Privacy and data use

Who is responsible for your information

Orbixa Technologies Ltd is the data controller for personal data collected through this website and the reviewer questionnaire. The company is registered in England and Wales under company number 16519488. Andrew Hardman is the internal owner for reviewer data handling and administration.

Registered office: Reception 1, First Floor Offices, Red Rose Court, Clayton Business Park, Clayton Le Moors, Lancashire, BB5 5JR. This is the company’s registered address, not a route for correspondence — please use the contact form, which confirms receipt and records that you got in touch.

What has not been done

A data protection impact assessment has not been completed and no lawful basis has been concluded by a governance owner. Both are required before this platform is used at scale. We would rather say so than imply an assurance we do not hold.

Naming the controller and completing that assessment are different things. We are confident about the first and have not finished the second, and this notice is written so the one is not read as the other.

How to reach us about your information

Use the contact form, and choose the reason closest to your request. There is no published email address; a message sent through the form is recorded, and its arrival is notified to us by email so that it is seen rather than waiting to be noticed. You should hear back within a couple of working days. A request about your information — to see it, correct it, or have it deleted — reaches the controller this way, and that is the route to use.

The notification carries your message in full, your name and your email address, so that it can be read and answered without anyone opening an internal system. It is sent to us and never to you. Nothing automatically schedules or enforces a reply.

You can also complain to the Information Commissioner’s Office at ico.org.uk, and you do not have to raise it with us first.

What we collect, and what each thing is for

Name, organisation and role category, as supplied when your invitation was created.

To know who is reviewing, so feedback can be read in the context of the service the person works in.

Email address, only where you agreed to give one. The review works without it.

To send your invitation link and, if you agreed to it, to follow up.

Questionnaire answers, including free text you choose to write.

They are the research. They are read to decide whether the problem is real and whether the approach could work.

Which demonstrator steps you viewed, and how long the review took.

To know which parts of the demonstration were used, so the next version is shorter where it can be.

Your four permission choices, each recorded separately with the version of the consent text and the privacy notice you were shown.

So that what you agreed to can be established later from the record rather than from memory.

Messages sent through the contact form, and the reason category you chose.

To reply, and to arrange demonstrator access where that is what you asked for.

Who processes it on our behalf

Named rather than described, so you can check them yourself.

Supabase

Database and authentication. Holds reviewer records, questionnaire answers, consent records and the administrator audit log.

Region: London (eu-west-2). Recorded in GOING_LIVE.md and chosen so reviewer data stays in the United Kingdom.

Vercel

Hosts and serves this website and the reviewer journey.

Region: Not recorded in this repository — see the outstanding items below.

Railway

Hosts the synthetic demonstrator, which holds no personal data and no patient data of any kind.

Region: Not recorded in this repository — see the outstanding items below.

Resend

Sends notification email to us — and only to us — when an enquiry arrives or a reviewer submits a questionnaire. No email is sent to reviewers or to people who contact us. WHEN YOU USE THE CONTACT FORM it receives your message in full, your name, your email address, your organisation if you gave one, and the category you chose, so that we can read and answer it without opening an internal system. WHEN A REVIEWER SUBMITS it receives only a name, an organisation, a role category, a questionnaire version, a timestamp and a link — never the answers, never any free text, never a quotation — and a reviewer who did not consent to attribution is not named in one.

Region: Not recorded in this repository — see the outstanding items below. Resend processes in the United States and the European Union depending on account configuration, and ours is not documented here yet.

What we do not do

• We do not send your free text, name or email to any third-party analytics service.
• We do not send you email. The only email this platform sends is a notification to us: that an enquiry arrived, carrying the enquiry and the address that wrote it, or that a reviewer submitted, carrying no answers, no free text and no quotations.
• We do not put a reviewer’s questionnaire answers in an email, ever. They are read in an access-controlled page where your permissions are applied field by field and every reading is recorded.
• We do not write invitation tokens, session credentials or free text into application logs.
• We do not treat your feedback as evidence that the product works.
• We do not quote you, name you or name your organisation without the specific permission for that.
• We collect no patient data of any kind. The demonstrator uses synthetic records only.
• We do not sell your information, and we do not use it for advertising.

Where your information is held

The database holding reviewer records is in London (eu-west-2), chosen so that reviewer data stays in the United Kingdom. The regions in which the website and the demonstrator themselves run are not recorded in our own documentation, so we cannot state a complete international transfer position yet. That is listed as outstanding below rather than guessed at.

Retention, deletion and withdrawal

Reviewer records are retained for twenty-four months from submission, or until you ask for removal. On withdrawal your identifying details are cleared and any quotation permission is revoked; anonymous counts remain so that published sample sizes stay accurate.

You can access, correct, withdraw or delete your information by asking through the contact form. You can withdraw a permission without withdrawing the others, and withdrawing the permission to store your answers removes them.

Whether twenty-four months is the right period is part of the assessment that has not been completed. The period is what the system currently does, stated so you know it.

Which version of this notice you agreed to

Every permission you give is recorded separately, with the version of the consent text and the version of this notice that you were shown at the time. This notice is version privacy-2026-09-04. If it changes, earlier records keep the version they were given under, so what you agreed to can be established from the record rather than from memory.

Still outstanding

Published because a privacy notice with gaps in it is more use than one that reads as complete and is not.

The lawful basis for processing reviewer personal data, and for any special category data if the questionnaire is ever judged to collect it.

Who must supply it: A data protection adviser or the appointed governance owner.

A legal determination. Writing a plausible basis into a privacy notice would be asserting a conclusion nobody has reached.

A completed data protection impact assessment.

Who must supply it: The appointed governance owner, with a data protection adviser.

It is an assessment, not a paragraph. Its absence is disclosed on every page that names the controller.

The regions in which the Vercel site and the Railway demonstrator actually run, and any resulting international transfer position.

Who must supply it: The governance owner, from the Vercel and Railway project settings.

Only the database region is recorded in this repository (London, eu-west-2, in GOING_LIVE.md). The other two are not, and a transfer statement built on a guess is worse than one that says it is incomplete.

Whether twenty-four months is the right retention period, and on what reasoning.

Who must supply it: The governance owner.

The period is implemented and disclosed. What is missing is the justification for it, which is part of the assessment above.