Join registry Report side effects
‹ Home

Privacy Policy

Effective date: 8 October 2026 | Version: PRIV 2.4

Who we are

SIDEfxHUB is a Charitable Incorporated Organisation (CIO) registered with the Charity Commission for England and Wales (charity number 1203385).

Website: sidefxhub.com | Email: contact@sidefxhub.com

What data we collect

Community data: name or pseudonym, email, condition (PFS/PSSD/PAS, or the name of another medicine), demographics (birth year, gender, country), symptom severity ratings, drug timeline, research participation preferences.

Contact form submissions: name, email, message content.

Event signups: name, email, country (optional), and which session you chose. Collected only when you sign up for a webinar or other event, and only with your explicit consent.

Proof of a report to a medicines regulator: a screenshot or a short note you choose to share after reporting side effects through our report guide, with the condition, country and regulator and, if you are not a community member, the email address you give. Only with your explicit consent: see Proof of your report to a medicines regulator below.

Analytics: only if you accept analytics cookies. We record the pages you visit, including a page that could not be found; the site that sent you (the domain only, never the full address); any campaign tags in the link you arrived by, such as utm_source; the country your connection appears to be in; and your device and browser type.

We also count a short list of actions, and never anything you type:

  • following a link or button to the community or to the reporting page, and where on the page it was;
  • choosing a country’s regulator on the reporting page (which country), and continuing to that regulator’s form;
  • copying a MedDRA term or code, or the report-writing template;
  • clicking a donate button, and where on the page it was;
  • following a link to the Milano project page or to our WhatsApp page;
  • switching the site’s language (from which language to which);
  • signing up for a webinar (which session only: your name and email stay with the signup, not in analytics);
  • playing a film (which film);
  • following a link to another website (the domain only, never the page).

Our analytics are our own. There is no Google Analytics, no advertising network and no third-party tracker on this site; nothing is shared with anyone.

Your IP address is never stored. Our server uses it to look up the country your connection appears to be in and to block automated abuse, and then discards it. Only the two-letter country code is kept. The lookup uses DB-IP’s country database on our own server, so your address is not sent to anyone.

Two cookies make this work, and both hold nothing but a random number:

  • sfx_vid — tells repeat visits apart. Expires after 12 months.
  • sfx_sid — marks one visit. Expires after 30 minutes of inactivity.

Decline analytics, or withdraw later, and neither cookie is set — and any already on your device is deleted.

Proof of your report to a medicines regulator

Our step-by-step report guide helps you report side effects to your country’s medicines regulator, on the regulator’s own website. Afterwards you can share proof with us that you reported: a screenshot of the regulator’s confirmation page or, if you have none, a short note (up to 300 characters, for example “Yellow Card, spring 2021”). Sharing proof is up to you, and you do not need to be a community member to do it.

Why we ask for it: so that one of our volunteers can check that a report was made, and so that we can count the reports that have been checked. Only totals are ever published. We do not use your screenshot or note for research, we never publish it, and we do not share it with anyone.

Health information: a screenshot of a report confirmation can show health information, such as the side effects you reported, the medicine and a reference number. Under UK GDPR, health information is special category data. A note, and the condition you choose in the guide, are health information too.

Your explicit consent: we keep a screenshot only if you tick a box of its own that says so. It is never ticked in advance, and the screenshot cannot be sent until it is ticked. Our legal basis is your explicit consent (UK GDPR Article 9(2)(a), with Article 6(1)(a)), and the same consent covers the condition you chose. If you send a note instead, you give that consent by writing the note and sending it to us. We record which version of the wording you agreed to, and when. If you are a community member, the consent is also recorded with your other consents, with the IP address and browser it was sent from; if you join later, it is added to them then.

What we keep: the screenshot or the note; when you shared it; the condition (PFS, PSSD, PAS or something else), the country and its regulator, if the guide asked you; the language of the guide; and whether and when a volunteer checked it.

Before it is sent: your browser makes the picture smaller and saves it again as a new image. This removes the location, camera and time data that a picture file can carry. It does not change what the picture shows. The original file never leaves your device.

Where it is kept and who can see it: in our community database, hosted by Railway in the EU (Amsterdam region). Access is controlled, and the screenshot is never at a public address. Only the SIDEfxHUB volunteers authorised to administer the community can view it, once signed in. We log who opened a report or its screenshot, and when, for accountability and security (our legitimate interest, Article 6(1)(f)). A screenshot is never sent by email and is never in an export of our data, except in a copy of your own data that you ask for.

Linking it to your membership: if you joined the community in the same browser, we link the report to your membership without asking for your email address. Otherwise the guide asks for the email address you joined with, and you can skip it. If the address belongs to a community member, we link the report to that membership. If it does not, we keep the address with the report only so that we can link the report if someone joins the community with that address later; when they do, the report becomes part of that membership and the address is removed from the report. We note which of the two ways the link was made. We use the address for nothing else.

