Privacy Notice

Notice version: 1.0 (25 September 2026)

Visibly Invisible Website: https://fei.ccai.org.uk/

This privacy notice explains how the Visibly Invisible research project collects, uses and protects personal information when you visit this website, contact the research team, or take part in our diary study. We are committed to handling your information fairly, lawfully and transparently, in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

1. Who we are

Visibly Invisible is a research collaboration between researchers at Northumbria University and Face Equality International (FEI). The research is carried out as part of the UKRI AI Centre for Doctoral Training in Citizen-Centred Artificial Intelligence (CCAI) at Northumbria University, funded by UK Research and Innovation through the Engineering and Physical Sciences Research Council (EPSRC), grant reference EP/Y030729/1.

The study has received ethical approval from Northumbria University (ethics reference 15450).

Data controller

Northumbria University is the data controller for personal information collected through this website and the study. This means the University decides how and why your information is used and is responsible for protecting it.

Northumbria University, Ellison Place, Newcastle upon Tyne, NE1 8ST ICO registration number: Z7674926

2. How to contact us

Questions about the project or the study

  • Lead researcher: Prof. Kyle Montague, Northumbria University, kyle.montague@northumbria.ac.uk
  • Co-investigator: Dr Reem Talhouk, Northumbria University, reem.talhouk@northumbria.ac.uk
  • Project collaborator: Dr Hannah Saunders, Face Equality International, hannah.saunders@faceequalityinternational.org

Questions about data protection or your rights

Data Protection Officer Legal Services Team, Pandon Building, Northumbria University, Newcastle upon Tyne, NE2 1XE Email: dp.officer@northumbria.ac.uk

3. What information we collect

When you visit the website

If enabled, we use Fathom Analytics on every page of the website to count visits and understand which pages are used. Fathom does not use analytics cookies or track you across websites. It processes limited request information, including your IP address and user agent, to produce privacy-preserving visitor and page-view statistics. UK and European visitor requests are processed and anonymised through Fathom's European infrastructure before the resulting analytics data continues through its systems. Our hosting provider, GitHub Pages, may also log visitors' IP addresses for security purposes.

Fathom is disabled unless the research team has approved and configured it. The website does not use advertising or behavioural-tracking cookies. It may use storage on your device for the functional purposes described below.

When you email the research team

If you contact us by email, we will receive your email address, your name (if included) and anything you choose to write in your message.

When you join the study

When you sign up to take part, we collect:

  • your name and email address;
  • your answers to the consent questions, including which uses of your data you agree to.

This information is stored separately from your diary entries. The consent record and submitted diary entries contain the same restricted, randomly generated participant identifier so that the research team can administer participation and withdrawal. This means diary entries are pseudonymised rather than anonymous while the research team retains that link. Your name and email address are not included in diary-entry submissions.

When you take part in the diary study

We collect the experience reports and follow-up reflections you choose to submit. These submissions do not ask for your name or contact details, and we ask you not to include information that could identify you or other people. Submitted records include a randomly generated participant identifier. When a record is first submitted, the research platform privately returns a random, record-specific submission ID to the app. The app stores that ID on your device and uses it to authorise later updates to that record. Because the study explores experiences of living with a visible difference, your entries may include information about your health, appearance or emotional wellbeing. This is treated as special category data (see section 4).

Information stored on your device

To allow the study app to work offline, your browser stores diary entries and drafts, consent choices, your name and email address entered on the consent form, the randomly generated participant identifier, synchronisation status, settings, and recent technology and context values used for autocomplete. We cannot access information held only on your device. Information is sent to the research platform only when you join the study or when the app synchronises research submissions after you have joined. You can remove the local copy at any time by using "Delete all data from this device" in Settings or clearing site data for fei.ccai.org.uk, although clearing site data before a pending submission or withdrawal has synchronised will prevent that pending action from being sent.

This functional browser storage is necessary to provide the offline diary and the study functions you request. It is not used for advertising or cross-site tracking.

We only accept participants aged 18 or over.

4. Why we use your information and our lawful basis

Northumbria University processes personal data under Article 6(1)(e) of the UK GDPR, which allows processing that is necessary for the performance of a task carried out in the public interest. Carrying out research, and running the website that supports it, is part of the University's public task.

We use your information to:

  • run, secure and improve the website;
  • respond to your questions;
  • record your consent and manage your participation in the study, including contacting you about the study if needed;
  • analyse diary entries for the purposes of the research;
  • publish anonymised research findings and, where you have agreed, a fully anonymised open dataset.

Where your diary entries include special category data, such as information about health, we rely on Article 9(2)(j) of the UK GDPR (processing necessary for scientific research purposes), Schedule 1 condition 4 of the Data Protection Act 2018, and the safeguards required by Article 89 of the UK GDPR.

Taking part in the study is voluntary. Separately from data protection law, we ask for your informed consent to take part in line with research ethics requirements. Full details are provided in the participant information sheet and consent form at https://fei.ccai.org.uk/en/join/.

5. Who we share your information with

We do not sell your personal information. We share it only where necessary, as follows.

Face Equality International. As our project partner, FEI may see pseudonymised diary entries and experience reports where necessary for the project. FEI does not have access to your name, email address or consent records. Any material shared for publication or public release will first be anonymised. If you choose to email Dr Hannah Saunders directly, FEI will handle that email in line with its own privacy policy.

