Privacy notice

Who is responsible?

Rehab Recordz CIC is the controller of personal information received for its own activities. We are registered in England and Wales, company number 16786667.

Registered office: 48 Burrington Road, Birmingham, B32 4DS, United Kingdom. This is a correspondence address, not a public venue.

For privacy questions or requests, contact dnbrehab@protonmail.com.

What this notice covers

This notice covers visits to this website, initial enquiries, offers of support and complaints. The enquiry form collects your name, email address and/or phone number, preferred contact method, enquiry type and optional organisation. It does not ask for medical information or accept attachments. Email buttons open your own email service. Public visitors cannot upload files or make payments. A separate, protected management area lets the site owner review enquiries and manage recordings.

An enquiry does not book a course place. We will explain any further information needed, and how it will be used, before enrolment. Attendance, assessment and participant support records are outside the scope of this website notice.

Information you give us

When you use the form, we receive the contact details and enquiry type you submit, the submission time and a reference number. When you email us, we also receive your message and any other information you choose to include. We use these to respond, discuss your enquiry and keep relevant correspondence.

If a professional contacts us about someone else, they should first check that the person wants to be contacted and share only the minimum necessary information. We will explain the source of their details when contacting that person.

You do not have to supply personal details to browse the website. If you want a reply, we need a way to contact you.

Why we use it

For ordinary enquiries, offers of support and complaints, we rely on legitimate interests: responding to people who contact the project, organising community activities and resolving concerns fairly. We use only the information needed for those purposes and consider the effects on the people involved.

Where a specific law requires us to retain or disclose information, we rely on that legal obligation. We will explain the relevant requirement where appropriate. We do not add enquirers to marketing lists or make automated decisions about their eligibility.

Health and recovery information

Please do not send diagnoses, recovery histories, medical records or case notes with an initial enquiry. You can ask about the course without telling us about your health or recovery status.

If sensitive information is needed later, we will first explain the purpose, lawful basis and additional legal condition for using it, who needs access and how long it will be kept. Where we rely on explicit consent, we will ask for it separately. Simply sending an enquiry is not blanket consent.

If we receive unnecessary sensitive information, we will avoid forwarding it and remove it when it is safe and lawful to do so. Safeguarding information may need to be referred to an appropriate service.

Who can receive information

Access is limited to authorised people who need the information for their project role. Our email service is Proton Mail. Our website is hosted using OpenAI Sites and Cloudflare infrastructure, with form records stored in Cloudflare R2. These providers process information needed to deliver, maintain and secure their services. Website form submissions are stored in a private website inbox, accessible only to the site owner through authenticated management access. We also use hashed connection and contact identifiers to slow repeated submissions; these are not displayed publicly. They are retained for spam prevention and cleaned up during inbox maintenance.

We do not sell personal information or give funders personal enquiry emails as routine project reporting. We may share necessary information with professional advisers or appropriate authorities where there is a lawful reason, including responding to a safeguarding concern.

Providers and processing outside the UK

Proton states that its mail servers store encrypted data in Switzerland, Germany or Norway. Website hosting providers may process technical information internationally, including in the United States. Data is not necessarily kept only in the UK.

Providers describe safeguards including recognised adequacy arrangements and approved contractual safeguards for international transfers. Their notices explain the applicable arrangements, retention and how to request more information: Proton Mail privacy notice, Proton data processing terms, OpenAI privacy notice, ChatGPT Sites data processing terms and Cloudflare privacy notice.

You can also contact us for information about the providers and safeguards relevant to your enquiry. Ordinary email should not be treated as a confidential medical-record transfer service.

How long we keep information

Website form submissions expire after twelve months and are removed when the inbox is next reviewed. The owner may keep protected exports for continuity; these are reviewed and deleted on the same schedule as the website records. Routine email enquiries will be deleted within twelve months after the last substantive contact, unless the conversation has become part of an ongoing activity or there is a specific reason to retain a relevant record.

For ongoing matters, complaints or safeguarding concerns, retention depends on whether the matter remains open, any follow-up or investigation, and applicable legal, insurance or funding requirements. We will keep only what is necessary, record the reason for longer retention and review it when the matter closes and at least annually afterwards.

Technical logs held by hosting providers follow their own service retention arrangements, explained in their privacy notices.

Photos, recordings and stories

We will ask separately before publishing an identifiable participant photo, recording or personal story. We will explain where it will appear. Course participation does not depend on agreeing to publicity.

Where permission is based on consent, you can withdraw it for future use. Withdrawal does not change the lawfulness of earlier use, and we may not be able to retrieve copies already shared by others.

Your rights

Contact dnbrehab@protonmail.com to request access to your information, correction, deletion or a restriction on its use. You can object to processing based on legitimate interests. Depending on the circumstances, you may also have a right to data portability or to withdraw consent. These rights have legal limits; we will explain any that apply.

We normally respond within one month. If identity checks or a lawful extension are needed, we will explain this. You can complain to the Information Commissioner’s Office (ICO) without first using our complaints process.