Supplemental Notice For Residents Of The European Economic Area, Switzerland, Or The United Kingdom
Last Updated: 18 September 2026
Name of data controller and contact details
ChatIBD is operated by Dr Shaun Chuah as a University of Glasgow academic project. Dr Shaun Chuah is the data controller for personal data processed through the Service. Privacy enquiries should be directed to:
Dr Shaun Chuah
Email: privacy@chatibd.com
Purposes of the processing
The purposes of the processing are described in the section of the ChatIBD Privacy Policy entitled How We Use Your Information.
Lawful basis for the processing
For operation of the Service, we may process personal data where necessary for our legitimate interests in providing and securing ChatIBD, preventing misuse, responding to users, monitoring response quality, safety and performance, investigating errors, conducting quality assurance, and improving the functionality of the Service, except where those interests are overridden by users' rights and freedoms.
This may include automated analysis of ChatIBD conversations and limited review by authorised team members where necessary for safety, quality assurance or investigation of flagged responses.
Where processing is undertaken as part of formal academic research, the lawful basis and any additional conditions for processing will be set out in the relevant approved research privacy notice and consent or governance materials.
We also may process personal data on other bases permitted by the EU General Data Protection Regulation (“GDPR”), the UK Data Protection Act 2018 (“UK GDPR”) and other applicable laws, such as where processing is necessary for us to comply with legal obligations.
Research processing
Routine safety monitoring, quality assurance, service analytics and product improvement are part of operating ChatIBD and are separate from formal research participation.
Where conversation-level data is used as part of an approved academic research project or formal research dataset, that processing will be described in separate research information and privacy materials and will rely on the lawful basis and governance arrangements specified in those materials.
Consent or another approved basis for research use is separate from routine use of ChatIBD.
The legitimate interests of the controller or third party, where applicable
Our specific legitimate interests, such as responding to your requests, comments and questions, providing you with support and improving our Services, are described in the section of the ChatIBD Privacy Policy entitled How We Use Your Information.
The categories of personal data concerned
The categories of personal data that we process are described in the section of the ChatIBD Privacy Policy entitled Information We Collect.
The recipients or categories of recipients of the personal data
The potential recipients of the personal data that we collect via the Services are described in the section of the ChatIBD Privacy Policy entitled How We Disclose Your Information. We also publish a list of our subprocessors at chatibd.com/subprocessors.
Information regarding the transfers of personal data outside of the European Economic Area (EEA), Switzerland and the United Kingdom (UK)
ChatIBD uses service providers to operate the Service. Where we transfer data to countries outside the UK/EEA (for example, to service providers in the United States), we rely on:
- the UK adequacy regulations
- the European Commission adequacy decision
- Standard Contractual Clauses (SCCs) approved by the UK ICO & the EC
The period for which the personal data will be stored, or the criteria for determining the retention period
How long we retain personal data varies according to the type of data in question and the purpose for which it is used. See the section entitled Retention of Personal Information.
Your rights to access, correct, restrict or delete your personal data and object to processing
You have the right to request access to your personal data, to have your personal data corrected, restricted or deleted, and to object to our processing of your personal data. Your rights may be subject to various limitations under the GDPR and the UK GDPR. If you wish to exercise any of these rights, or if you have any concerns about our processing of your personal data, please contact us in any of the ways listed in the section entitled How to Contact Us. The data portability rights in the GDPR and the UK GDPR are not relevant to the kinds of processing that we do.
The right to lodge a complaint with a supervisory authority
You have the right to file a complaint concerning our processing of your personal data with your national (or in some countries, regional) data protection authority. The EU Commission has a list here: http://ec.europa.eu/justice/article-29/structure/data-protection-authorities/index_en.htm. See www.ico.org.uk for information about contacting the UK Information Commissioner’s Office. See www.edoeb.admin.ch/edoeb/en/home.html for information about contacting the Swiss Federal Data Protection and Information Commissioner.
Research withdrawal
If you have consented to research use, you may withdraw that consent at any time using the research consent controls in the product or by contacting us. Withdrawal will stop future research use of your data but does not necessarily remove data already used in an approved analysis where lawfully permitted.
Statutory or contractual requirement or other obligation to provide any personal data
Users of the Services are under no statutory or contractual requirement or other obligation to provide personal data to us via the Services.
Contact Us
If you have any questions about this notice or wish to exercise your rights under the UK GDPR or EU GDPR, please contact us at privacy@chatibd.com