Our Social Enterprise’s data security and privacy standards
Our social enterprise Diabetes-cutmyrisks.co.uk Ltd was founded in January 2011. We rely upon our users, associates, collaborators and benefactors to help realise our mission of improving health and using personal health care plans to prevent diseases. So we commit to maintaining your confidence and trust and your privacy. Our principles are simple – we will be transparent about what data we collect about you, where that data comes from, how we use the information we hold about you, and the choices you can make.
We never pass on your personal information to anyone. Personal information is only disclosed with the user’s agreement, or if required by law.
Users’ personal data is only collected when the user registers through an online account. When a user asks to register, a simple privacy and security conversation is generated on the users mobile phone or web page. This conversation explains the key elements of this policy, and asks the user to agree to them.
This website is a secure (HTTPS encrypted) site. SSL is used as the standard security technology for establishing an encrypted link between our web server and your browsers. This link ensures that all data passed between the web server and browser remain private.
Each user account is completely private and only visible to you, and your home carer(s). And to your doctors and nurses that you nominate in your account, if you register them and give them your login details.
We never share user information with anyone. We are registered as a data controller with the UK Information Commissioner’s Office (ICO) and are compliant with the UK Data Protection Act 1998, and the new General Data Protection Regulation (GDPR) [(EU) 2016/679].
We keep the connected database of users’ personalised data on a different server to that used for the website/ app.
We do not use plain text files for person/patient data, but use encryption via international standard AES 256.
We set a secure, minimum recommended password length for all our registered users. This is a password length of 10+ characters, including symbols, numbers, lowercase and uppercase characters. We offer registered users an Auto-Select facility via https://passwordsgenerator.net/.
Your password for this site is generated on your user side, and is NOT sent across the Internet.
We use 2 factor authentication, asking each user to register a personal answer to a common question such as mother’s maiden name.
Site Visitors data is protected by using electronic safeguards: Encryption by Default, Firewalls, Monitoring Suspicious Activity, Security Testing, Data Backup and Recovery.
Akismet is enabled on this site. So the contact form submission data (IP address, user agent, email address, site URL, and comment) is submitted to the Akismet service for spam checking.The actual submission data is stored in the database of the site on which it was submitted and is emailed directly to the site author who published the page on which the contact form resides. This email will include the submitter’s IP address, timestamp, name, email address, website, and message. The IP address is included as an abuse prevention measure. Akismet here is required for providing proper spam defense.
Cookies will be used, and log files will be collected, as set out in our cookies policy page. And site users can manage their cookies consent on that web page or by pressing the ‘manage cookies’ button on any page after you have accepted cookies.
Each user will be given the choice of receiving emails and/or SMS messages, or not, for each category of response by the system.
Aggregated user data may be used for creating statistics, but will not contain personal information.
Our data centre provider (WordPress.com) is registered to be achieving the standard ISO 27001, second edition 2013. This provides a set of standardised requirements for an Information Security Management System. Their Privacy Notice explains how our provider, part of the Automattic group of companies, processes information about the visitors to our own website in connection with the services we provide through WordPress.com, Jetpack (including WooCommerce Shipping & Tax), and Akismet.
Intrusions monitoring is included on this site.
We use the NHS Data Model and Dictionary, version 3 from HSCIC, that provides a reference point for approved Information Standards and Collections, and we register for it at http://www.datadictionary.nhs.uk/.
The General Data Protection Regulation (GDPR) is a European Union (EU) law that took effect on May 25, 2018. The goal of GDPR is to give UK and EU citizens control over their personal data. This website is written using WordPress core software, which is GDPR compliant. The WordPress team has added several GDPR enhancements to make sure that WordPress is GDPR compliant. These include: comment consent check boxes, EU compliance add-on for Google Analytics, consent check boxes for WordPress forms, Email Marketing Opt-in Forms, plugin for EU Cookies Notices, Delete Me plugin.
Before revealing any non-public information about a site, an account, or a user, WordPress.com require a valid subpoena, search warrant, or court order. The only exception is when we have a good faith belief that there is an emergency involving imminent danger of death or serious physical injury.
page updated 20 July 2021. © 2021 by social enterprise Diabetes-cutmyrisks.co.uk.™ Ltd.