Privacy Policy

This is the privacy policy for the Healthcare Creators Collective at healthcarecreators.co.uk. It covers the public website, the application and onboarding flows, the creator dashboard, the community directory, and the tools we use to run the collective.

It explains what personal data we collect, why we collect it, who we share it with, how long we keep it, and the rights you have over your data under UK GDPR.

Healthcare Creators Collective Ltd ("HCC", "we", "us", "our"), a UK-registered company, is the data controller. The brand we use day-to-day is "Healthcare Creators Collective" or "HCC".

For privacy questions, email hello@healthcarecreators.co.uk.

We collect different things at different points in your relationship with HCC. Each of these sits in our database under your application or profile and is only accessed by HCC team members for the purposes described in the next section.

3.1 When you apply to join

• Full name, email address, phone number
• Your profession (or that you're a student, plus course and year)
• Your social media handles and self-reported follower counts
• The content niches you create about
• A short motivation paragraph about why you're joining

3.2 When we accept you and you onboard

• Your answers to the onboarding survey (different fields for VIP and Emerging Creator tracks)
• Evidence of professional registration or student status (a screenshot of the GMC / GPhC / NMC / HCPC / GDC register, or your university/student ID)
• An optional screenshot of your platform analytics
• Your chosen password (stored as a hash - we never see the plain text)

3.3 When you use the dashboard

• Edits you make to your profile
• Standard server logs for security and debugging

3.4 Cookies

We use only essential cookies. Details in our Cookie Policy.

3.5 When you browse the public site

We count how the public pages are used, anonymously, so we can improve them. For each visit we record:

• Which pages were opened, for how long they were on screen, and how far down they were read
• The name of the website that sent you (for example instagram.com), never the full address you came from
• Any campaign tag in the link you followed
• Which of our buttons and links you pressed, and which events and questions you opened
• Whether you started one of our forms, how far through it you got, and whether you sent it, but never what you typed
• Whether the screen was phone, tablet or desktop sized

A visit is identified only by a random number that exists while the page is open and is never stored on your device. We do not record your IP address or device details, and none of this can be linked to you or to an application you send. If your browser sends a Do Not Track or Global Privacy Control signal, nothing is recorded. Signed-in areas of the site are never counted.

3.6 When you register for one of our events

Our event tickets are handled by Eventbrite. When you register, Eventbrite passes us your registration:

• Your name and email address
• Your answers to the event's registration questions
• Whether you cancelled, and whether you checked in on the day

We keep this with the event so we can run it, show members the events they have registered for on their dashboard, and understand who our events reach. If you are not a member, we use your email only for that event, unless you agreed to hear from us when you registered.

3.7 When you connect your social media accounts

As a member you can connect Instagram, Facebook (a Page), TikTok or YouTube from your dashboard. You sign in on the platform itself and choose to share with us. We then read, and check once a day:

• Your username and your follower or subscriber count
• Your profile picture. If you haven't added a photo of your own, it becomes your HCC photo (your Instagram picture first), and you can choose another connected account's picture instead
• The account statistics the platform shares, such as reach, views and engagement
• Who your audience is, where the platform shares it: the share by gender, age range and country, as totals only, never anything about a single follower
• Your most recent posts or videos: their title, picture, link, and view, like and comment counts

We use this to show you your own analytics on your dashboard, to keep the follower numbers on your HCC profile accurate, and so the HCC team can match you with brand opportunities and plan events and workshops that suit you (section 4). We never post, message or change anything on your accounts. The access the platform gives us is stored encrypted. You can disconnect an account at any time from your profile, which deletes that access and our copy of its profile picture straight away; to delete the statistics we have kept too, email us (section 7). Removing HCC from the apps connected to your Instagram or Facebook deletes our access too, and asking them to send us a deletion request deletes the statistics as well (data deletion).

• To decide on your application: review reach, content fit, and professional standing before accepting you.
• To run the community: send acceptance emails, add you to the right WhatsApp group, run events and workshops, and tell members about new events (you can turn event emails off in your dashboard settings).
• To match you with brand opportunities: so the opportunities we bring you fit your profession, content and audience.
• To verify professional credibility: HCC commits to a trusted, vetted network. Registration evidence is the basis for that.
• To improve HCC: we look at onboarding answers together, never one person's, to decide what to offer.
• To improve the public site: anonymous counts of how its pages are used (section 3.5).

Our legal basis is consent (which you give when you submit the application form and complete onboarding), and legitimate interest in operating the collective.

We don't sell your data and we never share it with brands without your explicit consent on a per-opportunity basis. Inside HCC, only the small reviewer team can see full applicant data.

Our database, sign-in and file storage are in the UK, and the parts of the website that handle your data run in London. Email delivery and our team inbox use providers based in the United States. Each provider is bound by a data processing agreement and uses encryption in transit and at rest.

Eventbrite runs our event registration as its own service, under its own privacy policy, and shares each registration with us (section 3.6).

When you connect a social media account (section 3.7), you sign in with Meta (Instagram and Facebook), TikTok or Google (YouTube) under their own privacy policies. We do not send them anything about you.

We keep your data for as long as you're an active member. If you leave or ask us to delete it, we remove it within 30 days. Email delivery logs at our email provider are retained for around 30 days for diagnostics.

Under UK GDPR you have the right to:

• Access the personal data we hold about you
• Correct it if it's wrong
• Ask us to delete it
• Object to or restrict our processing of it
• Port your data to another service
• Withdraw consent at any time

To exercise any of these, email hello@healthcarecreators.co.uk. We respond within 30 days.

You also have the right to complain to the UK Information Commissioner's Office (ICO) at ico.org.uk.

All data is encrypted in transit and at rest. Passwords are stored as hashes - we never see them. Uploaded files are kept private. Admin access is per-person, not shared.

Some of our providers are based in the United States. Where your data leaves the UK, it is protected by the UK's approved safeguards (the UK-US data bridge or the UK's standard contract terms).

We'll update this page if our data practices change. The "last updated" date at the top tracks the most recent change. If a change is significant, we'll let active members know by email.

Questions, concerns, or data requests: hello@healthcarecreators.co.uk.