## Privacy policy This document explains how and why your personal information (also known as ‘personal data’) is collected and handled when you use the AVID Community and the Service. - Your right to privacy is important. - The security of your information is taken seriously and there are policies and processes in place to ensure that your data is safe. ### Why will your personal information be processed? THIS Institute, part of the University of Cambridge, has established the AVID Community for the purposes of supporting collaborative exploration and evaluation of ambient voice technology (AVT). THIS Institute has contracted Thiscovery, run by THIS Labs Ltd, to provide the technical platform to host the AVID Community. ### Key facts: - THIS Institute controls your personal data (it is the “data controller”), and Thiscovery handles this information on behalf of THIS Institute (it is the “data processor”). - [Thiscovery privacy policy](https://www.thiscovery.org/privacy-policy),  including its [Cookies settings](https://www.thiscovery.org/privacy-policy) generally describes the way information is collected, used, and protected on the Thiscovery platform. - The University of Cambridge [data protection notice](https://www.cam.ac.uk/about-this-site/privacy-policy) provides general information on how the University of Cambridge,  through THIS Institute,  uses your personal information. For specific information about how information will be used in this community, please see below. ### Who is responsible for processing your personal  information? Under data protection legislation, THIS Institute is **Data Controller** as it has determined the purpose and means for the processing of your personal information. This means that THIS Institute is responsible for making sure your personal information is kept secure, confidential and used only in the way you have been told it will be used. THIS Labs provides the technical platform (Thiscovery) for the AVID Community and is the **Data Processor** of your personal information on behalf of THIS Institute. THIS Labs are responsible for making sure your personal information is kept secure, and confidential. ### What information will be processed about you? To take part in this community THIS Institute will need to collect information that could identify you, called “personal information” or “personal data”. The following personal information from you will be handled for the running of the community: - Full name, Professional role/title, Organisation/affiliation, Work email, Country, that you will input during the registration process - Optional personal information you may wish to add to your profile page - Personal information you may add, but are not asked to add, to your posts, comments and responses and other contributions you may make on the community. You must be mindful that some of the information that you provide while participating in discussions could be considered as health data or other data that would be classed as Special Category data under the UK General Data Protection Regulation (UK GDPR). For example, this may include data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or concerning sexual orientation. By providing such sensitive data, you agree to their processing by the community in the conditions set forth in this Privacy Notice. ### Who can see your personal information? **Other community members** can see: - Your name, job title and organisation - Information you choose to make public in your profile - Personal information you choose to include in your posts and comments you make in discussions **THIS Institute** can see all community data to run the community. This includes your profile, posts, and activity data to let you take part in the community, help useful discussions, share experiences, address challenges, and co-develop resources relating to ambient voice technology. **THIS Labs/Thiscovery technical team** can see your data to maintain the platform and provide support. This access is logged and controlled. **Your personal data is not shared with other organisations** unless: - You give specific permission - THIS Institute or Thiscovery have a legal duty to share it ### What is the lawful basis for processing your personal information? The personal data gathered at the point of joining the community (Full name, Professional role/title, Organisation/affiliation, Work email, Country) is gathered on the basis of your consent, which can be withdrawn at any time. When you withdraw consent for us to use your personal data will be removed from our systems but we may not be able to remove data that has already been reported on or aggregated. Any personal information you may include in your contributions to the community (for example, information you submit as part of discussions with other members of the community on notice boards or when prompted to review materials within a community) is processed on the basis of the legitimate interests of THIS Institute, and on the basis of a public interest task by THIS Institute. ### How will your personal information be looked after? Only THIS Institute community administration team and the Thiscovery admin and technical team will have access to the personal information you provide. We will only use this to manage and support the community. We take appropriate technical and organisational measures to ensure that your personal information is secure, accurate and up to date, and that it is only kept as long as is reasonable and necessary. Measures to keep your data secure include: - Secure UK-based AWS servers - Cyber Security Essentials Plus certification - Data scrambled when stored and moved - Extra security checks when logging