PsyMetRiC Privacy Policy

This privacy notice explains how we handle personal information when you use the PsyMetRiC web app.

Who we are

Registered manufacturer and copyright holder: University of Birmingham Enterprise Ltd.

PsyMetRiC is a clinical risk calculator (UK Class I Software as a Medical Device).

For academic use of the underlying algorithm, eligible researchers can apply for a free academic licence via this licensing page.

Contact Details

To contact the PsyMetRiC team, please use the feedback form available in the app.

If you wish to exercise your data protection rights (see below), you can also use the same feedback form and state that your request relates to data protection.

What information we collect and why

• Calculator inputs (patient/predictor information): Information entered to generate a risk score is transmitted securely to our server, processed transiently to produce the output, then discarded. No inputted patient-identifiable data are stored or shared. We do not store patient-level outputs (risk scores) or patient-level usage logs that could reconstruct predictions.
• User accounts (for access control only): To control access to the PsyMetRiC user interface (for authorised users), we store: username, email address, password hash (no plaintext passwords), an admin flag (if applicable), and an optional account expiry date.
• Password reset: If you request a password reset, we send an email containing a tokenised link. Our messaging is designed to reduce account enumeration (it does not confirm whether an email/account exists).
• Remember this computer (optional): If you choose this option, a persistent token is stored in your browser (localStorage). Our server stores a token selector plus a hashed validator, an expiry time, and revocation state. The token lifetime is 30 days. Logging out revokes the token and clears the browser storage.
• Feedback: You may submit feedback through an encrypted web form, optionally including your name or email address.
• Service / safety emails (registered users): If you create a user account, we use your account email address to send infrequent messages that are necessary for safe and correct use of PsyMetRiC and to support security and regulatory compliance (e.g., critical updates that affect functionality or interpretation, safety notices, and account/security messages). These are not marketing emails.
• Mailing list (optional): If you opt in, we collect your email address via MailerLite to send routine updates. You can unsubscribe at any time.
• Server logs: We collect limited technical data (including IP address and basic request information) to operate and secure the service. Logs are reset every 24 hours and do not include any clinical inputs.
• Analytics: We use PostHog to track anonymised page and tab usage to help improve usability and functionality. No patient data or calculator inputs are ever captured.

Lawful Bases

• Risk calculator inputs (including health-related information): Explicit consent (by choosing to use the tool). Special category data: explicit consent under UK GDPR Article 9(2)(a).
• User accounts (access control): Legitimate interests (to provide controlled access and manage authorised use of the app).
• Password reset emails and security tokens: Legitimate interests (to secure accounts and enable account access).
• Service / safety communications to account holders: Legitimate interests (to support safe use of the device, communicate critical changes, and provide essential service/security notices).
• Feedback: Legitimate interests (to respond to issues and improve the service).
• Mailing list (routine updates via MailerLite): Consent (you can unsubscribe at any time).
• Server logs (security/operations): Legitimate interests.
• Analytics: Consent (via cookie banner).

How long we keep information

• Calculator inputs and risk outputs: Not stored.
• Server logs: Reset every 24 hours (and do not include clinical inputs).
• User account data: Kept for as long as your account remains active. If your account is deleted, we will delete or anonymise account data unless we must retain limited information for legal or security reasons.
• Password reset tokens: Stored only for as long as needed to complete the reset process, then expire.
• “Remember this computer” tokens: Up to 30 days, or until revoked (e.g., on logout).
• Feedback: Securely retained for up to 10 years for regulatory compliance (unless you request deletion where applicable).
• Mailing list: Retained until you unsubscribe (or request deletion).

Who we share information with

We use the following GDPR-compliant data processors:

Mailerlite

Provides mailing list functionality.

SMTP2GO

Used to send operational emails from the app (e.g., password resets and safety/service communications to registered users).

Jotform

Hosts our feedback form. Data is encrypted and stored in the EU (ISO 27001 certified).

PostHog

Self-hosted analytics platform. We collect only anonymised usage events (page views, tab interactions). No health or calculator input data are sent to PostHog.

Cloudflare

Provides security and perimeter services (e.g., reverse proxy/WAF). This may involve processing technical data such as IP address to deliver and protect the service.

Analytics and Cookies

We use PostHog to understand general usage patterns and improve the app’s usability and functionality. This includes anonymised data such as page visits and tab interactions only.

No risk calculation data or user-submitted health information is ever collected by PostHog.

Our app includes a cookie banner (via Civic Cookie Control) to request your consent before enabling analytics cookies. You can change your cookie preferences at any time using the banner settings.

International Transfers

Where needed, personal data may be transferred outside the UK in line with the UK GDPR and appropriate safeguards.

Your Data Protection Rights

Under data protection law, you have the right to:

• Access your personal data
• Request correction or deletion
• Object to or restrict processing
• Withdraw consent
• Request data portability

You do not need to pay a fee to exercise these rights. If you make a request, we have one calendar month to respond.

Withdrawing consent applies to optional processing such as the mailing list and analytics cookies; essential service and safety emails to registered account holders are not marketing and are sent only when necessary.

How to Complain

If you have concerns about our handling of your data, please contact us first. If you are not satisfied, you can complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk/make-a-complaint

Last updated: 29 December 2025