Privacy Policy

Introduction

Welcome to SIDEfxHUB. We are committed to protecting the privacy and security of our users. This Privacy Policy outlines how we collect, use, protect, and share personal information gathered about you, in accordance with applicable data protection laws, including the UK GDPR and the Data Protection Act 2018.

Your data is controlled by SIDEfxHUB, a Charitable Incorporated Organisation (CIO) registered with The Charity Commission (Number 1203385). The Data Protection Officer at this organisation is Gary Shields.

Consent

You give consent through a clear affirmative action, such as agreeing to take part in our research community. Community members also receive our emails as part of their membership, as described under Data Usage, and can unsubscribe from them at any time. Simply using this site is not taken as consent to anything, and you can withdraw a consent you have given at any time.

Data Collection

We collect various types of information in our Research Community and Newsletter to provide and improve our services to you. Such information includes:

• Name and e-mail address
• Research interests for study participation
• Demographic information such as birth year, gender, and country of residence
• Proof of a report to a medicines regulator, if you choose to share it: a screenshot or a short note, with the condition and country (health information, kept only with your explicit consent; see below)

Data Usage

Newsletter: The purpose of collecting your contact information is to send you emails with information and updates about research, fundraising, awareness initiatives and our upcoming Patient Data Platform. Community members receive these emails as part of their membership. You can unsubscribe at any time with the link in every email, or on your community page, and we will stop. Messages about the community itself, such as follow-up questions, study invitations and important changes to the community or its terms, go to every member.

Research Community: This information aids in researching and understanding PSSD, PFS and PAS. It helps build a community of individuals interested in participating in future research studies. When suitable research opportunities arise, and if your profile matches the study criteria, we will contact you to obtain your additional consent before sharing your information with the relevant researcher or institution.

Proof of Your Report to a Medicines Regulator

Our step-by-step report guide helps you report side effects to your country's medicines regulator, on the regulator's own website. Afterwards you can share proof with us that you reported: a screenshot of the regulator's confirmation page or, if you have none, a short note (up to 300 characters, for example “Yellow Card, spring 2021”). Sharing proof is up to you, and you do not need to be a community member to do it.

Why we ask for it: So that one of our volunteers can check that a report was made, and so that we can count the reports that have been checked. Only totals are ever published. We do not use your screenshot or note for research, we never publish it, and we do not share it with anyone.

Health information: A screenshot of a report confirmation can show health information, such as the side effects you reported, the medicine and a reference number. Under UK GDPR, health information is special category data. A note, and the condition you choose in the guide, are health information too.

Your explicit consent: We keep a screenshot only if you tick a box of its own that says so. It is never ticked in advance, and the screenshot cannot be sent until it is ticked. Our legal basis is your explicit consent (UK GDPR Article 9(2)(a), with Article 6(1)(a)), and the same consent covers the condition you chose. If you send a note instead, you give that consent by writing the note and sending it to us. We record which version of the wording you agreed to, and when. If you are a community member, the consent is also recorded with your other consents, with the IP address and browser it was sent from; if you join later, it is added to them then.

What we keep: The screenshot or the note; when you shared it; the condition (PFS, PSSD, PAS or something else), the country and its regulator, if the guide asked you; the language of the guide; and whether and when a volunteer checked it.

Before it is sent: Your browser makes the picture smaller and saves it again as a new image. This removes the location, camera and time data that a picture file can carry. It does not change what the picture shows. The original file never leaves your device.

Where it is kept and who can see it: In our community database, hosted by Railway in the EU (Amsterdam region). Access is controlled, and the screenshot is never at a public address. Only the SIDEfxHUB volunteers authorised to administer the community can view it, once signed in. We log who opened a report or its screenshot, and when, for accountability and security (our legitimate interest, Article 6(1)(f)). A screenshot is never sent by email and is never in an export of our data, except in a copy of your own data that you ask for.

Linking it to your membership: If you joined the community in the same browser, we link the report to your membership without asking for your email address. Otherwise the guide asks for the email address you joined with, and you can skip it. If the address belongs to a community member, we link the report to that membership. If it does not, we keep the address with the report only so that we can link the report if someone joins the community with that address later; when they do, the report becomes part of that membership and the address is removed from the report. We note which of the two ways the link was made. We use the address for nothing else.

