Privacy notice

Scope

This notice explains the limited personal information handled through the DashFin website and initial service enquiries.

Website data

The launch site uses no advertising trackers, behavioural analytics, user accounts or embedded third-party forms. Basic technical logs may be processed by the hosting provider for security, reliability and delivery.

Email enquiries

When you email DashFin, the information you send is used to respond, assess whether a project is suitable, prepare a proposal and maintain necessary business records. The launch services use synthetic data only. Do not send identifiable, pseudonymised, claimed-redacted or otherwise real-person-derived patient data, confidential model credentials or production secrets.

Business contacts and outreach

DashFin may use publicly provided business contact details to send a single, relevant introduction to a UK corporate organisation whose published work appears closely related to the service. Generic corporate addresses are preferred; addresses are not guessed, behavioural tracking is not used and an opt-out is provided. Where business contact information identifies a person, DashFin relies on its legitimate interest in developing relevant business relationships, balanced against the limited nature of the contact and the person's right to object. Replying is optional. An objection or opt-out is recorded on a suppression list so that the address is not contacted again.

Clinical data boundary

The current services accept synthetic data only. DashFin does not accept identifiable, pseudonymised, claimed-redacted or otherwise real-person-derived patient data. A later expansion cannot be authorised by a written scope, lawful basis, security review or data-processing terms alone: it requires a new ratified boundary-policy version and completion of every applicable product-specific regulatory, data-protection, clinical-safety, insurance, contracting and intellectual-property decision before it can be offered.

Sharing

Information is not sold. It may be handled by necessary service providers such as email, hosting, document storage or professional advisers, subject to their own terms and appropriate controls.

Retention

Unsuccessful initial enquiries and business correspondence are retained only as long as reasonably necessary for correspondence, security and record-keeping. Minimal suppression information may be retained for longer so an opt-out can be respected. Contract and payment records may be retained for applicable legal and accounting periods.

Your rights

Depending on applicable law, you may have rights to request access, correction, deletion, restriction or objection. Contact mmohamed@dashfin.org. Identity may need to be verified before a request is fulfilled.

Changes

This notice may be updated as the service, hosting or data practices change. The date above identifies the current published version.