Interactive prototype — demo data only.

Privacy

How we look after your information.

Your health information is yours. This policy explains — in plain language — what we collect, why, who can see it, and the rights you have over it.

Last updated: 2 July 2026 · Applies to myresearch.org.uk

⚠️
Draft — pending legal review. This site is an interactive prototype using demo data only. This policy is a draft prepared for review by qualified legal counsel and does not constitute legal advice.

1. Who we are

MyResearchStudy is a UK-based registry that matches people to clinical research studies and gives research teams access to a consented, de-identified recruitment pool, available at myresearch.org.uk. It is a product operated by Stratosphere Health Ltd ("we", "us") — MyResearchStudy is a brand name, not a separate company. For the purposes of the UK GDPR and the Data Protection Act 2018, Stratosphere Health Ltd is the data controller for the registry.

Stratosphere Health Ltd is a company registered in England and Wales, company number 16577066, with its registered office at 17 Cromwell Avenue, Gatley, Cheadle, England, SK8 4BS. It is registered with the UK Information Commissioner's Office (ICO), registration reference ZC197649.

Contact: stratplatform@gmail.com.

2. What we collect

If you join the registry (participants)
Your first name, email address, and town or postcode; the health condition you tell us about, whether you were recently diagnosed, and whether you're on medication (this is special category health data); how far you can travel; and — only if you choose to share them — your age band, sex or gender, ethnic group, and preferred language. We also record the consents you give and when you gave them.
If you create a researcher account
Your work email, organisation name, and a password (stored as a secure hash by our authentication provider).
Automatically
Basic technical data needed to serve the site (IP address, browser type) via our hosting and font providers. We measure site usage with Cloudflare Web Analytics, which is cookieless and shows us only aggregate page statistics — it does not identify you, profile you, or track you across other sites. We run no advertising trackers and no analytics cookies, and we use your browser's local storage only to keep you signed in and remember your registry profile on your device. Full detail is in our cookies & storage policy.

This service is for adults. We do not knowingly collect data from anyone under 18, and we ask that you do not submit information about another person without their agreement.

3. Why we use it, and our legal bases

✓
Matching you to studies. Because your condition is health data, we only do this with your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)) — the "Join the free registry" consent you give at sign-up.
✓
Introducing you to a named study team. Only with your separate, optional consent — otherwise research teams never see who you are.
✓
Fair, representative research. Demographic details are optional, used only in de-identified form, and every field offers "prefer not to say".
✓
Running the service. Account administration, security, and responding to you — under contract necessity and our legitimate interests in operating a secure service.

We do not use your information for automated decisions with legal effects, and we never sell it.

4. Who can see your information

Research teams (sponsors) see only a de-identified pool: an anonymous ID, condition, age band, region, and match status — never your name or contact details. Your identity is shared with a specific study team only after you explicitly agree to be introduced to that named study.

Service providers (processors) host and run the service under data processing agreements: Supabase (database and authentication), Render (site hosting), Resend (sending your sign-in and account emails, processed in the EU), and Cloudflare (cookieless web analytics and content delivery). Typefaces are self-hosted, so no third party receives your IP address for fonts. We share data with authorities only where the law requires it.

International transfers. Some providers process data in the United States. Where personal data leaves the UK we rely on safeguards approved under UK law — the International Data Transfer Agreement or UK Addendum, or the provider's certification under the UK–US Data Bridge.

5. How long we keep it

We keep your registry profile while your account is active. If your account stays inactive for 24 months we delete your profile automatically; if you opt out, it's deleted straight away. Records of your consent may be kept for up to 6 years afterwards where we need them to demonstrate compliance, and billing records for the 6 years the law requires. You can opt out at any time from your portal.

6. Your rights

Under the UK GDPR you have the right to: access your data; correct it; have it erased; restrict or object to processing; receive a portable copy; and withdraw consent at any time (which stops future matching but doesn't undo past lawful processing). You can also change exactly what you share with research teams — de-identified profile, or contact details for a named study — any time from your account. Withdrawing is as easy as opting out in your portal or emailing us.

To exercise any right, email stratplatform@gmail.com. We verify requests (usually by confirming the email on your profile) and respond within one month, extendable where the law allows — we'll tell you if so.

Complaints. We'd welcome the chance to resolve any concern first, but you can complain at any time to the Information Commissioner's Office (ico.org.uk).

7. Security

Data is encrypted in transit, access to identifying information is restricted, and research teams work from de-identified records by default. No system is perfectly secure; if a breach ever put your rights at risk we would notify you and the regulator as the law requires.

8. Changes to this policy

If we make material changes we'll update the date at the top and, where the change affects how your data is used, tell you by email before it takes effect. Continuing to use the registry after a change does not replace consent where consent is required — we'll ask again.

Questions about your data?

Email us and a human will reply — plainly.

stratplatform@gmail.com