Your information. Your choice. Your control.

Who is responsible for your information?

For the LymphAware ID service, LymphAware ID determines why and how personal information is processed and acts as the data controller.

For privacy questions, requests or concerns, contact admin@lymphawareid.com.

LymphAware ID is a communication and identification aid for people living with lymphoedema. It is not a medical-record system and does not provide diagnosis or replace professional medical advice.

Why we use your information

We use account, order and service information to create and manage your account, provide the membership and card services you request, take and fulfil orders, provide support and protect the service.

For processing that is necessary to provide the LymphAware ID service you have requested, our lawful basis under Article 6 UK GDPR is performance of a contract. Where we must retain information to meet tax, accounting or other legal requirements, we may rely on legal obligation.

We may rely on legitimate interests for proportionate service-security, fraud-prevention and support activities, and for processing minimal emergency-contact information so that a member can nominate someone who may be contacted when appropriate. We balance those interests against the rights and interests of the people concerned.

Additional languages

Automated translation

If you choose an additional-language package, selected patient-written fields from your main English profile may be processed automatically using OpenAI through Netlify AI Gateway to prepare the translated version.

We ask for separate, explicit agreement before this translation processing is used. The automated translation is not presented as a clinical or professional translation. Keep your English source profile accurate and contact LymphAware ID if translated wording appears incorrect.

International transfers

Some service providers or their subprocessors may process personal information outside the United Kingdom. Where UK personal information is transferred internationally, we review the provider’s contractual arrangements and rely on recognised transfer mechanisms and safeguards where required, such as adequacy arrangements, the UK Extension to the EU-US Data Privacy Framework, Standard Contractual Clauses and the UK International Data Transfer Addendum, depending on the provider and transfer.

Our provider arrangements should be reviewed periodically because providers, subprocessors and transfer mechanisms can change.

How long we keep information

Account and membership information: normally while the account/membership is active and for only as long afterwards as needed for administration, legal claims or other lawful purposes.

Health-profile information: while you choose to keep it in your profile and the relevant processing condition remains active. Withdrawing health-data consent removes the health-profile information covered by that withdrawal from the active service.

Consent/privacy records: retained as an accountability record for a proportionate period after the relevant processing ends.

Orders and financial records: retained for the period required by applicable tax and accounting rules, which may be several years.

Pre-launch interest list: We retain confirmed contact details only for the launch and related updates you requested, subject to periodic review. We will review the list within 90 days after launch and delete or anonymise entries no longer needed. You can withdraw email consent at any time using an unsubscribe link, or by contacting admin@lymphawareid.com. Limited suppression information may be retained to prevent further unwanted messages. General suggestions are reviewed and deleted when no longer needed.

Support enquiries: kept only as long as reasonably needed to resolve the issue and maintain an appropriate service record.

Deleted information may remain temporarily in protected service-provider backups until normal backup rotation removes it.

Security and breaches

LymphAware ID uses access controls, authenticated member accounts, database row-level security and service-provider security controls to protect information. No online system can remove all risk, so security is reviewed as the service develops.

We maintain an internal process for recording, assessing, containing and responding to personal-data breaches and for notifying the Information Commissioner’s Office and affected individuals where the legal thresholds require it.