
Outbreak Notification Subscriptions: Retained until the user cancels their alert subscription.
Anonymised Epidemiological Reports: Retained indefinitely. Because these records do not constitute personal data under UK GDPR Recital 26, they are maintained for long-term veterinary public health and scientific research.
Server & Infrastructure Logs: Technical access and security logs generated by our hosting providers (Vercel and Supabase, containing truncated IP addresses and request metadata) are retained on a short rolling cycle of typically 1 to 30 days (and never exceeding a strict maximum of 90 days in the event of an active cybersecurity investigation), after which they are automatically overwritten or permanently purged.

7. Your Statutory Rights Under UK GDPR

Under Chapter III of the UK GDPR, you have the following legal rights regarding your personal data:

1. Right to be Informed

The right to clear, transparent information about how we process your personal data (provided via this Privacy Notice).

2. Right of Access (SAR)

The right to request a free copy of the personal data we hold about you. Responded to within one calendar month.

3. Right to Rectification

The right to correct inaccurate, incomplete, or out-of-date personal information in your user profile.

4. Right to Erasure

The "right to be forgotten" — to request deletion of your account and associated personal data.

5. Right to Restrict Processing

The right to block or suppress further processing of your personal information in specific legal scenarios.

6. Right to Data Portability

The right to obtain your personal information in a structured, commonly used, and machine-readable format (JSON/CSV).

7. Right to Object

The right to object to processing based on legitimate interests or direct communications at any time.

8. Automated Decision-Making

We do not subject you to automated decision-making or profiling that produces legal or significant effects.

How to exercise your statutory rights:

You can exercise your rights at any time without fees by emailing our Data Protection Lead at privacy@diseasewatch.co.uk with the subject line "UK GDPR Rights Request". We will acknowledge and resolve your request within 30 calendar days as mandated by the ICO.

8. Cookies, Local Storage & Security Architecture (PECR Compliance)

In compliance with the Privacy and Electronic Communications Regulations (PECR) and modern UK cybersecurity guidelines, we adhere to strict cookie and transport hygiene:

Strictly Necessary Cookies: We use secure, HTTP-only session tokens to authenticate user logins and protect against CSRF attacks. Under PECR, these essential cookies do not require prior consent.
Rate Limiting & Anti-Brute-Force Tokens: Short-lived security cookies protect sensitive account operations from automated attacks.
Session & Local Storage: We store minimal functional preferences in your browser’s `localStorage` and `sessionStorage` (e.g., your selected theme mode and cookie acknowledgment). No personal trackers or cross-site identifiers are stored.
No Invasive Advertising Trackers: We do not run third-party advertising cookies, behavioural retargeting pixels, or ad exchange scripts.

Cookie / Storage Key	Category (PECR)	Duration	Purpose
sb-*-auth-token	Strictly Necessary	Session / 1 Year	Maintains authenticated user session and prevents unauthorized profile access.
dw_del_cooldown	Strictly Necessary	60 Seconds	Prevents spamming and mailbombing during account deletion OTP requests.
dw_eml_cooldown	Strictly Necessary	60 Seconds	Prevents spamming during email address change OTP requests.
dw_exp_cooldown	Strictly Necessary	60 Seconds	Prevents spamming during GDPR personal data export OTP requests.
dw_pwd_cooldown	Strictly Necessary	60 Seconds	Enforces rate limiting on password reset requests.
dw_delete_token / dw_delete_hash	Strictly Necessary	10 Minutes	Cryptographic HMAC signature to authorize 8-digit permanent account deletion.
dw_email_token / dw_email_hash	Strictly Necessary	10 Minutes	Cryptographic HMAC signature to authorize 8-digit account email address change.
dw_export_token / dw_export_hash	Strictly Necessary	10 Minutes	Cryptographic HMAC signature to authorize 8-digit Subject Access Request (SAR) data exports.
dw_cookie_consent_v1	Functional Preference	Persistent (Local)	Records that you have reviewed the PECR cookie and privacy notice.
theme	Functional Preference	Persistent (Local)	Stores your light/dark display interface preference.

Want to review or change your cookie notice status?

9. Right to Lodge a Complaint with the ICO

If you have concerns about our information rights practices or believe we have not resolved a request satisfactorily, you have the statutory right under Section 165 of the Data Protection Act 2018 to lodge a complaint with the UK supervisory authority:

Information Commissioner’s Office (ICO)

Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline: 0303 123 1113 (Mon–Fri, 9am–5pm)

Official Website: ico.org.uk

Online Complaint Portal: ico.org.uk/make-a-complaint

Privacy Policy & Notice

Data Minimisation

RCVS Confidentiality

Your Statutory Rights