How long we keep it: A screenshot is kept until you ask us to delete it, or until we delete it. The volunteers who administer the community can delete a screenshot at any time, and if you withdraw your consent, we delete it. Deleting removes the picture, and any email address kept with it, from our database at once; copies in our hosting provider's backups made before then expire on the provider's backup schedule. What stays is a short record that proof was shared, whether it was checked and when it was deleted, with no picture and no email address. If you erase your community membership, your reports and screenshots are erased with it.

Your rights: At any time, you can ask for a copy of your screenshot or note, ask us to delete it, or withdraw your consent. Write to contact@sidefxhub.com and we will act within one month. Community members can also download a copy of their data, including their reports and screenshots, on their Manage my data page. Deleting your proof from SIDEfxHUB does not withdraw the report you made: your regulator holds that report, not us.

On your device: The guide remembers where you are in it, with the condition and country you chose, in your browser: in the tab you are using, and on your device for 30 days, so that you can come back to it. This is not sent to us, and your email address, note and picture are never kept there. After you share proof, we set a cookie, sfx_reported, for one year, so that the guide and the community sign-up can thank you instead of asking again. It holds no answer, name or email address: only a signed note that this browser reported and, if you joined in this browser, a reference to your membership.

Measuring Our Google Ads

If you arrive on this site from one of our Google ads, we ask whether we may tell Google when you join the community or open a regulator’s report form. We ask so that we can see which ads help. If you say no, nothing is loaded from Google and nothing is sent. If you say yes, Google’s tag is loaded, Google places cookies in your browser (_gcl_aw and _gcl_au, kept for up to 90 days) and receives the fact that the sign-up or the click happened, together with the identifier of the ad click, the address of the page and technical details your browser sends, such as your IP address. We never send Google your name, your email address, your answers or the condition you chose. We do not use this for personalised advertising. Your answer is remembered in a cookie named sfx_ads for 180 days. You can withdraw it at any time by deleting that cookie in your browser or by writing to contact@sidefxhub.com. Google processes this data under its own privacy policy, and it may be transferred to the United States. Our lawful basis is your consent.

Sharing of Data

Personal data is not sold, traded, or rented. Personal data is shared only with third-party service providers and, with your explicit consent, under strict confidentiality agreements for operational purposes and with UK authorities as legally required. Proof of a report to a medicines regulator (a screenshot or a note) is never shared with anyone, including researchers.

Lawful Basis for Processing Your Data

We can only process your personal data if there are legal grounds to do so. These include:

• Consent: You give us clear permission to process your data. This involves explicit electronic consent, which can be withdrawn at any time without needing a reason.
• Explicit consent: Proof you choose to share of a report to a medicines regulator (a screenshot or a note), and the condition you chose with it, are health information, which is special category data. We keep them only with your explicit consent (UK GDPR Article 9(2)(a), with Article 6(1)(a)), which you can withdraw at any time.
• Legitimate interest: We may also process data without explicit consent for purposes you might reasonably expect, in line with the charity’s objectives and in your best interests.

Data Retention

We retain personal data only for as long as necessary to fulfil the purposes we collected it for, including satisfying any legal, accounting, or reporting requirements. A screenshot shared as proof of a report to a medicines regulator is kept until you ask us to delete it, or until we delete it, and is deleted if you withdraw your consent.

International Transfers

Your information, including personal data, may be transferred to — and maintained on — computers located outside your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those of your jurisdiction.

Your Rights

You have the right to access, correct, delete, or transfer the personal data we hold about you. You also have the right to withdraw consent at any time where we rely on consent to process your personal data. To exercise any of these rights, contact us at contact@sidefxhub.com or use the Manage my data page.

Security

We are committed to ensuring that your information is secure. We have put in place suitable physical, electronic, and managerial procedures to safeguard and secure the information we collect online.

Children’s Privacy

Our services do not address anyone under the age of 13. We do not knowingly collect personally identifiable information from anyone under the age of 13.

Changes to This Privacy Policy

We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page.

Contact Us

If you have any questions about this Privacy Policy, please contact us:
Email: contact@sidefxhub.com

SIDEfxHUB — Charity Registered in the UK as “SIDEfxHUB”.
UK Registered Charity Number: 1203385.