Privacy Policy

1. Who we are

CEFREF is an electronic headache diary designed to help users record and review information about their headaches and use of headache medication.

CEFREF is operated by:
Ceftronics Limited
Studio 9
50–54 St Paul’s Square
Birmingham
England
B3 1QS

Company number: 11968089

Ceftronics Limited is registered with the Information Commissioner’s Office (ICO), registration number ZB709659.

Data protection contact

For questions about this Privacy Policy, how we use your personal information, or to exercise your data-protection rights, please contact:
info@cefref.com

For the purposes of UK data protection law, Ceftronics Limited is the controller of personal information processed in connection with your CEFREF account and the operation of CEFREF, except where another organisation is separately responsible for information processed as part of a research or clinical Project.

2. Who can use CEFREF

CEFREF is intended for people aged 18 years and over.

You must be at least 18 years old to create and use a CEFREF account.

3. Information we collect

We collect and process information necessary to provide CEFREF.

Account and identity information

This may include:

• your email address;
• authentication and account identifiers;
• your CEFREF ID;
• information about the status of your account;
• information recording completion of required account processes, including acknowledgement of the Privacy Policy and Terms of Use; and
• security and session information necessary to keep you signed in and protect your account.

CEFREF does not currently ask you to provide your name, postal address, telephone number, date of birth or sex as part of the standard CEFREF account.

Headache and health information

Information you choose to record in CEFREF may include:

• the dates on which you record headache or pain information;
• headache or pain severity;
• categories of headache medication recorded in your diary;
• whether medication was used;
• optional notes that you enter;
• your selected timezone; and
• the date from which your CEFREF tracking period begins.

Because this information relates to your health, some of it constitutes special category personal data under UK data protection law.

CEFREF uses your recorded information to calculate and display diary summaries, headache and medication measures, trends and other analysis views. These calculations are derived from the information you have entered.

The current implementation does not collect a general medical history or make a medical diagnosis.

4. How we use your information

We use personal information where necessary to:

• create, authenticate and manage your CEFREF account;
• provide and secure the CEFREF service;
• store and display your headache diary;
• calculate diary summaries, trends and other CEFREF analysis;
• provide reminders where you enable them;
• create DATA EXPORTS when you request them;
• send essential account, security and service communications;
• administer participation in a CEFREF Project where you choose to participate;
• protect CEFREF, its users and its systems from misuse or security threats;
• investigate technical problems;
• maintain appropriate audit and security records; and
• comply with applicable legal and regulatory requirements.

We do not use your health information to provide automated medical diagnoses or automated clinical decisions.

5. Our legal bases for processing

Under UK data protection law, we must have a lawful basis for processing your personal information. Where we process special-category information, including information about your health, we must also have an additional condition permitting that processing.

Providing CEFREF

We process the account and other personal information necessary to provide CEFREF because it is necessary to perform our agreement with you and provide the service you have requested.

Health information

CEFREF needs to process the headache, pain, medication and other health information that you choose to enter in order to provide your headache diary, calculations, analysis and related CEFREF functions.

For this health information, we rely on your explicit consent as the applicable special-category processing condition.

Before using CEFREF’s diary functionality, you will be asked to expressly consent to Ceftronics Limited processing the health information you enter for these purposes.

You may withdraw that consent. Because processing this health information is necessary to provide CEFREF’s headache-diary and analysis functionality, withdrawing consent means that we will no longer be able to provide those functions to you.

Other processing

We may also process personal information where necessary for our legitimate interests in operating, securing and maintaining CEFREF, where necessary to comply with a legal obligation, or under another lawful basis where applicable.

Participation in a research or clinical Project is separate from your ordinary CEFREF account and may involve additional Project consent, privacy information or governance arrangements.

6. CEFREF Projects and research

Some users may choose to participate in a CEFREF research or clinical Project.

A Project may use a six-character Project ID (Unlock Code) to allow you to join it.

