Privacy notice
How RAi Health & Social Care uses the personal information you give us when you apply to join, become a member or sign in to this site.
Draft, not yet approved. This notice describes what the site actually does today. The parts marked to be confirmed are decisions still open, and must be settled before the site opens to the public.
1. Who we are
RAi Health & Social Care (Responsible AI in Health and Social Care) is an independent institute in formation. It runs this website and the members' community on it.
Data controller: to be confirmed. The organisation legally responsible for your information has not yet been named. Its name, address and, if it has one, its Information Commissioner's Office registration number will go here.
Until then, write to hello@raihealth.co.uk about anything in this notice. The working group reads that inbox.
2. What we collect
When you apply to join
- Your name, email address, role and organisation.
- The setting you work in, your nation, and your region and local area if you give them.
- Your answers about your motivations, your experience and what you would contribute.
- The name and details of a sponsor, if you give one.
- Whether you are already an NHS AI Ambassador.
- Any commercial interest you declare, and your description of it.
- The topics you would like to discuss, if you tick any.
- Whether you ticked the box asking to be listed in the Champions directory.
- The time you confirmed you had read how your data is used.
Reviewers also record their decision on your application, any note explaining it, and whether they referred you.
If you become a member
Your name, email address, role, organisation, region, membership class (Champion, Advisory Council, Observer or Industry Forum) and the date you were approved. For the Champions directory we also keep your nation, setting, local area, topics and whether you want to be listed. You can change your listing and topics yourself on your Account page.
If you are on the working group
We email you each research brief once it is approved. We keep your email address, whether you have unsubscribed, and a record of each email sent. Every email has a link to unsubscribe.
If you take part in discussions
What you post, when, which discussion it belongs to, and when you last edited it. If you report a post, we keep the report and your reason. We keep your choices about discussion emails, and a record of each weekly digest sent to you for 90 days. Your name, role, organisation and region appear next to your posts. You can turn the weekly digest off on your Account page, and stop reply emails for any discussion.
When you sign in
- The email address you type into the sign-in form, and the time, so we can limit repeated requests.
- A one-time sign-in link. We store only a scrambled form of it (a hash), never the link itself.
- A record that you are signed in on a device, held in a cookie (see section 6).
- If you add a passkey: the public half of the key, a name for it such as "iPhone", and when it was added and last used. The private half never leaves your device, and we never see your fingerprint or face.
Technical information
To slow down abuse, we keep a scrambled form of your internet address (an IP address hash) when you sign in with a passkey or send an application. We cannot turn it back into the address. We also keep a log of actions on the site, such as sign-ins and decisions on applications, so we can investigate problems.
We do not use analytics, advertising or tracking of any kind. Everything the pages need, including the typefaces, is served from this site.
3. Why we use it, and our lawful basis
| What we do | Lawful basis |
|---|---|
| Read and decide on your application | Legitimate interests: running a selective professional network. To be confirmed |
| Run your membership and let you sign in | Legitimate interests. To be confirmed |
| Run the members' discussion forum, email you when someone replies to a discussion you take part in, and send a weekly digest of new discussions | Legitimate interests: helping members learn from each other. To be confirmed |
| Keep the site secure (rate limits, the action log) | Legitimate interests: protecting members and their information. |
| List approved members in the Champions directory, which other signed-in members can see and which we share with the NHS AI Ambassadors Network | Consent: we only do this if you tick the box on the application form. You can withdraw it at any time. To be confirmed |
The bases marked to be confirmed are our working view and need checking with a data protection adviser before launch.
4. Who sees your information
- The four people who run the working group (Fin, Anna, Nitin and Nick) read applications. Nobody else does, and other members cannot see your application.
- Other signed-in members read what you post in discussions, with your name, role, organisation and region.
- Other signed-in members. If you are listed in the Champions directory, other signed-in members see your name, role, organisation, region, topics and email address. If you are not listed, they see none of this. You can list or unlist yourself at any time on your Account page.
- The NHS AI Ambassadors Network. If you are approved, and you ticked the box to share, your name, role, organisation and region are included in the Champions directory we share with them. Tell us at any time and we take you out.
- Companies that run parts of the service for us. They act on our instructions and may not use your information for anything else:
- Cloudflare hosts the website and its database. The database is stored in Cloudflare's Western Europe region.
- Resend sends the site's emails: sign-in links, an email when someone replies to a discussion you take part in, the weekly digest of new discussions, and, to the working group, the research briefs. It receives your email address and the message. Where Resend processes data, and the safeguard for any transfer outside the UK, to be confirmed
- Apple (iCloud Mail) hosts the hello@raihealth.co.uk and fin@raihealth.co.uk mailboxes, so it holds any email you send us.
We never sell your information, and we do not pass it to funders or suppliers.
5. How long we keep it
| Information | Kept for |
|---|---|
| An unsuccessful application, with the reviewers' decisions | Six months after the decision, then deleted automatically |
| A successful application | While you are a member |
| Your discussion posts | While you are a member. A post you remove, or that the working group hides, is deleted 30 days later. Ask us and we delete your posts sooner. |
| Your member record, directory entry and passkeys | While you are a member, or until you ask us to delete them. You can remove a passkey yourself on your Account page. |
| Email addresses typed into the sign-in form, and scrambled internet addresses | 24 hours |
| Sign-in links | They stop working after 15 minutes and are deleted within 24 hours |
| Signed-in sessions | Up to 30 days, or until you sign out |
| Your research brief email preference, and the record of emails sent to you | While you are on the working group |
| The action log | 12 months. Entries that hold an address that does not belong to a member are deleted within 24 hours. |
Deletion runs automatically every night.
6. Cookies
We use only what the site needs to work, so we do not ask for cookie consent.
| Name | What it does | How long |
|---|---|---|
rai_session | Keeps you signed in | 30 days, or until you sign out |
rai_pk | Holds a one-time passkey check while you sign in with a passkey | 5 minutes |
rai.passkey (stored in your browser, not a cookie) | Remembers that this device has used a passkey here, so the passkey prompt can open straight away. It holds no name or address. | Until you clear your browser's site data |
7. Your rights
Under UK data protection law you can ask us to:
- give you a copy of the information we hold about you
- correct anything that is wrong
- delete your information
- stop or limit how we use it, including taking you out of the Champions directory
- give you your information in a form you can take elsewhere
Write to hello@raihealth.co.uk. We will reply within one month.
If you are unhappy with how we have handled your information, please tell us first. You can also complain to the Information Commissioner's Office at ico.org.uk/make-a-complaint or on 0303 123 1113.
8. Changes to this notice
If we change how we use your information, we will update this page and, for anything significant, tell members.
Draft prepared 1 October 2026.