Privacy policy

Who is responsible for your data

This site is run by Rayyan Malik, acting for Cardiff Muslim Medics. For data protection purposes the data controller is Rayyan Malik, contactable at cardiffmuslimmedics@gmail.com.

Cardiff Muslim Medics is a student society, not a company. We keep the amount of personal data we hold deliberately small.

What we collect

Only what a feature needs in order to work:

• Donations: your name, your email address and the amount, so we can thank you, send a receipt and keep an honest record of what the fund has raised. Card details are entered on Stripe and never reach our servers. If you tick the anonymous box, your name is not shown on the public wall, though we still hold it in our own records.
• Joining the alumni network: your name, email address, graduation year, and the preferences you choose. Those details sit in our private list, not on the public site.
• The Alumni Map: your graduation year, career stage, specialty and the hospital or health board you are at, if you choose to add yourself. This is the one thing on this site that is deliberately public, so only add what you are happy for other members to see.
• Advice you share: the text you write. You can submit it without naming yourself, and anonymous advice stays anonymous. Nothing is published until a committee member has reviewed it.
• Getting in touch through the map: your message and your email address, so we can pass the message on.
• Messages you send us through the contact form: whatever you write, plus your email address so we can reply.

How the reach-out relay works

If you contact someone through the Alumni Map, your message goes through us, not straight to them. We forward it by email. This means your email address is not exposed to the other person unless they reply and choose to reveal it, and it means nobody can harvest addresses from the map. We keep the message only as long as it takes to pass it on.

What we do not collect

We do not use Google Analytics, advertising pixels, session recording or heatmaps. We do not build a profile of you, we do not sell or rent your data, and we never share your details outside the society. There is no automated decision making on this site.

We do count page views, using Cloudflare Web Analytics. It records which page was opened, which site you came from, and how quickly the page loaded. It sets no cookie, stores nothing in your browser, and does not give you an identifier, so it cannot follow you between visits or between sites. Cloudflare receives your IP address in the normal course of serving the request and discards it rather than storing it.

Why we are allowed to hold it

For joining the network, the Alumni Map and sharing advice, we rely on your consent. You gave it by filling the form in, and you can withdraw it at any time by emailing us.

For donations, we rely on performance of a contract and on our legal obligation to keep financial records.

For replying to your messages, we rely on our legitimate interest in answering people who write to us.

The services we use

A small number of established providers, each seeing only what it needs:

• Cloudflare hosts the site, provides the anti-spam check on our forms, and counts page views through Cloudflare Web Analytics.
• Supabase stores the database behind donations, the alumni network, the map and site content.
• Stripe takes card payments. Stripe handles your card details directly, as an independent controller under its own privacy policy. We never see or store your card number.
• Resend sends our email: receipts, confirmations and the reach-out relay.
• Google Fonts serves our typefaces. This does not set a cookie, but it does mean Google receives your IP address when a page loads its fonts.

Where your data goes

Some of these providers operate outside the UK. Where personal data is transferred abroad, it is done under the safeguards those providers offer, such as the UK addendum to the EU standard contractual clauses. We have not chosen any provider that lacks such a safeguard.

Page view counts are processed at whichever Cloudflare data centre is nearest to the request, which may be outside the UK. Those counts carry no name, account or identifier, so there is nothing in them that points back to you.

How long we keep it

Donation and payment records are kept for six years, because financial records have to be available for that long.

Your entry in the alumni network and on the Alumni Map is kept until you ask us to remove it.

Published advice is kept while it is still useful. Ask and we will take yours down.

Messages and reach-out relays are kept only as long as it takes to deal with them, then deleted.

Your rights, and how to use them

Under UK GDPR you can ask us for a copy of the data we hold about you, ask us to correct it, ask us to delete it, ask us to restrict what we do with it, object to us holding it, or ask for it in a portable format.

To do any of these, email cardiffmuslimmedics@gmail.com with what you want. You do not need to give a reason, and there is no charge. We will reply within one month.

To be taken off the map or out of the network, email us and say so. We will remove you and confirm when it is done. Donation records connected to you are kept for the six years described above, because we are required to.

If you are not happy with how we have handled your data you can complain to the Information Commissioner’s Office at ico.org.uk, but we would rather you told us first so we can fix it.

Children

This site is for medical students, doctors and alumni. It is not aimed at children, and we do not knowingly collect data from anyone under 13. If you think we have, tell us and we will delete it.

Changes

This policy was last reviewed on 13 October 2026. If we change it in a way that affects you, we will say so on this page rather than change it quietly.