Privacy Notice

Who is responsible for your information

DD Medical Atlas is operated by Graeme Syme, a sole trader trading as Dyslexic Dietitian. Graeme Syme is the data controller for the personal information described in this notice. You can contact us through the DD Medical Atlas contact form.

Information we collect

• Account information: your email address, account identifier and encrypted authentication information.
• Favourites: the illustration identifiers saved to your account.
• Contact enquiries: your name, email address, enquiry type and message.
• Illustration sharing: the recipient email address, selected illustration, annotated PNG and delivery information needed to send the message. Your own account email is not disclosed to the recipient.
• Security and service information: IP address, browser and request information, authentication activity and limited delivery or error logs.
• Information stored on your device: annotation-tool preferences and any locally added illustrations. This information remains in your browser unless you choose a feature that sends it.

Do not enter or upload patient names, NHS numbers, dates of birth, photographs or other identifiable health information. DD Medical Atlas is not designed to store medical records.

Why we use it and our lawful bases

• To create and secure accounts, provide favourites and deliver requested features: necessary to provide the service requested by you and, where applicable, perform our contract with you.
• To answer enquiries, maintain service security, prevent abuse and improve reliability: our legitimate interests in operating and protecting the service and communicating with users.
• To send an annotated illustration to the recipient you specify: to carry out your requested action and our legitimate interests in providing the sharing service.
• To meet legal, regulatory or safeguarding obligations: compliance with legal obligations or establishment, exercise or defence of legal claims.

We do not sell personal information or use account and contact details for advertising.

Service providers and international processing

We use Supabase for account authentication and account-linked data, Netlify for hosting and request processing, and Resend for transactional email delivery. These providers process information on our behalf and may process it outside the UK. We rely on the providers' contractual and legal safeguards for applicable international transfers.

How long information is kept

• Account information and favourites are normally kept while the account remains active, then deleted or anonymised following account deletion, subject to limited backups and legal requirements.
• General contact correspondence is normally kept for up to 12 months after the last contact unless a legal, security or business reason requires longer retention.
• Share-event and security records are kept only for as long as reasonably necessary to prevent abuse, investigate delivery problems and protect the service.
• Recipient addresses and image attachments are transmitted to the email provider for delivery; DD Medical Atlas does not add the recipient to a mailing list.
• Browser-stored preferences and local uploads remain on your device until you remove them or clear the site's storage.

Your rights

Depending on the circumstances, you may have rights to access, correct or erase your personal information, restrict or object to processing, and receive portable information. You can also withdraw consent where consent is the lawful basis. Use the contact form to make a request. You may complain to the UK Information Commissioner's Office at ico.org.uk.

Security and changes

We use access controls, secure cookies, encrypted connections and service-provider safeguards. No online system can be guaranteed completely secure. We may update this notice when the service or law changes; the date above shows the latest revision.