CEFREF records information necessary to administer Project participation, including the Project you join, your Project ID, participation status and your response to the CEFREF Project consent.

Joining a Project does not, by itself, automatically send your headache information to the Project.

When you request an eligible PDF DATA EXPORT while participating in a Project, CEFREF sends:

1. a copy to your verified CEFREF account email address; and
2. a separate Project copy to the verified research email address configured for that Project.

The Project copy contains the CEFREF ID, Project information, Project ID and the clinical analysis contained in the DATA EXPORT.

The Project copy does not contain your name or CEFREF account email address.

Free-form diary notes are not included in the Project PDF DATA EXPORT.

A Project may separately provide a participant information sheet, privacy notice, consent form or other research documentation. Where applicable, that documentation should explain how the relevant research or clinical organisation processes information for its own purposes.

7. DATA EXPORTS

CEFREF allows you to deliberately request exports of your information.

Depending on the export function used:

• a CSV export may contain diary dates, pain scores, medication information and your notes and is sent to your verified CEFREF account email address; and
• a PDF DATA EXPORT contains calculated headache and medication analysis and identifying CEFREF/Project information where applicable.

Creating an export is a deliberate user action.

Where you are participating in an eligible Project, a copy of an eligible PDF DATA EXPORT will also be sent separately to that Project as described above.

Information necessary to record and administer an export may be retained separately from the temporary PDF file itself.

8. Emails and notifications

CEFREF uses your email address for essential account and service communications. These may include:

• account verification;
• password recovery;
• requested DATA EXPORTS;
• Project-related confirmations; and
• Project research-email verification where applicable to an administrator.

These are transactional or service communications. They are not marketing emails.

CEFREF does not currently operate a marketing newsletter or promotional mailing list through the application.

If you enable CEFREF reminders, reminders are delivered using browser/device Web Push notifications, rather than email.

9. Cookies and browser storage

CEFREF uses a strictly necessary session cookie to maintain a secure authenticated session after you log in.

The session cookie is used for authentication and security. It is not used for advertising or behavioural tracking.

CEFREF may also use browser and Progressive Web App storage technologies, including local browser storage, application caching and service-worker functionality, where necessary to provide application functionality, offline/PWA behaviour, preferences or legacy unauthenticated diary functionality.

These technologies are different from cookies.

CEFREF does not currently use advertising cookies or analytics cookies.

10. Analytics, advertising and location

CEFREF does not currently use third-party advertising or behavioural tracking services.

The current CEFREF application does not intentionally collect GPS or precise location information.

CEFREF does not currently use information about your headache diary for advertising.

Operational infrastructure may process technical information, such as network or request information, where necessary to operate and secure the service.

11. Who processes your information

We use service providers to operate CEFREF.

CEFREF’s current production infrastructure uses Amazon Web Services (AWS) services, including services for:

• account authentication and related account communications;
• application hosting;
• database hosting; and
• operational infrastructure and logging.

CEFREF uses Microsoft Azure for application DATA EXPORT email delivery.

The production CEFREF application and database currently operate using AWS infrastructure in the London (eu-west-2) region.

The CEFREF database is encrypted and is not publicly accessible.

Where third parties process personal information on our behalf, we require appropriate arrangements to protect that information.

We do not sell your personal information.

12. International transfers

CEFREF’s primary application infrastructure is currently deployed in the AWS London region.

Some suppliers may operate internationally or provide support and other services from locations outside the United Kingdom. Where personal information is transferred outside the UK, we will ensure that an appropriate lawful transfer mechanism and safeguards are used where required by data protection law.

13. How long we keep information

We retain personal information only for as long as reasonably necessary for the purposes for which it is processed and to meet applicable legal, security, audit and regulatory requirements.

Different types of CEFREF information may therefore have different retention periods.

