Privacy policy

About this privacy policy

This privacy policy explains how information is handled when you visit this NHS-hosted webpage about the DigiBete App.

This page has been provided to give children and young people, parents and carers, healthcare professionals and other visitors information about the DigiBete App and how to access it.

You do not need to create an account or sign in to use this webpage.

This privacy notice applies to people who visit the NHS Children and Young People’s Diabetes Service Website available on https://www.digitaldiabetesservice.nhs.uk/. It explains what personal information we collect, how we use it, who we share it with, and the choices you have.

Important: This notice is for the public information website only. If you are using the DigiBete App, please also refer to the App Privacy Policy .

The NHS Children and Young People’s Diabetes Service is a “service” that is commissioned by NHS England for children, young people and families living with type 1 or type 2 diabetes in England.

Access to the Service – Children and Young People

The NHS Children and Young People’s Diabetes Service is available to children, young people and their parents or carers. Access to the DigiBete App is provided through a unique clinic code issued by the child's or young person's diabetes healthcare team.

Young people aged 13 and over may register for the DigiBete App and use the Service independently. For children under 13, registration and access must be managed by a parent or carer.

We are committed to protecting the privacy and personal information of all users, particularly children and young people, in accordance with UK data protection legislation.

In 2026, DigiBete C.I.C. developed this website as a landing page explaining the new NHS England-commissioned service.

The NHS Children and Young People’s Diabetes Service gives access to the DigiBete App created by the DigiBete team over the last 10 years in partnership with Leeds Children’s Diabetes Team at Leeds Children’s Hospital, part of Leeds Teaching Hospitals NHS Trust. You can find out how to contact us by visiting: https://www.digitaldiabetesservice.nhs.uk/contact

DigiBete provides a Helpdesk for service users. You can contact the Helpdesk by emailing app@digibete.org. The Helpdesk is open 8:00am to 6:00pm, [Monday to Friday, excluding bank holidays].

NHS England commissions the service and is the data controller for information processed as part of it, such as information sent to NHS England from the DigiBete App. This is explained in the App Privacy Policy.

DigiBete C.I.C. is the data controller for this Website and the personal information collected through it, as explained in this notice.

DigiBete’s Data Protection Officer is John Hughes and is contactable on: john@digibete.org

Our Clinical Safety Officer is Alicia Ridout and is contactable via our help desk: app@digibete.org

How we protect your privacy?

We are committed to protecting your privacy by adhering to the principle of data minimisation, as outlined in the UK GDPR. This means we only collect and process personal data that is:

Adequate: sufficient to provide you with relevant services and support.

Relevant: directly related to your interaction with our content and services.

Limited to what is necessary: we do not collect or retain more information than we need.

1) Who we are (Data Controller)

DigiBete C.I.C. (“DigiBete”, “we”, “us”) is responsible for deciding how and why personal information collected through this Website is used (the “data controller”).
 
Registered details:
DigiBete C.I.C. (Company No. 10371773)
Registered office: Platform, 3rd Floor Tech Hub, New Station Street, Leeds, England, LS1 4JB.
 
Contact (general): https://www.digibete.org/contact-us/
Email: hello@digibete.org

Website vs App roles: DigiBete acts as a data controller for personal data collected through this public Website.

Separately, DigiBete may act as a data processor in relation to personal data processed through the DigiBete mobile application when access is provided by a healthcare professional. That processing is covered by a separate App Privacy Notice and relevant data processing agreements with healthcare organisations.

DigiBete may also provide separate clinic portal and school care-plan services on behalf of NHS organisations. These services are covered by separate privacy notices and may involve DigiBete acting as a data processor under NHS instruction.

This Website Privacy Notice does not apply to the DigiBete app.

2) Data Protection Officer (DPO)

We have appointed a Data Protection Officer (DPO) to oversee data protection compliance and act as a contact point for users and the Information Commissioner’s Office (ICO).

DPO contact details:
· Role/Name: Data Protection Officer (DPO) / John Hughes
· Email: john@digibete.org
· Address: Platform, 3rd Floor Tech Hub, New Station Street, Leeds, LS1 4JB

3) What information we collect (Open Website – No Accounts)

Because our Website is open and does not require logins or accounts, we generally collect only limited data.
 
