What changed in our privacy notice

Version 2.1 — published 5 November 2026.

One small addition, reviewed by our Data Protection Officer. The full notice is at /privacy-policy.

• Our staff use an AI assistant for everyday work. PCRA staff use Claude, provided directly by Anthropic under a business (Claude Team) subscription, to help draft and summarise emails, documents and meeting notes. It is separate from the portal. Only business contact details and work correspondence go in, never patient, participant or health data. Anthropic does not train on our content, and we delete conversations when they are no longer needed. Details in Section 11A.

The processor list (Section 13) and international transfers (Section 14) have been updated to match. Nothing else has changed.

Earlier: version 2.0

Version 2.0 — effective from 9 May 2026.

We've updated our Privacy Notice to reflect how the new PCRA Portal works. This page is a quick, plain-English summary of what's new. The full notice is at /privacy-policy.

In short

Our portal launched in May 2026 as a new way for GP practices and study sponsors to work with PCRA. The privacy notice needed updating to explain that, including the new things that come with running a portal — accounts, sign-in, AI features, and how we keep patient data out of all of it.

Patient-identifiable data is still excluded by design. That hasn't changed. Sponsors and PCRA staff anonymise data before it ever enters the portal.

What's new

• Three new groups of people are described in the notice: practice staff who sign in to the portal, sponsor users who use it, and people who email us at info@pcralliance.uk.
• AI is now used in the portal, in narrow, supervised ways — for example, helping a practice fill in their profile, or drafting a reply to a sponsor enquiry. A human always reviews AI output before it influences anything. AI runs only inside the EU and never trains on our data.
• Cookies — we use only the cookies that are strictly needed for sign-in and security. No analytics, no trackers.
• The companies that help us run the portal are now named explicitly: Microsoft (email), Vercel (hosting), Neon (database), AWS (AI + secure storage), GitHub (code).
• Patient-data safeguards are described in more detail, including what happens if patient data accidentally arrives by email (it's quarantined and removed).
• Your rights under UK GDPR are unchanged but explained more clearly, with the contact route updated.

What hasn't changed

• We're still PCRA — registered in the UK, regulated by the ICO (registration ZB864081).
• We still don't sell or share your data for marketing.
• The legal bases we rely on are essentially the same — research delivery, the contract with you if you're a member or sponsor, and your consent where it's needed.
• Anyone can ask us for a copy of the data we hold about them, or to correct or delete it. The contact route is info@pcralliance.uk with the subject line "FAO Data Protection Officer".

Who signed it off

The full notice was reviewed and countersigned by our Data Protection Officer on 9 May 2026.

If anything in this summary or the full notice doesn't make sense, please email us at info@pcralliance.uk and we'll explain.