Privacy notice

The data controller is Pulmonary Hypertension Association UK (PHA UK), registered charity 1120756 and company 06268494.

Email office@phauk.org or telephone 0300 373 5367 with a data-protection question or request.

The form’s opening information and privacy link identify its controller. Together Events is a separate organisation and controller; this PHA UK notice does not apply to a Together Events form. A Together Events form will not be published through sPHere Forms until its own approved privacy notice is available and linked before the first question.

Each form shows a short data-protection summary before you start. It states the form’s purpose, the Article 6 lawful basis PHA UK relies on, whether it asks for special-category information, the relevant Article 9 condition, and how long the submitted record is kept.

Depending on the form, information may include your name and contact details, answers you provide, documents you upload, and booking or payment details. PHA UK will not publish a form that asks for health, disability, dietary, access, bank-account, identity-document or other restricted information unless the form has passed a separate legal, contractual and security review.

Unless a form specifically asks for restricted information and explains why, please do not include it in a free-text answer or upload.

We do not sell form answers, use them for advertising profiles, or make legal or similarly significant decisions about you solely through sPHere Forms.

Your browser may keep an in-progress copy for the current form. Where a form requires consent, neither the browser copy nor the server draft is saved until you give it. You can change your answers before submitting.

• Inactive server drafts are deleted after 7 days.
• Uploads attached to an unfinished draft are kept while that draft is (at most 7 days); uploads never attached to a draft are deleted after 24 hours.
• A salted hash of the network address may be used for abuse prevention. The raw address is not stored in the Forms database. An expired counter is removed by the next daily cleanup.
• Technical submission log entries are deleted after 12 months.

PHA UK configures its primary database and file storage to run in London, United Kingdom. Application requests are processed by its contracted hosting provider and may pass through global content-delivery and routing infrastructure. PHA UK assesses those locations and safeguards before releasing a form. Information is encrypted while it travels between your browser, the application and storage. Uploaded files are kept in private storage and are served through controlled application routes.

PHA UK uses specialist suppliers to run and protect the service. During the controlled hosting migration, the application may be served by Vercel or Hostinger. Supabase provides database and file storage, and Sentry provides privacy-filtered error monitoring. A particular form may also use n8n, Microsoft 365 or Twilio for confirmations, messages or workflow processing. The form or its data-protection summary will identify any material additional use.

Where a form has Bot protection enabled, PHA UK uses Cloudflare Turnstile at submission to distinguish likely people from automated traffic. It processes limited network and browser security signals, including the IP address, TLS fingerprint, user-agent details, public site key and form hostname. PHA UK does not send your form answers to Turnstile. PHA UK relies on its legitimate interests in protecting the availability, authenticity and integrity of the service for this security processing.

Cloudflare acts as PHA UK’s processor when it uses those signals to protect the form. Cloudflare also states that it acts as a controller when it uses the limited signals to improve Turnstile’s bot detection. Turnstile is not used for advertising and any storage or access technology configured by PHA UK is limited to what is necessary for the security check. Read Cloudflare’s Turnstile privacy information (opens in a new tab).

Some suppliers or their approved subprocessors may support the service from outside the UK. PHA UK assesses those transfers and records the applicable contractual safeguard before the supplier is approved for respondent data.

Access is limited to authorised PHA UK staff and approved service providers who need it for the purpose stated on the form. We may disclose information where the law requires it, to protect someone’s vital interests, or to establish or defend legal claims.

The retention period for the real record created by a form is stated in that form’s data-protection summary. Different records need different periods, for example an event enquiry and a financial record. When the period ends, PHA UK securely deletes or anonymises the information unless a legal hold or legal obligation requires it to be kept longer.

Depending on the lawful basis and circumstances, you may have rights to access, correct, erase, restrict or receive your information, and to object to its use. Where PHA UK relies on consent, you can withdraw it at any time without affecting earlier lawful use.

Contact office@phauk.org to exercise a right. We may need to confirm your identity before acting on a request.

You can also complain to the Information Commissioner’s Office (opens in a new tab). We would appreciate the chance to resolve your concern first.

A form aimed at children or people who may need extra support must use appropriate language and safeguards and receive a separate data-protection review before publication. If you are unsure whether a form is suitable for you, contact PHA UK before sending sensitive information.

We review this notice and the sPHere Forms data-protection assessment when the service, suppliers or law changes. We will show a new date here and bring a material new use to the attention of affected people before it starts.