Privacy policy

What the contact form collects

One thing on this site asks you for anything, and that is the contact form. It collects six fields, four of which are required:

• Full name and work email — so a reply goes to a person, at an address that works
• What is this about — the topic you pick, which decides who reads it
• Message — whatever you choose to write
• Organisation and country — both optional, and useful mainly for working out whether a pilot is even practical

The form will not send until you tick the box that reads “I am happy for MalariaX to store these details in order to reply. We do not add anyone to a mailing list.” That sentence is the whole of what we are asking permission for, and we hold ourselves to the second half of it.

There are no hidden fields. Nothing is appended behind the form — no device fingerprint, no referrer, no marketing identifier, and no lookup of your email address against a third-party database to find out who you are.

What happens when you browse

Nothing is stored on your device

This site sets no cookies and writes nothing to local storage. It carries no analytics, no heatmap, no session recording and no advertising script. There is no consent banner because there is nothing to consent to. That describes the site as it stands on the date at the top of this page; if it ever changes, this policy changes with it and that date moves.

Server logs

Our hosting provider keeps ordinary web server logs: IP address, timestamp, the file requested, the response code, and the user-agent string your browser sends. Those are a by-product of serving a page at all, and we use them to keep the site up and to look into faults or abuse.

Typefaces

Three typefaces load from fonts.googleapis.com and fonts.gstatic.com. Your browser fetches them directly, which tells Google your IP address and user-agent under Google’s own terms. Nothing comes back to us and we cannot see who asked for what. A content blocker will stop the request, and the page falls back to the fonts already on your machine without breaking.

Links out

This site links to a fair amount of other people’s work — the World Health Organization, published papers, public image datasets. Following one takes you somewhere with its own policy, and this one stops applying the moment you leave.

Why we process it, and on what basis

• To answer you. You filled in a form asking us to get in touch, and ticked a box saying so. Basis: your consent, plus steps taken at your request.
• To work out whether a pilot or a collaboration is possible. If a message turns into a real conversation, the same details carry it, and later the agreement covering it. Basis: steps taken before entering into a contract.
• To keep the site running. Server logs, for faults and abuse. Basis: our legitimate interest in a site that works and is not under attack.

Consent given by ticking a box can be withdrawn by saying so, and withdrawing it costs you nothing. We do no profiling and no automated decision-making about you. We do not sell, rent or trade anything collected here, and there is no mailing list to be added to — not as a matter of policy, but because one does not exist.

Who else sees it

What you send through this site reaches:

• Our hosting and email providers, which handle it in the course of serving the page and delivering the message
• The form endpoint, where the form is configured to post to a third-party form service rather than to our own infrastructure
• Professional advisers, on the occasions we need advice on something
• A public authority, where the law requires it and we are satisfied that it does

Each of those acts on our instructions under a written agreement and cannot use your details for its own ends. Nothing goes to an advertising network or a data broker, since we use neither.

How long we keep it

• An enquiry that goes nowhere: deleted within 24 months of the last exchange.
• Correspondence that becomes a collaboration: kept for as long as the work runs, and afterwards for as long as the relevant limitation period requires.
• Server logs: whatever the hosting provider’s ordinary cycle is, typically no more than 90 days.

If you want something gone sooner than that, ask and it will be.

How it is protected

The site is served over HTTPS, and access to anything submitted through it is authenticated and limited to the people who need to read it. We are a small team, which makes that easier to enforce than it would be at scale, and also means there is nobody to hide behind if we get it wrong.

What we will not do is describe our security in terms designed to sound more thorough than it is. If you are evaluating us as a data partner, ask, and you will get a specific answer rather than an adjective.

Your rights

Whatever law applies where you are, you can expect to be told how your data is used, to get a copy of it, to have it corrected if it is wrong, to have it deleted, to object to us processing it, and to withdraw a consent you have given. Where the GDPR or UK GDPR reaches you, the rights to restrict processing and to data portability apply as well.

Exercise any of them by writing to hello@malariax.com. We will not charge you, and we will not ask you to justify the request.

If we handle it badly, you can take it to the data protection authority for your country. We would rather you came to us first, but nothing obliges you to.

Blood films, patient data and research images

No patient data reaches this website. There is no portal here, nothing to upload, and no clinical system behind it. If you are a patient who has had a malaria test, nothing about that test is on this site or in anything it connects to.

The research itself is a separate matter. Blood-film images used to develop and test our models come from laboratories, public datasets and research partners, under data-sharing agreements and the ethics approvals that go with them. Those agreements set what may be transferred, how it is de-identified before it leaves the laboratory, what it may be used for, and when it must be destroyed. They govern that work — this page does not, and cannot vary them.

Where an image originates with a patient, the relationship is with the institution that collected it. That institution decides what happens to it, and a request about it has to go there rather than to us. Tell us and we will pass it on, but we cannot act on it directly.

Changes, and how to reach us

When this policy changes, the date and version at the top of the page change with it. Where a change materially affects details you have already given us, we will write to you about it rather than leave you to notice.

Questions about this policy, or about anything else on this site: hello@malariax.com.