Summary: We collect only the data necessary to operate our verification services. We do not sell personal data. We comply with the EU General Data Protection Regulation (GDPR). You may request deletion of your data at any time.
1. Data Controller
GlobalDocsHub ("we", "us", "our") acts as the data controller for personal information processed through globaldocshub.com and associated subdomains. For data protection enquiries, contact: [email protected].
2. Information We Collect
2.1 Information You Provide
- Physician registration: Full name, medical credentials, institutional email address, ORCID identifier, and institutional affiliation.
- Publication submissions: Author names, institutional affiliations, document metadata, and uploaded PDF files.
- Contact enquiries: Name, email address, and the content of your message.
- API access requests: Institutional email, organisation name, and intended use case.
2.2 Automatically Collected Data
- IP addresses (anonymised after 90 days), browser type, operating system, and referring URL for security and analytics purposes.
- Cryptographic hashes (SHA-256) of submitted documents — these are non-reversible and cannot be used to reconstruct document content.
2.3 Data We Do Not Collect
We do not collect payment information, social media credentials, biometric data, or any special category health data about visitors to our platform.
3. Legal Basis for Processing
Under GDPR Article 6, we process personal data on the following legal bases:
- Contract performance — processing necessary to fulfil your submission or registration request.
- Legitimate interests — platform security, fraud prevention, and operational analytics.
- Legal obligation — retaining records as required by applicable law.
- Consent — for optional communications and research newsletter subscriptions (withdrawable at any time).
4. How We Use Your Information
- To verify physician identity and academic credentials
- To authenticate and index submitted publications
- To generate and display cryptographic verification seals
- To publish verified physician profile subdomains
- To respond to enquiries and provide technical support
- To detect and prevent fraudulent submissions
- To comply with legal and regulatory obligations
5. Data Sharing
We do not sell, rent, or trade personal data. We share data only in the following limited circumstances:
- CrossRef / DOI Foundation: DOI metadata is submitted for indexing as part of our verification workflow.
- ORCID: We query the ORCID API to verify researcher identities. No data is written to ORCID without explicit consent.
- Infrastructure providers: Hosting, security, and monitoring services operating under data processing agreements in compliance with GDPR Article 28.
- Legal authorities: Where required by a court order, legal process, or statutory obligation.
6. Data Retention
- Verified physician profiles: Retained for the duration of the physician's active status, plus 7 years following formal deactivation.
- Publication records and cryptographic hashes: Retained permanently for the integrity of the verification chain.
- Contact and enquiry data: Deleted after 24 months from last correspondence.
- Access logs: Anonymised after 90 days, deleted after 12 months.
7. Your Rights Under GDPR
If you are located in the European Economic Area (EEA), you have the following rights:
- Right to Access — request a copy of the personal data we hold about you.
- Right to Rectification — request correction of inaccurate or incomplete data.
- Right to Erasure — request deletion of your personal data, subject to legal retention requirements. Note: cryptographic document hashes are irreversible and cannot be deleted without compromising verification integrity.
- Right to Portability — receive your personal data in a structured, machine-readable format.
- Right to Object — object to processing based on legitimate interests.
- Right to Withdraw Consent — withdraw consent for optional communications at any time.
To exercise any of these rights, contact [email protected]. We will respond within 30 days.
8. Cookies
We use strictly necessary session cookies to maintain security and platform functionality. We do not use advertising cookies, cross-site tracking cookies, or third-party analytics services that transfer data outside the EEA.
9. International Data Transfers
Where personal data is transferred outside the EEA, we ensure adequate protections are in place through Standard Contractual Clauses (SCCs) as approved by the European Commission.
10. Security
We implement industry-standard technical and organisational security measures including TLS 1.3 encryption in transit, AES-256 encryption at rest, access controls, regular security audits, and anomaly detection systems. Our infrastructure complies with ISO 27001.
11. Changes to This Policy
We may update this Privacy Policy periodically. Material changes will be communicated via the platform and/or registered email addresses. Continued use of GlobalDocsHub following notification constitutes acceptance of the revised policy.
12. Contact & Complaints
For privacy enquiries: [email protected].
You also have the right to lodge a complaint with your national data protection supervisory authority.