A community with rules, and a place that keeps its promises
People will only speak honestly if they trust the room. That means clear conduct, a way to report harm, and a straight account of where data lives and who can see it.
Governance is not a PDF in a drawer
On this community, the rules are built into how people join and how staff respond. The legal documents sit in the footer. The technical controls sit in the hosting. This page is the plain-language map of all three.
Keeping the room decent
UK GDPR and the Data Protection Act 2018
This community is run for people in the United Kingdom. Personal data is handled under UK GDPR and the Data Protection Act 2018. In practice that means: we tell you what we collect and why (the privacy policy); we ask you to accept the terms when you join; we do not sell your details; survey answers are used to improve health and care work, usually as grouped findings; and you can ask to see, correct, or delete what we hold about you.
Registration can include an age check (this community asks that you are 18 or over) and a cookie notice. If the terms or privacy notice change in a material way, people can be asked to accept the new version before they carry on. Those documents are in the footer on every page, in English as the source, with other languages available where translation is turned on.
This page explains how the platform supports that duty. The organisation that runs a given community is still the controller of its own engagement data — they decide the purpose of a survey, how long to keep the answers, and how they report back.
Your rights, in working order
Where the data lives
-
United KingdomThis community’s application, database and files are hosted in AWS London (eu-west-2). That is UK data residency for the live service.Current
-
In transitBrowsers talk to the site over HTTPS. The site asks browsers to use HTTPS next time as well (HSTS).Completed
-
At restFiles in the private store are encrypted with AES-256. The database sits on managed AWS RDS in the same London region.Completed
Infrastructure, database and application security
Questions about data or conduct
If you want to exercise a data right, report a concern, or ask how a particular group is moderated, start here. For a lock-out or a lost authenticator, an administrator can reset two-step sign-in without ever seeing your password.
Send emailQuestions people ask
Is my data stored in the UK?
Yes, for this community. The application, the database and the private file store are in AWS London (eu-west-2). Files are not put on a public bucket in another country as a shortcut.
Who can read a file I upload?
People who are already allowed to see that content in HumHub. The file store is private. A guessable link is not enough. The application checks permission on every download.
Are survey answers anonymous?
Some surveys are. Others need an account so we can invite you back. Each project page says which it is before you start. Results are normally shared as grouped findings, not “this person said this”.
What happens if I report a post?
Moderators of that group see it. If the report is about a group admin, it goes to site administrators. You will not be asked to argue it in public. Repeated or serious harm can lead to content being removed and accounts being restricted.
How is this different from “Join safely”?
Join safely is for you as a member: how you sign in, what you share, language. This page is the public account of rules, UK data protection, and the hosting. Run the community is for people who hold the admin keys.