A. Information you provide to us
If you contact us via a Website by email, we may collect:
· Your name (if you provide it)
· Your email address
· The content of your message and any information you choose to include
· The date and time you contacted us

Please do not include health information in your message. If you choose to include health or other special category information, this may be treated as special category data under UK GDPR and handled with additional care and appropriate safeguards.  If health information is submitted voluntarily, it will be handled securely and only used to respond to the enquiry or redirect the individual to an appropriate healthcare contact where necessary.

B. When you visit the Website, your browser connects to our servers on Amazon Web Services in London. Our servers process your IP address and browser details to deliver pages and protect the Website from attacks, but do not keep a record of your visit. Our firewall keeps a small sample of recent requests, including IP addresses, for a few hours for security monitoring. Information about how the Website is used comes from our analytics (section 4)

4. How we measure use of this website?

We use PostHog, a web analytics service, to understand which pages people use and how well the website performs, so we can improve it. PostHog Inc. processes this data for us under a data processing agreement.

PostHog does not set cookies on your device or store anything else on it, so you will not see a cookie banner for analytics.

This Website does not set any cookies on visitors’ devices. Our administrators’ sign-in pages use a cookie that is strictly necessary to keep them signed in; it is never set for visitors.

When you visit a page, your browser sends PostHog:

· the address of the page you are viewing

· the address of the page you came from, if any

· how long the page was open and how far you scrolled

· measurements of how quickly the page loaded and responded

Your IP address and browser details are also sent. PostHog uses them once to create an anonymous daily visitor count and then discards them; it does not store them. The anonymous count changes every day, so it cannot be used to recognise you on another day or to link your visits together.

We do not use PostHog to record your clicks, what you type, or your screen. We do not build a profile of you, and we do not use this data for advertising.

If your browser sends a “Do Not Track” signal, no analytics data is collected.

Our lawful basis for this processing is our legitimate interest in understanding how the website is used so that we can improve it.

The data is stored in the European Union, in Frankfurt, Germany. On its way there it passes through Cloudflare, which PostHog uses to receive it. Cloudflare may handle the data in transit in countries outside the UK and EU. The UK recognises the EU as giving adequate protection to personal data. Any transfer outside the UK and EU, including by Cloudflare, is protected by safeguards in PostHog’s data processing agreement, such as the UK International Data Transfer Addendum to the EU Standard Contractual Clauses or the UK-US Data Bridge.

PostHog keeps this data for 12 months, after which it is deleted.

Our legal basis for using your information

Security reporting

To protect this website against malicious code, we use a security policy that controls what each page can load. If a page tries to load something the policy does not allow, your browser automatically sends a report. These reports go to PostHog, through Cloudflare.

A report includes:

· the address of the page you were viewing and the page you came from

· what was blocked and where on the page it came from

· your browser type and version

Your browser also sends your IP address with the report, because it is needed to deliver it. PostHog discards it and does not store it.

Browser add-ons and extensions can sometimes trigger these reports, so a report may show that a particular add-on was running in your browser.

Reports are sent whether or not your browser sends a “Do Not Track” signal. They are not linked to your analytics data, and we use them only to find and fix security and technical problems.

Our lawful basis for this processing is our legitimate interest in keeping the website secure.

Reports are stored and handled in the same way as analytics data. They are kept in the EU and pass through Cloudflare on the way, and PostHog keeps them for 12 months, after which they are deleted.

5) How we use your information
 
We use personal information to:
· Respond to enquiries and provide support where you contact us
· Maintain Website security (for example, to help detect malicious activity)
· Measure and improve the Website using cookie-free analytics (see section 4)
· Produce aggregated statistics that help us understand Website usage patterns 
  
6) Our lawful bases for processing (UK GDPR)

A. Responding to enquiries and communications

Article 6(1)(f) – Legitimate interests: to respond to enquiries, manage communications, and operate our organisation effectively.
We have balanced this against your rights and freedoms and consider this processing to be proportionate and low risk.

