Privacy Notice.

CVES — College of Vascular and Endovascular Surgery, United Kingdom — is the data controller for the personal data described in this notice. We decide why and how that data is used.

For anything to do with your personal data — access, correction, deletion, objections, or a concern about how we have handled it — write to privacy@cves.org.uk. We aim to acknowledge within five working days and respond substantively within one month.

This is the most important thing to know about CVES. Our clinical registries — the CVES Venous, Aortic and Peripheral Arterial Disease Registries — are designed to hold anonymised clinical observations only. We do not collect patient names, dates of birth, NHS or hospital numbers, addresses, contact details, images that identify an individual, or free-text identifiers.

Because no patient-identifying data reaches us, CVES does not process special category health data about patients under Article 9 of the UK GDPR. The full position is set out in the Registry Data Statement.

Health-related information about you is likewise not something we ask for. We collect professional information — qualifications, post, institution, specialty interests — not clinical information about you as a patient.

What we hold depends on your relationship with the College. We ask for the minimum needed for each purpose.

We rely on a specific lawful basis for each purpose:

• Contract — administering your membership, delivering programmes you have registered for, and issuing certificates.
• Legitimate interests — running and securing the site, College announcements to members, maintaining the member directory, assessing applications, and improving our education. We balance these against your interests and you can object at any time.
• Consent — marketing emails to non-members, non-essential cookies, and publishing your profile publicly in the directory or on the global network map. You can withdraw consent at any time without affecting processing already carried out.
• Legal obligation — retaining financial and tax records relating to payments.

Membership visibility is under your control: your Workspace settings determine whether your profile is public, visible to members only, or hidden, and whether you appear on the network map.

We set strictly necessary cookies to keep you signed in and to protect the service. Preference and analytics cookies are switched off until you allow them, and you can change your mind at any time from “Cookie settings” in the footer.

The categories, names and lifetimes are listed in the Cookie Notice.

We do not sell personal data and we do not share it for third-party advertising. We use a small number of service providers who process data on our instructions under written terms, described here by function:

• Application hosting and database services, which store the site and Workspace data.
• A payment provider, which handles membership and course payments and holds the card data — we never see or store full card details.
• An email delivery service, used to send account, transactional and College emails from our mail subdomain.
• Where you choose to use them, optional AI features that process the text you enter in order to return a response.

We will also disclose data where the law requires it, or to establish or defend legal claims.

CVES is an international college and some of our providers operate outside the United Kingdom. Where personal data is transferred abroad, we rely on UK adequacy regulations where they apply, and otherwise on the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, together with appropriate technical and organisational safeguards. You can ask us which mechanism applies to a particular transfer.

When a retention period ends we delete the data or anonymise it so it can no longer be linked to you.

Under the UK GDPR you have the right to:

• Be informed about how your data is used — this notice.
• Access a copy of the personal data we hold about you.
• Have inaccurate data corrected.
• Have data erased, where we no longer need it or where you withdraw consent.
• Restrict our processing while a concern is investigated.
• Portability — receive data you gave us in a common, machine-readable format.
• Object to processing based on our legitimate interests, and to direct marketing at any time.
• Not be subject to solely automated decisions with legal or similarly significant effects — we do not make such decisions.
• Withdraw consent at any time, where consent is the basis we rely on.

Most of this you can do yourself in Workspace settings: edit your profile, change directory visibility, or request account deletion. Otherwise email privacy@cves.org.uk. Exercising your rights is free, and we will not treat you differently for doing so.

Access to personal data is restricted by role. Member and administrative data sits behind authentication and row-level access rules, so an account can only reach the records it is entitled to. Administrative actions are logged. Uploaded documents are held in private storage rather than on public URLs.

No system is risk-free. If a breach were to affect your rights and freedoms, we would notify the ICO within 72 hours where required, and tell you directly where the risk is high.

CVES services are intended for qualified clinicians, trainees and students in healthcare, and are not directed at children. We do not knowingly collect data from anyone under 16. If you believe a child has given us data, contact us and we will delete it.

We update this notice as the College and its services evolve. The date at the top always reflects the current version, and we will tell members directly about changes that materially affect them.