How long we keep it: a screenshot is kept until you ask us to delete it, or until we delete it. The volunteers who administer the community can delete a screenshot at any time, and if you withdraw your consent, we delete it. Deleting removes the picture, and any email address kept with it, from our database at once; copies in our hosting provider’s backups made before then expire on the provider’s backup schedule. What stays is a short record that proof was shared, whether it was checked and when it was deleted, with no picture and no email address. If you erase your community membership, your reports and screenshots are erased with it.

Your rights: at any time, you can ask for a copy of your screenshot or note, ask us to delete it, or withdraw your consent. Write to contact@sidefxhub.com and we will act within one month. Community members can also download a copy of their data, including their reports and screenshots, on their Manage my data page. Deleting your proof from SIDEfxHUB does not withdraw the report you made: your regulator holds that report, not us.

On your device: the guide remembers where you are in it, with the condition and country you chose, in your browser: in the tab you are using, and on your device for 30 days, so that you can come back to it. This is not sent to us, and your email address, note and picture are never kept there. After you share proof, we set a cookie, sfx_reported, for one year, so that the guide and the community sign-up can thank you instead of asking again. It holds no answer, name or email address: only a signed note that this browser reported and, if you joined in this browser, a reference to your membership.

How we use your data

  • Building a patient community to support research and advocacy
  • Sending updates about research, fundraising, and patient support
  • Improving our website
  • Responding to enquiries
  • Checking, with your consent, that a report to a medicines regulator was made, and counting the reports that have been checked

We will never sell, trade or rent your personal data.

  • Consent (Article 6(1)(a)): when you join our community, subscribe to updates, or submit a contact form
  • Consent (Article 6(1)(a), and PECR regulation 6 for the cookies themselves): analytics, and everything derived from it. Nothing is collected until you accept, and collection stops the moment you withdraw
  • Explicit consent (Article 9(2)(a), with Article 6(1)(a)): proof you choose to share of a report to a medicines regulator (a screenshot or a note), the condition you chose with it and, if you are not a community member, the email address you give. The proof and the condition are health information (special category data), and we keep them only with this consent
  • Legitimate interests (Article 6(1)(f)): improving services and outreach aligned with our charitable objectives, and logging who opened, checked or deleted proof of a report, for accountability and security

Data sharing

We do not share your personal data except:

  • Research: with your separate, explicit consent if a relevant study arises
  • Service providers: limited third-party services under data processing agreements
  • Legal obligations: if required by law

Proof of a report to a medicines regulator (a screenshot or a note) is never shared with anyone, including researchers. Only our hosting provider, Railway, stores it.

Data retention

  • Community data: retained for the duration of your participation. Request deletion at any time.
  • Contact submissions: retained for up to 24 months, then deleted.
  • Event signups: deleted within one week of the event taking place.
  • Analytics: everything recorded for a visit is deleted after 14 months.
  • Proof of a report to a medicines regulator: a screenshot is kept until you ask us to delete it, or until we delete it, and is deleted if you withdraw your consent. A short record that proof was shared and checked stays, without the picture or your email address; for a member, it is erased with the membership.

Your rights

You have the right to access, rectify, erase, port, restrict, and object to the processing of your data. You may withdraw consent at any time. Contact contact@sidefxhub.com — we will respond within one month.

For analytics specifically: we hold no name or email against it, so we can only find your records if you send us the value of your sfx_vid cookie (your browser’s developer tools will show it, under this site’s cookies). With it we can retrieve or delete everything recorded for your browser. If you have cleared your cookies we cannot identify you, and under Article 11 we are not required to — we would rather say so than promise otherwise.

Cookies

On this website, analytics cookies only, and only with your consent. No advertising, no cross-site tracking, and no third-party analytics. You choose on your first visit, and you can change your mind at any time through the cookie settings link at the foot of any page.

Our community sign-up and our report guide set two cookies of their own, so that you are not asked the same thing twice: sfx_member, when you join, and sfx_reported, when you share proof of a report. Each lasts one year and holds only a signed reference, never an answer, a name or an email address. The report guide also keeps your place in it on your own device for 30 days; that is not sent to us.

Third-party services

  • Stripe: processes donations securely. Payment details handled by Stripe, not stored on our servers.
  • YouTube: until you press play, a film is only a picture. On some pages that picture is the film’s thumbnail from YouTube’s image server (i.ytimg.com), which receives your IP address, as every server your browser contacts does, but sets no cookie. When you press play, the film loads from youtube-nocookie.com, YouTube’s privacy-enhanced mode, and YouTube may then set cookies under its own policy.
  • DB-IP: the country database behind our analytics (IP geolocation by DB-IP, licensed CC BY 4.0). It runs on our own server; nothing is sent to DB-IP.
  • Zoom: hosts our live sessions. If you join one, Zoom processes your data under its own policy. Zoom is a US provider.
  • Microsoft: delivers our outgoing email.
  • Railway: hosts this website and our community database. The database, which also holds the screenshots described above, is in Railway’s EU region (Amsterdam).

Security

We take reasonable measures to protect your data. No method of internet transmission is completely secure.

Contact us

Email: contact@sidefxhub.com | Organisation: SIDEfxHUB, UK Registered Charity #1203385

ICO: ico.org.uk | 0303 123 1113