Privacy policy

Last updated: 8 October 2026

This policy explains what personal data Amagi Health Ltd collects through amagisummit.org, why we collect it, who we share it with and the rights you have.

Who we are

Amagi Health Ltd ("Amagi", "we", "us") runs the Caribbean Brain Health Summit and this website.

Amagi Health Ltd is a company registered in England (company number 15274813). Our registered office is 86-90 Paul Street, London, England, United Kingdom, EC2A 4NE.

For the personal data described here, Amagi is the controller. That means we decide how and why it is used, and we are responsible for looking after it.

How to contact us

Email info@amagibrainhealth.org with "Privacy" in the subject line, or write to us at our registered office. You can use either to ask a question or to exercise any of your rights.

What we collect and why

When you fill in a form

Our Register Interest and Call to Action consultation forms ask for some or all of the following:

• your name and email address
• a phone or WhatsApp number, if you choose to give one
• your organisation and role, if relevant
• the country or territory you are in, and which group best describes you (for example, family carer or researcher)
• your area of interest in the Call to Action, and anything you write in the form
• your answers to the consent boxes on the form

We also record the date you sent the form and, if you arrived through one of our campaign links, which campaign it was. We never ask about your health.

We use this information:

• To confirm your registration, reply to you and run the Summit. Our lawful basis is our legitimate interest in organising the Summit and responding to the people who contact us.
• To include your views in the Call to Action consultation. Our lawful basis is our legitimate interest in developing the Call to Action with the people it affects. We only name you publicly if you agree (see below).
• To send you news and updates, only if you tick the box to agree. Our lawful basis is your consent.
• To name you or your organisation publicly, or to share your story, only if you tick the box for each. Our lawful basis is your consent.
• To understand which of our campaigns bring people to the site. Our lawful basis is our legitimate interest in using our resources well.

You can withdraw your consent at any time by emailing us or using the unsubscribe link in any email we send. This does not affect anything we did before you withdrew it.

When you donate

Donations are taken by Stripe on its own secure checkout page. Stripe collects your card details, name, email address and billing details. Your card details never reach our website and we never see them.

Stripe tells us the amount, the currency and whether the payment succeeded. Your name and email address are kept in our Stripe account so we can deal with any questions about your donation. We also attach to the payment the page you donated from and, if you arrived through a campaign link, which campaign it was.

Our lawful basis is that we need this information to take your donation, and that the law requires us to keep financial records. Stripe also uses some of this information for its own purposes, such as preventing fraud. See Stripe's privacy policy.

When you browse the site

• Server logs. Our hosting provider records technical details of each visit, such as your IP address, browser and the pages you request, to keep the site secure and running. Our lawful basis is our legitimate interest in running a secure website.
• Analytics. Plausible Analytics counts visits and shows us which pages are useful: the page, the site that sent you, your browser, device type and country, and whether you clicked Donate or completed a donation (the amount, never who gave it). It sets no cookies, stores nothing in your browser and does not identify you. Your IP address is used only to tell visits apart for a day and is never stored. Our lawful basis is our legitimate interest in understanding how the site is used.
• Fonts. Some of the site's lettering is loaded from Adobe Fonts, so your browser sends your IP address to Adobe when a page loads. Our lawful basis is our legitimate interest in presenting the site properly.

Our cookies page lists every cookie and similar item the site stores in your browser.

When you email us

We keep your message and contact details so we can reply and keep a record of our conversation. Our lawful basis is our legitimate interest in responding to you.

Who we share it with

We do not sell your personal data. Supporters of the Summit do not receive attendee contact lists. We share personal data only with organisations that help us run the site and the Summit, and only as much as they need:

• Netlify hosts the website.
• Supabase hosts the database and file storage behind the website.
• Airtable holds our contact records, so we can manage registrations.
• Resend sends the emails the website sends, such as form confirmations.
• Stripe processes donations.
• Plausible Analytics counts visits to the site, with data stored in the EU.
• Google hosts some of our forms on Google Forms.
• Adobe provides some of the fonts on the site.
• Our web developer and analytics agency, who build and look after the site and its analytics reports for us.

We may also share personal data if the law requires it, or to protect the rights, property or safety of Amagi, our visitors or others.

Transfers outside the UK

Several of these providers are based in, or store data in, the United States or other countries outside the UK. Where they do, the transfer is protected by the UK Extension to the EU-US Data Privacy Framework, or by the International Data Transfer Agreement or Addendum approved by the Information Commissioner. Contact us if you would like more detail.

How long we keep it

• Form submissions and contact records: for up to 3 years after you last contacted us, unless you ask us to delete them sooner.
• Donation records: 6 years after the end of the financial year in which you donated, as UK law requires for financial records.
• Server logs: a short period, set by our hosting provider, usually no more than 30 days.
• Emails: for as long as we need them to deal with your enquiry, and no more than 3 years.

Your rights

Under UK data protection law you have the right to:

• ask for a copy of the personal data we hold about you
• ask us to correct anything that is wrong or incomplete
• ask us to delete your personal data
• ask us to limit how we use it
• object to us using it on the basis of our legitimate interests
• ask us to send it to you, or to another organisation, in a common format
• withdraw your consent at any time, where we rely on it

To use any of these rights, email info@amagibrainhealth.org. It is free, and we will reply within one month. We may need to check your identity first.

Complaints

If you are unhappy with how we have handled your personal data, please tell us first so we can try to put it right. You also have the right to complain to the Information Commissioner's Office (ICO), the UK regulator, at ico.org.uk/make-a-complaint or on 0303 123 1113.

Keeping your data safe

We use encrypted connections, restrict access to the people who need it, and choose providers that keep data secure. No website can be completely secure, but we take reasonable steps to protect your information.

Children

This site is for adults. Our forms are not meant for anyone under 13, and we do not knowingly collect their personal data.

Changes to this policy

We will update this policy when the way we use personal data changes. The date at the top shows when it last changed.