For example:

• authenticated sessions have limited validity periods;
• temporary PDF DATA EXPORT artifacts have a maximum expiry period of 30 days and may be removed earlier when they are no longer required for delivery;
• Project research-email verification requests expire;
• clinical information associated with an account is removed as part of the account-deletion process; and
• limited records may need to be retained after account deletion for security, audit, legal, Project-governance or integrity purposes.

We will not describe information as anonymised where it remains capable of being associated with an identifiable account or retained identifier.

14. Deleting your CEFREF account

CEFREF provides a Delete Account function.

When account deletion is confirmed, CEFREF begins a controlled deletion process which includes:

• preventing further normal use of the account;
• revoking active CEFREF sessions;
• cancelling eligible pending DATA EXPORT deliveries;
• deleting stored clinical diary information and associated account data that are no longer required;
• removing reminder and notification information;
• ending active Project participation;
• deleting the associated authentication account; and
• retiring the CEFREF ID so that it is not reassigned to another person.

Deletion may be completed asynchronously and may therefore not occur instantaneously.

Some limited historical records may be retained where necessary, including records required for security, audit, legal or Project-governance purposes. These can include retired identifiers, historical Project participation or consent events and records relating to previous DATA EXPORT activity.

Deleting your CEFREF account cannot recall an email or DATA EXPORT that has already been delivered to you or to an eligible Project.

15. Withdrawing your health-data consent

You may withdraw your explicit consent to the processing of your health information at any time.

CEFREF cannot provide its headache diary, analysis and related clinical functions without processing the health information you enter. If you withdraw this consent, you will therefore need to stop using those functions and delete your CEFREF account using Settings → Delete Account.

Withdrawal of consent does not affect the lawfulness of processing carried out before you withdrew your consent. Some limited information may continue to be retained where this is necessary for legal, security, audit or research-governance purposes, as explained in this Privacy Policy.

16. Keeping your information secure

We use technical and organisational measures intended to protect personal information against accidental or unlawful loss, alteration, disclosure or access.

These include authenticated access controls, server-side sessions, encrypted database storage and restricted database network access.

You are responsible for keeping your CEFREF login credentials secure and should not disclose your password to another person.

No internet-based service can guarantee absolute security.

17. Your data-protection rights

Depending on the circumstances, UK data protection law gives you rights including the right to:

• be informed about how your information is used;
• request access to personal information we hold about you;
• ask us to correct inaccurate or incomplete information;
• request deletion of personal information;
• request restriction of processing;
• object to certain processing;
• request portability of eligible information; and
• withdraw consent where processing is based on consent.

Some rights are subject to legal conditions and exemptions.

To exercise a data-protection right, contact:
info@cefref.com

We may need to verify your identity before acting on a request.

18. Automated decision-making

CEFREF calculates and presents information derived from the headache and medication information you record.

These calculations are intended to help you review your diary.

CEFREF does not currently make solely automated decisions about you that produce legal or similarly significant effects, and it does not provide an automated medical diagnosis.

19. Medical information

CEFREF is an electronic headache diary. It is not intended to replace professional medical assessment, diagnosis or treatment.

Information recorded, calculated or displayed by CEFREF should not be relied upon as medical advice.

If you are concerned about your headaches, symptoms or medication use, you should seek advice from an appropriately qualified healthcare professional.

CEFREF is not intended for emergency medical use. If you believe you may require urgent medical attention, you should seek appropriate urgent or emergency medical assistance rather than relying on CEFREF.

20. Links to other websites

CEFREF may contain links to other websites, including www.cefref.com.

External websites have their own privacy practices. We are not responsible for the privacy practices of independent third-party websites.

21. Complaints

If you have a concern about how Ceftronics Limited processes your personal information, please contact us first at:
info@cefref.com

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s data-protection regulator.

22. Changes to this Privacy Policy

We may update this Privacy Policy where CEFREF, our data-processing activities or applicable legal requirements change.

The version and effective date appear at the top of this Privacy Policy.

Where a change materially affects how we process your information, we will take appropriate steps to bring the change to your attention and, where required, obtain a new acknowledgement or consent.