Privacy notice
Last reviewed 2026-10-26. This notice covers the registry (registry.brainsait.de), provider sign-up, the early-access waiting list and the provider workspace.
Who is responsible
BRAINSAIT LTD · Company No. 14901033 (England and Wales)
Office 321-323 High Road, Chadwell Heath, Essex RM6 6AX, United Kingdom
Privacy contact: hello@brainsait.de
What we collect
- ORCID sign-in: your ORCID iD and the name on your ORCID record. No ORCID password or token is kept.
- Application: names (Arabic/English), profession, specialty, professional identifiers you enter, e-mail, and optionally a mobile number with SMS consent.
- Credential documents you upload (licence, degrees, certificates) — only with the consent checkbox on the form.
- Optional links: a LinkedIn identity check (subject id, name, e-mail, verified flag; no token kept), your Zenodo account (to list records), your public bio.
- Early-access waiting list: name, e-mail, optionally mobile/WhatsApp number, profession, specialty, country, organisation, the features you are interested in and any ideas you write — only with the consent checkbox on the form.
- Membership and billing: invoice and payment status for BPR membership.
- Public research data already published under your ORCID iD (ORCID, Zenodo, Hugging Face, Crossref/DataCite).
- Technical logs: IP address, browser and requested page, kept 14 days; an internal audit log of reviewer actions.
Why we use it
- To publish your registry profile and SPID, and to confirm that you control your ORCID iD.
- To review your credentials with the issuer before any status is shown as verified.
- To issue signed credentials, run membership and invoices, and send service messages about your application and membership.
- To set up the member services you request (for example, your own EMR instance).
- To contact people on the waiting list about early access, and to learn which features providers need.
What is public
Your profile shows your names, SPID, profession, specialty, ORCID iD, trust statuses and publisher-confirmed research. Licence numbers, documents, e-mail and phone are never public.
Who receives it
- Hetzner Online GmbH — hosting, e-mail relay and encrypted backups, in Germany.
- ORCID — sign-in. Daftra — invoices. Payment providers you choose at checkout (Shopify Payments for mada, Apple Pay and card; PayPal).
- Lark — internal team notifications about new requests (name, e-mail, topic); for the waiting list only name, profession, country and interests.
- Notion — a copy of your profile only if you tick that consent.
- Hugging Face — only if the on-server writing assistant is unavailable: name, profession, specialty and city for a bio suggestion.
- SMS provider — your mobile number, only with SMS consent and once an SMS provider is configured.
The BPR community on WhatsApp is optional; if you join it, what you share there is handled by WhatsApp (Meta) and visible to the group. AI features run on our own server; your data is not sent to an AI provider. We do not sell personal data.
Where it is stored
On servers in Germany (European Union). Data you provide from Saudi Arabia is therefore transferred outside the Kingdom; we apply the safeguards required by the Personal Data Protection Law for such transfers.
How long we keep it
- Profile and application: while you are listed, then deleted on request.
- Credential documents: until you ask for removal.
- Backups: 14 days (registry), about 8 weeks (EMR instances).
- Invoices: as long as tax law requires.
- Waiting list: until the early-access period ends and you have been contacted, then deleted unless you join; earlier on request.
Your rights
You can ask to see, correct or delete your data, withdraw a consent at any time, and ask what we hold about you. Write to hello@brainsait.de from the e-mail on your application; we answer within 30 days. You can also complain to the Saudi Data & AI Authority (SDAIA) or, because the controller is a UK company, to the UK Information Commissioner's Office (ICO).
Patient data in member EMRs
In a member's own EMR, the member (the clinician or facility) decides how patient data is used; BrainSAIT hosts and operates the system on their behalf and does not use patient data for any other purpose.
BrainSAIT Provider Registry · BPR workspace · GIVC · hello@brainsait.de · Privacy