Privacy Notice

1. Who we are

Csoportal is an independent platform providing a professional directory of Clinical Safety Officers and a clinical safety management workspace. Csoportal is not an NHS service and does not claim NHS endorsement. For privacy questions, contact the address published on this platform’s contact page.

2. What we collect

• Account data: name, email address, password (hashed), role.
• Directory profiles: professional title, clinical profession, registration body (and optionally registration number, which is never displayed publicly), specialties, expertise, location, biography and availability.
• Enquiries: organisation, contact name, email, product context and the description of support required — sent to the CSO you choose.
• Workspace data: projects, hazards, risk assessments, evidence metadata, actions and safety cases you create.
• Audit logs: records of important actions (who did what, when) for security and accountability.

3. Patient data is not wanted here

The platform is designed for clinical safety management, not clinical records. Do not upload patient-identifiable information or clinical records into this platform. The workspace displays this warning prominently. Hazard descriptions and evidence should be written to avoid identifying individuals.

4. Why we process data

• To provide accounts, the directory and the workspace (performance of a contract).
• To deliver enquiries to the CSO you address them to (performance of a contract).
• To keep the platform secure and auditable (legitimate interests / legal obligations).
• To send service notifications such as new enquiries or profile status changes.

5. AI processing

The AI assistant processes project text you choose to send it (such as product descriptions and hazard details) in order to generate suggestions. AI output is always labelled as a draft requiring CSO review. Do not include patient-identifiable information in anything you ask the AI to analyse. AI is provided by a third-party processor under contract; see the terms page for the current provider list.

6. Sharing

We share enquiry contact details only with the CSO you addressed, by email (replying to that email reaches you directly) and in their dashboard. Directory profiles publish only the fields you choose to make public; registration numbers are never displayed. We use infrastructure processors (hosting, database, authentication, email delivery, AI provider) under data processing agreements. To limit abuse we keep a one-way hash of the sender's network address with each enquiry; the address itself is not stored. We do not sell personal data.

7. Retention

Account and workspace data are retained while your account is active. Enquiries are retained for the CSO’s records unless deletion is requested. Audit logs are retained for security purposes. You can request export or deletion of your data via the contact address.

8. Your rights and GDPR

You have rights of access, rectification, erasure, restriction, portability and objection under UK GDPR. Whether and how Csoportal’s deployment is fully GDPR compliant depends on the operator’s configuration, contracts and operational processes — compliance is not automatic and is not claimed by the software alone. Contact the platform operator to exercise your rights.

9. Security

The platform uses authentication, role-based access control, project-level permissions (row-level security), audit logging and private storage. No system is perfectly secure; report concerns via the contact address.