B. Website security and technical operation

Article 6(1)(f) – Legitimate interests: to protect the Website, systems, and users from security threats or misuse.

C. Analytics and website improvement

Article 6(1)(f) – Legitimate interests: to measure and improve the Website using PostHog cookie-free analytics, as described in section 4.
You can object to this, or stop analytics data being collected by turning on the ‘Do Not Track’ setting in your browser.

D. Legal and regulatory obligations

Article 6(1)(c) – Legal obligation: where we are required to comply with applicable laws or regulatory requirements

E. Health information you choose to send us

If you include health information in an enquiry, we will only use it to respond to you or direct you to your diabetes team. Our condition for processing it is UK GDPR Article 9(2)(h) (provision of health care or management of health care services), with the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2. It is handled only by staff who have a duty of confidentiality.

7) Who we share information with

We do not sell your personal information.

We may share personal information only when necessary, for example:
· With trusted suppliers acting on our instructions under contract, including Amazon Web Services (website hosting, UK), PostHog (website analytics and security reporting) and Cloudflare (secure data transmission for PostHog)
· With NHS England, as commissioner of the service, where your enquiry relates to the commissioned service
· If required by law or to comply with a regulatory request in appropriate circumstances 
· To protect the rights, property, or safety of DigiBete, our users, or others

Embedded content and third-party websites

Our Website contains links to other websites. If you follow a link, that website’s own privacy policy applies. Those providers may collect information via their own cookies or technologies. Where this happens, their privacy policies apply to their processing. 
 
 
8) International transfers
 
Our analytics provider, PostHog, stores data in the EU. Its sub-processor Cloudflare may handle data in transit outside the UK and EU (see section 4). Where personal data is transferred outside the UK, it is protected by UK adequacy regulations or appropriate safeguards, such as the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the UK-US Data Bridge.

9) How long we keep your information (Retention)

We keep personal information only for as long as necessary for the purpose it was collected, including legal, regulatory, security and operational reasons. We follow the NHS Records Management Code of Practice where it applies.
 
Typical retention periods:
· Website enquiries: kept up to 24 months after resolution

- Website application logs: 90 days (these do not contain visitors’ IP addresses)

- Firewall request samples: maximum 3 hours

 
10) Your rights
 
You have rights under UK GDPR, including:

to access your personal data

to correct inaccurate data

to request deletion (where applicable)

to object to or restrict processing (where applicable)

to withdraw consent at any time (where processing is based on consent)

to data portability (where applicable)

to complain to the Information Commissioner’s Office (ICO) – see below

 To exercise your rights, contact us via https://www.digibete.org/contact-us/ or email hello@digibete.org. We will respond within one month and there is normally no charge.

We do not use your information for automated decision-making or profiling.

If you are unhappy with how your information has been handled, please contact us first. You also have the right to complain to the Information Commissioner’s Office: www.ico.org.uk, telephone 0303 123 1113, or write to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

11) Security, NHS alignment, and incident management

We take security seriously and use appropriate technical and organisational measures to protect personal information.
 
NHS Service Standard 9 (security and privacy)
We design and operate this Website with reference to NHS Service Standard 9:
 
Create a secure service which protects people’s privacy, including identifying and managing security risks and protecting personal information appropriately.
 
Encryption (HTTPS)
Our Website is delivered over HTTPS, which encrypts data in transit between your browser and our web servers.
 
Security incidents
If a security incident occurs that affects personal information, we will assess it promptly and notify individuals and/or regulators where required by law.

12) Children’s privacy

 This Website is designed for children, young people and their parents or carers. We have therefore kept the personal information it collects to a minimum and designed it with reference to the ICO’s Age Appropriate Design Code (the Children’s Code).

DigiBete have a specific Children’s Privacy Policy which explains how we conform to the Information Commissioner's Office (ICO's) code standards, and demonstrates that our services use children’s data fairly and in compliance with data protection law. The code is a set of 15 flexible standards that provides built-in protection to allow children to explore, learn and play online by ensuring that the best interests of the child are the primary consideration when designing and developing online services.

13) Changes to this notice
 
We may update this privacy notice from time to time. The latest version will always be published on this page, with the “Last updated” date shown at the top.