Privacy center

What we collect

Account details: your name, email address, role, organisation and country.

Application and story content: the description of your work, outcomes, evidence links, team members you name, photos you upload, and the names and emails of colleagues you ask to confirm your contribution.

Nominations, thank-you notes, reviewer sign-ups, enquiries and newsletter sign-ups you send us.

Review records: reviewer scores, comments, conflict declarations and decisions about applications.

Payment records, if fees apply in future: amount, currency, status and a payment reference. Card details are handled by Stripe and never reach us.

Technical data: standard server logs kept by our hosting providers for security.

We do not ask for special category data (such as your health, ethnicity or religion). Please do not include it.

Data we receive about you from others

If someone names you as a colleague, nominee or team member, we receive your name, email address, role and how they know your work from them. We tell you this when we first contact you, and you can decline, object or ask us to delete your details at any time.

Why we use it, and our lawful basis

To run your account and assess your application, under our contract with you.

To publish approved records, under our contract with you and only with the consent you give at application. Non-approved applications are never published.

To contact colleagues you name so they can confirm your contribution, under our legitimate interest in verifying evidence. They can decline or ask us to delete their details.

To send updates you sign up for, with your consent, which you can withdraw at any time.

To keep the published register accurate and trustworthy, including keeping corrected or revoked records visible, under our legitimate interest in the integrity of the register.

To keep the service secure, prevent fraud and meet legal obligations.

Giving us your details is not a legal requirement, but we cannot assess an application without them.

We do not make decisions about you by purely automated means. Every recognition decision is made by people.

Patient information

Do not include patient names or anything that could identify a patient. We remove such details if we find them, and we may decline an application that contains them.

What becomes public

If your application is approved, your public record shows your name, role, organisation, country, the recognition awarded, a summary of the work and its status history. You choose whether a photo appears. Evidence files, colleague details and reviewer comments are never published.

You can withdraw your consent to publication at any time. We will then remove your record from public view; anyone checking its verification link will see that it is no longer published.

Who processes data for us

Supabase (database, sign-in and file storage, hosted in London, UK), Vercel and Cloudflare (website hosting and security, including servers in the United States), Stripe (payments, if enabled), and email providers used to send account and record emails. Each acts on our instructions under a written data processing agreement. Where data is processed outside the UK, we rely on UK adequacy regulations (including the UK Extension to the EU-US Data Privacy Framework) or the ICO's International Data Transfer Addendum. We never sell your data.

How long we keep it

Published records stay online while the recognition is valid, unless you withdraw consent to publication. Revoked records stay marked "Revoked" for up to six years, because the register must stay trustworthy; you can object to this and we will weigh your circumstances.

Applications that are not approved, and their evidence, are deleted 24 months after the decision. Enquiries are kept for up to 24 months. Newsletter emails are kept until you unsubscribe.

Your rights

Under UK data protection law you can ask to access, correct or delete your data, restrict or object to its use (including any direct marketing, at any time), receive a portable copy, and withdraw consent without affecting earlier lawful use. We reply within one month, extendable by two months for complex requests, and there is normally no fee.

You can also complain to the Information Commissioner's Office (ico.org.uk). We would welcome the chance to help first.

If you live outside the UK

We follow UK data protection law for everyone. Where the laws of your country (for example the EU GDPR or Saudi Arabia's Personal Data Protection Law) give you additional rights, we will honour them. Contact us using the details above.

Cookies

We use only the cookies and local storage that are strictly necessary for sign-in, security and site preferences, so no consent banner is needed. We do not use advertising or tracking cookies. If this changes, we will ask for your consent first.