How INSPIRE uses your personal data, and the choices you have. Last updated 11 November 2026.
The short version
We only ask for what we need to run your account and the conference.
Only the INSPIRE committee can see it, and each member sees only what their role needs.
We never sell your data, and we don't use advertising or tracking cookies.
You can download or delete your data yourself, at any time.
1. Who we are
INSPIRE National Medical Research Conference (“INSPIRE”, “we”) is organised by a committee of students at Lincoln Medical School. The INSPIRE committee decides how and why your personal data is used, so it is the controller under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
For anything about your data, contact the committee through our contact form. We'll reply within one month.
2. What we collect, why, and for how long
Every use of your data needs a lawful basis. Here is each thing we collect, what we use it for, the basis we rely on, and when we delete it. When we rely on legitimate interests, we have checked that our use is necessary and doesn't override your rights.
Account details: name, email, password (stored only as a secure hash), university, stage, course, and the account type you choose
Why
To create your account, check who is attending and give you the right access
Lawful basis
Contract: we need these details to provide the account and your place at the conference
Kept until
Until you delete your account, or 12 months after the conference if it isn't used again
Committee position or presentation title
Why
So the executive committee can confirm your role before switching on committee or presenter access
Lawful basis
Contract
Kept until
As for your account
Account review: the decision (approved, waitlisted or declined), any note to you, and who made it
Why
To manage places fairly, run the waitlist and keep an accountable record
Lawful basis
Legitimate interests in running a fair, well organised event
Kept until
As for your account
Your ticket and check-in time
Why
To let you in on the day and know who is in the building in an emergency
Lawful basis
Contract, and legitimate interests in safety
Kept until
Until 31 March 2027
Slides, posters and the feedback on them
Why
So the committee can review your work, give feedback and run your session
Lawful basis
Contract
Kept until
Until 31 March 2027, then deleted. Feedback is deleted with the file
Access and dietary needs
Why
To make arrangements for you on the day
Lawful basis
Your explicit consent (Article 9(2)(a)), which you can withdraw at any time
Kept until
Until 28 February 2027, or straight away if you withdraw consent
Your photography preference
Why
So our photographers know not to photograph you
Lawful basis
Legitimate interests in respecting your wishes
Kept until
As for your account
News about future INSPIRE events
Why
To tell you about future conferences
Lawful basis
Your consent, only if you tick the box. You can stop at any time
Kept until
Until you withdraw consent or delete your account
Messages you send through the contact form
Why
To reply to you
Lawful basis
Legitimate interests in answering enquiries
Kept until
12 months after the enquiry is closed
A record of what you agreed to, with the date and the version of this notice
Why
To show we have your consent where the law requires it
Lawful basis
Legal obligation (UK GDPR Article 7(1))
Kept until
As long as the consent it relates to, plus 12 months
A security log of changes made through the committee dashboard
Why
To keep your data safe and find out what happened if something goes wrong
Lawful basis
Legitimate interests in security, and our duty to keep data secure
Kept until
24 months
We don't make decisions about you by automated means alone. Every account is reviewed by a person. We don't collect data from anyone else about you, except a committee member updating your account type if you've been accepted to present.
The conference is for adults. Please don't register if you are under 18.
3. Access and dietary needs
Details about access or diet can reveal something about your health or religious beliefs. UK GDPR calls this special category data and protects it more strongly. So:
We never ask for it when you register. You can add it later from your account, only if you want to.
We only store it after you tick a box giving your explicit permission, and we record when you did.
Only the executive committee can see it, and we share only what's needed with the venue to make arrangements for you.
You can withdraw permission in one click. The details are deleted straight away.
Otherwise we delete it by 28 February 2027.
4. Who can see your data
Access is set by role and enforced by the database itself, not just the website:
You see everything about yourself.
Supporting committee members see slides and posters with the presenter's name, so they can review them. They can't see anyone's email or profile.
The executive committee, vice president and president see account details to review accounts, manage the waitlist and run check-in.
Other attendees see nothing about you.
We won't share your data with anyone else unless the law requires it, for example if the police make a valid request.
5. Companies that help us
These companies run parts of the website for us. They act only on our instructions, under data processing agreements, and can't use your data for their own purposes.
SupabaseDatabase, sign-in and private file storageThe region chosen for our project, shown here once confirmed
VercelHosts the websiteUSA, with public pages cached worldwide
ResendSends our emails, including sign-up and password emailsUSA
CARTO and OpenStreetMapMap images on the campus map. They receive your IP address when the map loadsEU and USA
When you tap “Walking directions” on the campus map, Google Maps or Apple Maps opens and their own privacy policy applies.
6. Data outside the UK
Some of these companies are based in, or use servers in, the USA. Where that happens, your data is protected by the UK International Data Transfer Addendum to the EU Standard Contractual Clauses, or by the UK Extension to the EU-US Data Privacy Framework where the company is certified. You can ask us for a copy of the relevant safeguards.
7. Keeping it safe
Everything is encrypted when it travels over the internet, and stored data is encrypted at rest.
Passwords are stored only as secure hashes. Nobody at INSPIRE can see your password.
Slides and posters are kept in private storage. Download links expire after 30 minutes.
Your ticket's QR code holds a random reference number only, never your name or email.
Changes made in the committee dashboard are logged, and the log records which fields changed, not their contents.
If something goes wrong that puts your data at risk, we'll tell the Information Commissioner's Office within 72 hours where required, and tell you if there's a high risk to you.
8. Your rights
You have the right to the following. Most you can do yourself, straight away. For anything else, contact us and we'll respond within one month. It's free.
See your data
Download a copy of everything we hold from Profile and privacy, or ask us for it.
Correct it
Edit your details in your account at any time, or ask us to fix anything you can't change.
Delete it
Delete your account yourself from Profile and privacy. Everything linked to it goes too.
Take it elsewhere
The download is a standard JSON file you can open or give to another organisation.
Object or restrict
Ask us to stop using your data, or pause using it while a concern is looked into.
Withdraw consent
Switch off news emails or remove your access needs in your account. This doesn't affect anything before you withdrew.
9. Cookies and storage
We use only what the site needs to work: a sign-in cookie that keeps you logged in, and storage in your browser that remembers sessions you've saved. We don't use analytics, advertising or tracking cookies, so we don't need to ask for cookie consent. Read the cookie policy for details.
10. Questions and complaints
If you have a question or concern, please contact us first through our contact form and we'll do our best to help. You also have the right to complain to the Information Commissioner's Office, the UK's data protection regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.
Changes to this notice
If we change how we use your data, we'll update this notice and the date at the top. If a change affects something you agreed to, we'll tell you and ask again. This is version 2026-11-11.