in - Regular security monitoring - Secure backup systems - Staff trained in data protection - Strict access controls - Robust data processing agreements between THIS Institute and THIS Labs - Regular security reviews - Privacy settings you control - Content checking tools Although THIS Institute and Thiscovery use appropriate security measures once we have received your personal information, the transmission of information when you submit it over the internet is never completely secure. We do our best to protect personal information, but we cannot guarantee the security of information transmitted to the AVID community website, so any transmission is at the user’s own risk. Information on how Thiscovery will process your personal information is available on Thiscovery’s [privacy policy.](https://www.thiscovery.org/privacy-policy) ### Will your personal information ever be shared? - Thiscovery and THIS Institute will never share personal information in any way not described in this community Privacy Policy or in Thiscovery’s [privacy policy](https://www.thiscovery.org/privacy-policy). - Information provided within a community may be useful to better understand how to run the community or to develop understanding of the work of the community, so such information may be used to inform continuous improvement. - Some of the information we gather from you (including discussions within the community) may be used by THIS Institute to facilitate healthcare innovation and improvement programmes, including the evaluation of such programmes. In this case, all information will be fully anonymised, meaning that we will remove your name, location and any other identifying information (for example, names of NHS trusts, place names), and any other indirect identifying information (such as specific details about health or experiences). ### How long will your information be held? THIS Institute and Thiscovery will not keep personal data longer than is necessary for the purpose or purposes for which they were collected. - **Community membership data** will be held for the duration of your membership plus 2 years - **Community posts and discussions** will be permanently as part of the community knowledge base - **Technical logs** will be held for a maximum of 2 years After these time periods, THIS Institute and Thiscovery will securely delete your personal data or make your data anonymous. If you choose to de-register from the community and de-activate your account, we will take all reasonable steps to destroy, or erase from our systems, all personal data that is no longer required. ### What are your rights? You can contact THIS Institute [avtcommunity@thisinstitute.cam.ac.uk](mailto:avtcommunity@thisinstitute.cam.ac.uk) at any time to: - Get a copy of your personal data - Correct any personal data about you that may be wrong - Ask us to delete your personal data - Ask us to pause handling your personal data while we sort out problems - Get your personal data in a format you can take elsewhere - Object to certain types of handling your personal data - Withdraw consent ### Who do you contact? - For questions about the running of the community or handling of your personal data contact the community administration team at THIS Institute at [avtcommunity@thisinstitute.cam.ac.uk](mailto:avtcommunity@thisinstitute.cam.ac.uk) - For technical problems or questions about the platform: [help@thiscovery.org](mailto:help@thiscovery.org) - For security questions about the platform: [security@thiscovery.org](mailto:security@thiscovery.org) - If further support is needed: - Data handling complaints: Contact the University’s data protection team for most complaints [data.protection@admin.cam.ac.uk](mailto:data.protection@admin.cam.ac.uk). If the complaint is serious or requires escalation please contact the Data Protection Office ([dpo@admin.cam.ac.uk](mailto:dpo@admin.cam.ac.uk)). - Independent complaints: Information Commissioner's Office at [ico.org.uk](http://ico.org.uk) or 0303 123 1113 ### Technical details **Software:** Open-source HumHub platform **Hosting:** Thiscovery's secure AWS servers in the UK **Security:** Cyber Security Essentials Plus certified **Data location:** All data stored in the UK **Data processing agreement:** Thiscovery handles your personal data under a services contract with THIS Institute that requires Thiscovery to: - Handle your personal data only following THIS Institute's instructions - Warrant proper security measures - Help with your data rights - Delete your personal data securely when the contract ends - Submit to regular checks to make sure the rules are being followed ### If something goes wrong If there's a security problem affecting your personal data: 1. Thiscovery will inform THIS Institute immediately (within 24 hours) 2. THIS Institute will check if you and the Information Commissioner need to know 3. If there's high risk to your rights, we will inform you promptly 4. Thiscovery will take immediate steps to reduce any impact and fix the problem 5. Thiscovery and THIS Institute will provide guidance on protecting yourself if needed ### How can you find out more about how your personal data is used? - The University of Cambridge [privacy notice](https://www.information-compliance.admin.cam.ac.uk/data-protection/research-participant-data) describes how THIS Institute uses personal data and explains how you can contact them. - Thiscovery's [privacy notice](https://www.thiscovery.org/privacy-policy) describes how Thiscovery uses personal data and how you can contact them. - For further information the Information Commissioner's Office may be helpful: [https://ico.org.uk](https://ico.org.uk) Last updated: 19th November 2025