Data Governance

We collect only the data that is necessary for the platform to function and to achieve its purpose. We do not collect data "just in case" — every data field we request has a clear, specific reason. Demographic information, for example, is collected to support health inequality analysis and is optional where possible.

We process personal data under the following lawful bases as defined by UK GDPR:

• Consent (Article 6(1)(a)): for optional data such as demographic information and analytics cookies.
• Contract (Article 6(1)(b)): for data necessary to provide the service you have requested, such as account creation.
• Legitimate interests (Article 6(1)(f)): for platform security, fraud prevention and service improvement.

Where we process special category data (such as health information from symptom checks), we rely on the explicit consent of the user.

Data is stored on secure servers with encryption at rest and in transit. Access is restricted to authorised personnel on a least-privilege basis. For more detail, see our Security page.

We retain personal data only for as long as is necessary to fulfil the purpose for which it was collected:

• Account data: retained while your account is active and deleted upon request.
• Health interaction data: retained while your account is active to support progress tracking; deleted with your account.
• Analytics data: retained in aggregated, anonymised form for service improvement.
• Audit logs: retained for a defined period for security and accountability purposes.

Where processing is based on consent, users can withdraw consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before withdrawal. Users can manage their consent preferences, including cookie settings, at any time.

We respect the rights of data subjects under UK GDPR, including the right to access, rectify, erase, restrict, object to and port their personal data. For full details, see our Privacy Policy.

CancerPath aims to follow UK GDPR principles and continuously improve its governance processes. As the platform develops and takes on NHS and research partnerships, we will conduct formal governance reviews, update our policies and strengthen our data protection practices in line with evolving requirements.