Privacy notice

Last updated 29 October 2026

This notice explains what personal information the Thoracic Outlet Syndrome International Collaborative (“TOSIC”, “we”) collects through this website and the members’ area, why we collect it, who processes it on our behalf, how long we keep it and what you can ask us to do with it. It covers everyone who uses the site: visitors, patients, applicants, members, centers and newsletter subscribers.

If anything here is unclear, or you want to use any of the rights described below, write to info@tosicollaborative.org.

1. Who is responsible for your information

TOSIC is responsible for the personal information collected through this website and decides how it is used. Requests about your information are handled by the Executive Committee, which you can reach at the address above.

2. What we collect, and why

Membership applications and CVs

When you apply to join, we collect your name, email address, specialty, institution, country, the professional details you choose to give us and the CV you upload. We use them only to assess your application, to contact you about it and, if you are accepted, to set up your membership and issue your membership certificate. Your CV is seen only by the people reviewing applications. We rely on the steps you have asked us to take before membership, and on our legitimate interest in admitting qualified professionals.

Member accounts and profiles

Members have an account with a sign-in email and password. Passwords are handled by our authentication provider and are never visible to TOSIC. Your profile (name, specialty, institution, country, biography, photo, expertise and publications) is used to run your membership. It appears in the members’ directory, which only signed-in members can see, and you can hide it at any time from My profile. If you serve on the Executive Committee, the Advisory Board or as a country representative, your name, role, institution, photo and biography are also published on the About pages. We also keep a record of significant actions taken in the members’ area and dashboard (an audit log) so that changes to members’ records can be traced.

Membership certificates

Each certificate carries a number. Anyone who has that number can confirm on the verification page that it is genuine; the page shows the member’s name, the type of membership and its dates, and nothing else.

Patient stories

If you share your story in the Patient Corner, we collect the name you want shown, your country, the type of TOS if you know it, your email address and your story. Your email is never published; we use it only to contact you before publication. We publish a story only with the consent you give on the form, edited for length and with identifying details removed. You can withdraw your consent at any time, and we will take a published story down. Because a story can include details of your health, we ask you not to include anything that would identify you or your doctors unless you want it published.

Contact messages

When you write to us through the contact form or “Ask the TOSIC team”, we collect your name, email address and message, and use them only to answer you.

If you subscribe, we keep your email address and the date you subscribed, and send you a few emails a year about the collaborative. Every newsletter has an unsubscribe link, and unsubscribing takes effect straight away. We rely on your consent, which you can withdraw at any time.

Center applications and affiliations

When a center applies to be listed, we collect the center’s details and the name, email address and phone number of its contact person. Approved centers are shown publicly on the Find a TOS Center map with the details the center provided for publication. Members’ affiliation requests link their profile to a center once the center confirms them.

Registry and center data

The TOS Registry is built from de-identified records submitted by participating centers. Patients’ names, national identity numbers, dates of birth and similar direct identifiers are not accepted: the database itself refuses any record that contains them. Each record receives its own registry case ID, and the center’s local hospital reference is kept so that the submitting center, and only that center, can match the record to its own files. Each participating center remains responsible for the ethics approval and patient consent required at its institution before it submits data. Registry data are used only for the research purposes described on the Research Hub, and are released only through the registry access procedure.

Clinical cases, research proposals and study participation

Members who submit cases are asked to remove anything that identifies the patient before submission; cases are reviewed before they are shown to other members. Research proposals and study participation requests are kept so that they can be reviewed and tracked.

The AI assistant

Questions you type into Ask TOSIC are sent to an AI model, through Netlify’s AI Gateway, to produce an answer from the collaborative’s own published material. TOSIC does not keep a record of the questions or answers. Please do not type names or other details that identify you or a patient.

The symptom self-check and clinical tools

The patients’ self-check and the clinical calculators run entirely in your browser. Nothing you enter in them is sent to us or stored by us.

3. Cookies and similar technology

We do not use advertising cookies, tracking pixels or third-party analytics. The site stores a small amount of information in your browser: a copy of the site’s wording so pages open quickly, and, if you sign in, the session that keeps you signed in. Pages load fonts from Google Fonts, and the center map loads its map tiles from OpenStreetMap and its map library from unpkg; those services receive your IP address in order to send the files to your browser.

4. Who processes your information for us

We do not sell personal information and we do not share it for marketing. We use these service providers, who process it only on our instructions:

Google Firebase — member accounts and sign-in, the database (applications, profiles, center and registry data, messages, newsletter subscriptions) and file storage (CVs, photos, documents).
Netlify — hosting of the website, the patient-story form inbox, and the server functions that send email and run the AI assistant.
Brevo — sending the platform’s emails and the newsletter.
AI model providers through Netlify AI Gateway — generating answers to questions typed into the assistant.

Some of these providers process data outside your country, including in the United States. Where that happens, we rely on the safeguards the providers offer for international transfers, such as standard contractual clauses. We may also disclose information where the law requires us to.

5. How long we keep it

Applications and CVs from accepted applicants are kept for as long as the membership lasts. Declined or withdrawn applications, with their CVs, are deleted within twelve months of the decision.
Member profiles are kept while the membership is active and deleted within twelve months of it ending, except for the membership record needed to verify certificates already issued.
Contact messages are kept for up to two years after the conversation ends.
Newsletter addresses are kept until you unsubscribe.
Patient stories that are not published are deleted within twelve months; published stories stay up until you ask us to remove them.
De-identified registry records are kept for as long as the registry runs, so that long-term outcomes can be studied.
Audit-log entries are kept for as long as the records they relate to.

6. Your rights

Depending on where you live, you may have the right to ask for a copy of the information we hold about you, to have it corrected or deleted, to restrict or object to how we use it, to receive it in a portable form, and to withdraw any consent you have given. Members can correct most of their details themselves in the members’ area. For anything else, write to info@tosicollaborative.org; we will answer within one month. If you are not satisfied with our answer, you can complain to the data protection authority in your country.

7. Security

The site is served only over encrypted connections. Access to each kind of record is enforced by the database itself rather than by the interface: members-only material cannot be read without an active account, members cannot change their own permissions or other members’ records, and the audit log cannot be edited or deleted. Data are backed up regularly. No system is perfectly secure; if a breach affects your information, we will tell you and the relevant authority as the law requires.

8. Children

The members’ area is for healthcare professionals. Patient stories from people under 16 should be sent by a parent or guardian.

9. Changes to this notice

When we change this notice, we update the date at the top of the page. If a change materially affects how we use information we already hold, we will tell members and subscribers by email.

See also the Terms of use and the Publication policy.