Privacy Notice
This notice explains what information the TED & Graves' Support Community Alliance collects, why we collect it, and the choices you have. We keep it in plain language on purpose.
Before you publish: this notice is a solid starting point, but privacy law differs by country and health-related information is treated as a special category almost everywhere (GDPR Art. 9 in the EU/UK, HIPAA where a covered entity is involved in the US). Have a qualified privacy professional review and adapt it before the site goes live, and fill in the bracketed details below.
Who we are
The TED & Graves' Support Community Alliance ("we", "us") operates this website. For questions about this notice or about your information, write to support@tedgravessupport.org.
Data controller: [legal entity name, registered address, and — where required — the name and contact details of your data protection officer or EU/UK representative].
What we collect
Information you give us
- Contact details you enter in our forms — such as your name, email address and country.
- Anything you choose to tell us about your situation, including whether you or someone you care for has been diagnosed with Graves' disease or Thyroid Eye Disease, and what kind of support or information you are looking for.
- The content of emails and messages you send us.
You decide what to share. You never have to give us health information to contact us — but if you do, we treat it as sensitive personal information and handle it accordingly.
Information collected automatically
- Basic technical data our hosting provider records to serve and secure the site, such as your IP address, browser type and the pages you requested.
- We do not use advertising cookies or third-party tracking pixels on this site.
How we use it
- To reply to you and provide the support, education or information you asked for.
- To tell you about resources, community activities, and — if you asked about them — clinical research opportunities that may be relevant to your situation.
- To send you updates, if and only if you asked to receive them. Every message includes an unsubscribe link.
- To keep the website secure, working and improving.
We do not sell your personal information, and we do not share it with advertisers.
Legal basis
Where the GDPR or UK GDPR applies, we rely on your consent for sending you updates and for processing any health-related information you share, and on our legitimate interest in responding to enquiries and operating the site. You can withdraw consent at any time.
Who processes data on our behalf
Form submissions are not sent to any third party. What you write in our forms is stored on our own server, encrypted, and read only by our team. These are the only providers involved in running the site at all:
- Hostinger — the virtual server this site runs on, and its logs. Hostinger privacy policy.
- Google Fonts — web fonts are requested from Google's servers, which receive your IP address. [If you prefer to avoid this, the fonts can be self-hosted — see README.md.]
- [Add your email provider, newsletter tool, or CRM here.]
How long we keep it
We keep what you send us for as long as we are supporting you and for a reasonable period afterwards, then delete it — the deletion is automatic once that period passes. If you ask us to delete your information sooner, we will, and the record is removed from our server rather than merely hidden. [Confirm the exact retention period here.]
Your rights
- Ask what information we hold about you, and get a copy.
- Correct anything inaccurate.
- Ask us to delete your information.
- Withdraw consent or unsubscribe at any time.
- Object to or restrict certain uses of your information.
- Complain to your local data protection authority.
To exercise any of these, email support@tedgravessupport.org. We aim to respond within 30 days.
Security
The site is served over HTTPS with a valid TLS certificate. Everything you send through our forms is encrypted at rest (AES-256-GCM) on our own server, stored outside the public web directory, and readable only through a password-protected panel limited to the people who need it in order to respond to you. Access is logged. No system is perfectly secure, so please avoid sending us more clinical detail than you need to — and never send anything you would not want written down.
Children
This site is intended for adults. We do not knowingly collect information from children under 16. If you believe a child has sent us information, contact us and we will delete it.
Not medical advice
Nothing on this website is medical advice, and using this site does not create a patient–clinician relationship. Always consult a qualified healthcare professional about your condition and treatment options. Participation in any clinical research study is voluntary, and eligibility is determined by the study protocol and by qualified research and medical professionals.
Changes
If we change this notice we will update the date at the top of the page and, for significant changes, tell the community directly.