TraumaLink prototype: privacy information

Updated 12 November 2026. This describes development work, not an approved service for real patient information.

Use fictional information only

TraumaLink is being developed by Spheno Labs Ltd as a referral communication website. Do not enter real patient names, identifiers, clinical information or photographs in a demonstration. It is not an emergency communication service.

Professional sign-up

The revised sign-up flow requires a verified personal NHS work email, multi-factor authentication, professional registration details and organisation/team approval. Access requests contain your name, profession/grade, regulator and registration, organisation, department and requested role. Pending applicants cannot view or send referrals. Private reviewers record verification references and decisions. Real sign-up is not open until the identity service and staff privacy arrangements are approved.

Referral correspondence and history

The revised application preserves referral correspondence, photographs, responses and earlier saved versions. Completion and a clinician’s saved-record declaration do not delete the history. Later notes are attributed addenda. An earlier proposal to delete sent referrals after seven days has been withdrawn.

A separate version audit records attributed lifecycle changes. Access logs record authorised viewing and export authorisation. These records contain personal information and are access-controlled. A saved-record declaration is not proof that another clinical system received the information.

Referral conversation and read acknowledgements

Messages between approved sending and receiving teams are retained as attributed referral correspondence and included in saved versions and complete-record exports. The open page checks for new messages automatically. Opening a page or receiving an alert does not mark anything as read. An explicit read acknowledgement records the account, team, time and activity entries acknowledged in the referral history; it does not accept clinical responsibility. Demo accounts are shared, so these acknowledgements identify a demo role, not an individual clinician. Unsent text stays only in the open page and is not saved as an offline draft. No email or SMS is sent.

Optional device alerts

If you choose to enable alerts and grant browser permission, we store the device push endpoint and encryption keys, consent time, a digest linking it to your sign-in, its expiry and delivery cursors in encrypted storage. Alerts contain only “New referral activity is available. Sign in to review.” No patient identifiers, referral identifiers or message text are included. Your browser’s push provider (such as Apple, Google or Mozilla) processes delivery information, including the endpoint and connection metadata. Alerts are best effort and are not evidence of delivery, reading or clinical action. Use your usual telephone escalation route for urgent or unanswered referrals.

Device alerts expire with the original 12-hour sign-in limit and stop on sign-out, workspace lock, account withdrawal or revoked team approval. If the page is closed, generic alerts may continue after the clinical session’s 30-minute inactivity limit; clinical data still requires signing in again. You can turn off alerts in the workspace or browser settings. Expired or revoked subscription payloads are cleared by the scheduled notification worker; referral history and read acknowledgements remain under the clinical retention policy. The notification worker does not cache pages, messages or photographs offline. Production use of push providers needs a separate recorded privacy review.

Security and copies

Information is sent to the workspace server over HTTPS and encrypted in application storage. Approved sending and receiving teams can access records within their permissions. The authorised server can decrypt records; this is not end-to-end encryption.

The application uses a secure session cookie, with access expiring after 30 minutes of inactivity or 12 hours overall, and a temporary organisational sign-in cookie of up to 10 minutes. Applicants use a separate sign-up cookie lasting up to 30 minutes; it cannot authorise access to referrals. The application code contains no advertising or analytics trackers. Hosting and identity services may process connection information; deployed settings require separate review.

Photographs are re-encoded to remove embedded metadata, but visible identifying details remain. Where workspace policy allows, a complete referral version can be downloaded with photographs and correspondence. Downloads and clipboard copies leave the workspace’s controls. Encrypted recovery snapshots now include referral versions and audit evidence, excluding account credentials and sessions.

Retention, rights and accountability

No final retention periods have been approved. Automatic age-based deletion of referrals, version history and access logs is disabled in the revised source while the category-specific retention and recovery policy is prepared. This is not a promise to retain information indefinitely. Authorised case erasure removes clinical version payloads and preserves an attributed disposal record; backups and external copies require separate reconciliation. Holds and restrictions must be reviewed.

Before real-data use, the operator must publish a complete reviewed notice naming controllers, privacy/support contacts, purposes, legal grounds, recipients, retention periods, transfers and rights. Supplier agreements, operational monitoring and deployed security/recovery checks must also be completed. No GDPR certification is claimed.

For a demonstration query or information entered by mistake, contact the person who supplied access through your existing route. Do not send patient information through an unapproved channel. No public support address has been verified here. Read about rights and complaints at the ICO.