Campaign privacy notice

How we use NHSmail feedback

This notice explains how Doctors' Association UK handles information submitted through the NHSmail evidence form at nhsmail.dauk.org.

Last updated 9 August 2026

Who is responsible for the information

Doctors' Association UK (DAUK) is the data controller for personal information collected through this form. For data protection questions or requests, email contact@dauk.org.

Why we are collecting it

We are gathering evidence about NHSmail joiner and leaver changes, account continuity and related impacts on doctors. We may analyse responses, identify recurring themes, prepare aggregated findings, make representations to NHS England or other relevant bodies, and use evidence in DAUK campaigning.

What we collect

We collect the professional and operational information you enter in the form, including your role or grade, working arrangements, NHS organisation, the type and timing of the NHSmail issue, its impact, and your written account.

If you choose a named response, we also collect the name and email address you provide. If you choose anonymous submission, the form does not ask for your name or email and the submission record is designed not to contain a direct identifier.

Please do not provide patient identifiable information. Avoid naming individual colleagues unless it is essential to understanding the issue.

Our legal basis

For collecting and analysing campaign evidence, DAUK relies on its legitimate interests in understanding issues affecting doctors, representing those concerns and informing its campaigning and policy work. We have designed the form to minimise the amount of personal information needed.

Permission for DAUK to contact you and permission to use anonymised extracts are optional, separate choices. You can submit a named response without agreeing to either.

Anonymous responses

We do not deliberately add IP addresses, browser identifiers, user agent strings or device fingerprints to the feedback submission record. Please remember that information you write in free text can itself identify you if the circumstances are very distinctive.

Our hosting providers may process technical request information, which can include IP addresses, in security and operational logs. DAUK does not use those logs to identify people who select anonymous submission.

Who processes the data

The public website and submission endpoint are hosted using Vercel. Submission records are stored in an isolated Supabase database. These providers process data on DAUK's behalf to provide hosting, security and database services.

We do not use advertising trackers on this microsite and we do not add third party analytics cookies to the form.

How long we keep it

Identifiable submissions will normally be retained for no more than 12 months from submission and may be deleted earlier when they are no longer needed. DAUK may retain aggregated statistics or information that has been irreversibly anonymised for longer as part of its organisational and campaign record.

Sharing and publication

DAUK may use aggregated findings in meetings, correspondence, briefings, campaigning and media work. If you give permission for anonymised extracts, DAUK may quote parts of your response after removing direct identifiers and taking reasonable steps to reduce the risk that context identifies you.

We will not publish your name or email simply because you chose a named submission.

Your rights

Where UK data protection law applies to your information, your rights can include access, correction, erasure, restriction and the right to object to processing based on legitimate interests. The availability of a particular right depends on the circumstances and the nature of the data.

To exercise a right, contact contact@dauk.org. For an anonymous submission, DAUK may be unable to locate your response unless you can provide enough information to identify it without requiring us to collect additional identifying data.

Further information and complaints

This campaign notice supplements the main DAUK privacy policy. If you are unhappy with how DAUK handles your personal information, contact us first if you are comfortable doing so. You also have the right to complain to the Information Commissioner's Office.