Privacy

Notice version: r7-1 · Effective date: Pending owner confirmation — real intake disabled.

Pending owner confirmation — real intake disabled.

Data controller: Pending owner confirmation — real intake disabled.
Country and postal address: Pending owner confirmation — real intake disabled.
Contact: Pending owner confirmation — real intake disabled.

What we collect and why

You choose which answers to save for a private map comparing your situation with published research. This is not clinical care or participation in a study. Fields may be skipped.

Age group (age_band) — An approximate range is enough. We do not need a date of birth.
Region you live in (region) — A rough region is enough to say how far you would have to travel. We do not ask for, and do not store, a country, a city or an address.
Willing to travel for a study (can_travel) — Many studies run in only a handful of centres worldwide.
How long ago the injury happened (time_since_injury) — Time since injury matters more than almost anything else: what is studied in the first weeks and what is studied years later are different bodies of work.
Phase of injury (phase) — Acute is the first days and weeks. Subacute is roughly up to three months. Chronic is after that. If you are unsure we derive it from how long ago it was.
Cause of injury (cause) — Some studies include only traumatic, or only non-traumatic, injuries.
Neurological level of injury (neurological_level) — The lowest level where sensation and strength are still normal. Usually written in a discharge summary as C5, T6, L1 and so on.
Vertebral level (vertebral_level) — Which part of the spine was fractured or operated on, if the record says so. The band is enough — we do not store the individual vertebra.
AIS grade (ais_grade) — The ASIA scale from A to E. A means no movement and no sensation below the level of injury. E means everything is within normal limits. If your records do not say, "I don’t know" is a perfectly good answer.
Complete or incomplete injury (completeness) — Incomplete means at least some signals still cross the level of injury — even if that is only sensation.
Last neurological examination (last_ais_exam) — The picture changes after an injury, and an old examination may no longer describe you today.
Spinal surgery (surgery) — For example decompression or removal of fragments.
Spine stabilised (stabilisation) — Metalwork, screws or a plate.
What the MRI or CT report says (imaging_summary) — In your own words or quoted from the report. We do not read the images themselves — only the text you give us.
Movement below the level of injury (movement_below) — Any movement you can make on purpose.
Sensation below the level of injury (sensation_below) — Touch, pressure, temperature, pain.
Arm and hand function (hand_function) — At a cervical level this is often the goal that matters most.
Trunk control (trunk_control) — Whether you can sit without support.
Leg function (leg_function) — From no movement to walking unaided.
Breathing (breathing) — Whether you need ventilator support.
Pain (pain) — Including burning or shooting pain below the level of injury.
Spasticity (spasticity) — Involuntary tightening or jerking of muscles.
Bladder (bladder) — For many people this is the recovery goal that matters most.
Bowel (bowel) — Whether you need a management programme.
Sexual function (sexual_function) — You may skip this. We ask because it is a research area of its own.
Rehabilitation right now (rehabilitation) — Many studies require active rehabilitation as a condition of taking part.
Regular medication (medication) — Yes or no is enough here — we do not ask for a list.
Implants or assistive devices (implants) — A stimulator, a pump, an exoskeleton, electrical stimulation.
Complications (complications) — Pressure sores, infections, autonomic dysreflexia.
Other conditions (comorbidities) — Many studies have limits on other conditions.
Your main goals (goals) — In your own words: what matters most to you to regain or improve.
Open to taking part in clinical trials (trial_openness) — This does not enrol you anywhere. We only show you what exists.
Level of risk you would consider (risk_limit) — A surgical procedure carries more risk than training or a device.
How much time you could commit (travel_limit) — Some protocols require months of visits.
What you do not know yet (unknowns) — For example: "I do not know my AIS", "I have never seen the MRI report". It lets us say what is missing instead of pretending we know.
A sudden severe headache right now (sudden_headache) — We are asking about right now. Together with your level of injury this can mean something that is looked at the same day.
Your bladder is not emptying right now (cannot_empty_bladder_now) — If this is so, it is urgent rather than a questionnaire matter.
You have a fever right now (fever_now) — After a spinal cord injury the cause can be invisible from outside.
Movement or sensation changed suddenly in the last few days (function_changed_recently) — A sudden change needs to be looked at urgently.
New severe pain that was not there before (new_severe_pain) — This is not the same as pain you are used to.
Breathing has become harder than usual (breathing_worse_now) — Compared with your usual state, not with anybody else’s.
There is broken skin or a pressure sore (skin_broken) — We give no care instructions at all — that is for whoever examines it.

The private database also stores a random profile ID, a hash of the browser access token, locale, creation/activity timestamps, consent purpose/version/language/text hash and grant/withdrawal timestamps. Optional documents include the encrypted filename, original validated PDF or metadata-stripped image bytes, extracted text and excerpts; type, size, hash, page count and coded candidate facts; your confirmations, corrections, observation dates, source provenance, disagreements, goals, safety flags and matching results. Private audit events contain actions, codes and counts, not document text.

Consent and control

The proposed legal basis is consent under GDPR Article 6(1)(a), with explicit consent for special-category health data under Article 9(2)(a). Legal applicability and this notice require sign-off. Minimum age: 18. Storage, documents, matching, reports and sexual-health processing have separate permissions. Withdraw the storage consent with one click to stop further processing; delete all data to erase the live record. A new notice version requires a new decision.

Storage and recipients

Railway · Pending owner confirmation — real intake disabled.

The application keeps health records in a separate PostgreSQL database. Railway hosts the web service and database and is an infrastructure processor; its subprocessors and international-transfer arrangements require verification before intake. Profile answers and documents are not sent to AI models, external OCR, researchers, partners or the public scientific database. Infrastructure processing is a third-party service; “no third-party sharing” does not mean “no hosting processor”.

AES-256-GCM encrypts free text, filenames, document bytes, extracted text and excerpts at the application layer. Controlled answer codes, timestamps, IDs and derived research results are stored without application encryption. The server can decrypt; this is not end-to-end encryption. The browser session is the access credential; there is no account recovery. Do not share the device or session cookie.

Retention and deletion

Inactivity period: 180 days, proposed and pending approval. When approved, an automatic hourly purge removes expired live records; service downtime delays the purge until restart. Opening a private session counts as activity. Deletion removes the live profile, documents, extracted facts, results and consent records and severs private audit identifiers. Backups can still contain encrypted documents and unencrypted codes until they expire. Verified backup expiry: not yet verified. Immediate removal from historical infrastructure backups is not claimed.

Your rights and incidents

Use the profile to access and correct answers, export machine-readable JSON and the report to your browser, withdraw consent and delete your data. JSON rights export remains available after withdrawal; generating a research report requires the report permission. Contact the controller for unresolved requests, restriction or portability; you may complain to your competent supervisory authority. If access to the browser cookie is lost, identity verification is needed and recovery is not guaranteed. The controller must assess incidents and, where GDPR applies, notify the authority within 72 hours when required and affected people without undue delay for high risk. This describes the intended procedure, not a completed legal review.

Necessary cookies preserve private and watch sessions for up to 180 days and an explicit corpus preference. Hosting may process IP addresses and request metadata. No analytics or advertising trackers have been added.

Contact / collaboration