Service providers. We use the following providers to run the website and study. They act on our instructions and only process information for the purposes described here:

  • GitHub Pages (GitHub, Inc.), which hosts the website;
  • Formidable, a research data-collection platform developed by the CCAI team and hosted on Northumbria-managed DigitalOcean infrastructure in the European Union, where consent records and submitted diary data are stored;
  • Fathom Analytics, which provides cookie-free website statistics.

Research outputs. Findings will be published in anonymised form, for example in academic papers, reports and presentations, so that no individual can be identified. If you opt in on the consent form, your anonymous diary entries may be included in an open research dataset published with a permanent identifier (DOI).

Legal requirements. We may share information with regulators, auditors or law enforcement where the law requires us to.

6. International transfers

Consent records and submitted diary data are stored on Northumbria-managed DigitalOcean servers located in the European Union.

Some website data may be processed outside the UK by our service providers:

  • Fathom Analytics is a Canadian company. For UK and European visitors, limited request information is processed and anonymised on European infrastructure before analytics data continues through Fathom's systems. Fathom's data-processing terms and applicable UK transfer safeguards govern any international processing.
  • GitHub, Inc. is based in the United States. Any transfer of visitor IP addresses to the United States is protected by safeguards recognised under UK law, such as the UK Extension to the EU-US Data Privacy Framework or the International Data Transfer Agreement.

7. How long we keep your information

  • Email enquiries: up to 5 years, in line with Northumbria University's records retention policy.
  • Consent records (name, email address and consent responses): 5 years after the end of data collection, so that we can show consent was given.
  • Diary entries and research data: 5 years after the end of data collection, in line with the University's research data management policy.
  • Open dataset: if you agree to your anonymous entries being archived and published, they will be kept indefinitely as part of the published dataset.
  • Website analytics: if Fathom is enabled, analytics history has no automatic expiry while the subscription remains active. If the subscription ends, Fathom says the analytics data is queued for deletion and may take up to 60 days to remove. The research team will periodically review whether older analytics are still needed.
  • Information on your device: kept in your browser until you submit it or clear your browser's site data.

8. How we keep your information secure

We protect your information using appropriate technical and organisational measures, including:

  • encrypted connections (HTTPS) between your device, the website and our servers;
  • storing consent records separately from diary entries;
  • restricting server access to authorised members of the research team;
  • hosting submitted research data on EU-based infrastructure managed for the research team, with operational controls intended to validate submissions, record withdrawals and exclude withdrawn records from future research use.

9. Your rights

Under data protection law, you have the right to:

  • ask for access to the personal information we hold about you;
  • ask us to correct inaccurate or incomplete information;
  • ask us to erase your information;
  • ask us to restrict how we use your information;
  • object to our use of your information;
  • ask for your information to be transferred to another organisation (data portability), where this right applies. Data portability does not normally apply where the lawful basis is public task.

Withdrawing from the study. You can withdraw at any time without giving a reason, either through the app or by contacting the research team. The app immediately stops future diary synchronisation on that device and, when online, asks the research platform to mark the consent record as withdrawn. The research team will use the restricted participant identifier to mark associated source records as withdrawn and exclude them from future exports and analysis.

To preserve research integrity, security and an audit trail, source records may be retained with access restricted rather than deleted. Information already anonymised, included in completed aggregate analysis, or published cannot be identified and removed. Withdrawal does not delete the diary entries stored on your device; you can export or delete those separately in Settings.

Some rights may also be limited where information is used for research purposes and exercising them would seriously impair the research, as permitted by the Data Protection Act 2018.

To exercise any of your rights, please contact the Data Protection Officer using the details in section 2. We will respond within one month.

10. Children

The study is only open to people aged 18 and over, and this website is not intended for children. We do not knowingly collect personal information from anyone under 18.

11. Links to other websites

This website may link to other websites, including those of Northumbria University and Face Equality International. We are not responsible for the privacy practices of other websites, and we encourage you to read their privacy notices.

12. Changes to this notice

We may update this notice from time to time, for example if the study or the tools we use change. Any changes will be posted on this page with a revised "Last updated" date. If we make significant changes that affect participants, we will let you know by email.

This privacy notice and the current online consent materials are provided in English. The app interface may be available in other languages, but those interface translations are not translations of this legal notice. If you need an explanation or a translation in another language before deciding whether to participate, contact the research team using the details in section 2. Do not join the study until you have received information you understand.

13. How to complain

If you are unhappy with how your personal information has been handled, please contact Northumbria University's Data Protection Officer first:

  • Email: dp.officer@northumbria.ac.uk
  • Post: Data Protection Officer, Legal Services Team, Pandon Building, Northumbria University, Newcastle upon Tyne, NE2 1XE

The University will acknowledge your complaint within 5 working days and aim to respond in full within one calendar month. If you are not satisfied with the outcome, you can ask for a review by the University's General Counsel within 20 working days of receiving the response. More information is available at https://www.northumbria.ac.uk/about-us/leadership-governance/vice-chancellors-office/legal-services-team/gdpr/gdpr-complaints/.

You also have the right to complain to the Information Commissioner's Office (ICO) at any time: