Privacy Policy

Effective Date: 8 September 2026
Last Updated: 8 September 2026

HIV Risk Report (“HIV Risk Report,” “we,” “us,” or “our”) takes the privacy of personal, health, and sexual-health information seriously. This Privacy Policy explains how we collect, use, store, disclose, and protect information when you visit hivriskreport.com, contact us, or, when available, request a personalised HIV Risk Report.

1. Who Is Responsible for Your Information?

For UK data-protection purposes, the data controller responsible for the processing described in this Privacy Policy is:

Trading Name: HIV Risk Report
Email: team@hivriskreport.com

2. Information We Collect

a. Information You Provide Directly

Depending on how you use the website, we may collect information that you voluntarily provide, including:

• Your email address when required for report delivery or support
• Information contained in communications you send to us
• Country or geographic information you voluntarily provide
• Information required to process or confirm an order

b. Personalised Assessment Information

When personalised assessments are available, the information you voluntarily submit may include:

• Date of a possible HIV exposure
• Country in which an encounter occurred
• Your gender
• A sexual partner's gender
• Known or unknown HIV status of a partner
• Type of sexual activity
• Sexual role
• Condom use or condom failure
• PrEP-related information
• Information concerning HIV treatment where relevant
• Wounds, inflammation, or other reported physical factors
• Circumcision status where relevant to the requested assessment
• Ejaculation information where relevant
• Information about partner background voluntarily supplied by you
• Other information reasonably necessary to prepare the requested report

Some of this information may reveal information concerning health, sex life, or sexual orientation and may therefore receive additional protection under applicable privacy law.

c. Information Generated From Assessment Inputs

When a personalised assessment is requested, we may generate information based on the answers supplied, including:

• Statistical risk estimates or risk categories
• Explanations of factors relevant to the reported encounter
• Testing-window dates calculated from a supplied exposure date
• Educational information relating to HIV transmission and testing

Generated information may itself constitute health-related personal information.

d. Payment Information

Payments, when offered, are processed by Stripe or another payment provider. HIV Risk Report does not intentionally collect or store full payment-card numbers.

We may receive limited transaction information such as payment status, transaction identifier, amount, and transaction date.

e. Automatically Collected Information

Our website and service providers may automatically receive limited technical information such as:

• IP address
• Browser type
• Device type
• Operating system
• Pages visited
• Approximate country or region
• Referring webpage
• Date and time of website activity
• Cookie and privacy preferences

3. Why We Use Personal Information

Depending on the services being used, personal information may be processed to:

• Operate and maintain the website
• Generate and deliver a personalised report requested by a user when that service is available
• Calculate dates or statistical information required for a requested report
• Process and confirm payments
• Respond to customer-support requests
• Protect the website against fraud, misuse, and security threats
• Maintain necessary financial and transaction records
• Comply with applicable legal requirements
• Understand general website performance through analytics where permitted by applicable law and cookie preferences

We do not use sexual-health assessment answers to target advertising to you.

4. UK GDPR: Article 6 Lawful Basis

Where UK GDPR applies, we identify an appropriate Article 6 lawful basis for each processing activity.

5. Special-Category Health and Sexual-Health Information

Under UK data-protection law, information concerning health, sex life, or sexual orientation may constitute special-category personal data.

Where HIV Risk Report processes this type of information in order to prepare a personalised assessment, the Article 9 condition we rely on is:

Article 9(2)(a): Explicit Consent.

Before a personalised assessment is submitted, the user will be asked to expressly confirm that they consent to HIV Risk Report processing the health and sexual-health information they provide for the purpose of preparing the report they requested.

This consent is separate from simply visiting the website or reading this Privacy Policy.

Where processing relies on consent, consent may be withdrawn by contacting us. Withdrawal does not affect processing that was lawful before consent was withdrawn.

6. AI-Assisted Report Preparation

When personalised reports are available, a human operator may use OpenAI's ChatGPT or another general-purpose artificial-intelligence service to assist with drafting, organising, calculating, checking, or formatting report content.

Only assessment details reasonably necessary to prepare the requested report may be entered into the AI service. Depending on the assessment, these may include information such as:

• Type of sexual exposure
• Sexual role
• Partner HIV status where reported
• Country
• Condom use
• PrEP use
• Other relevant risk factors supplied in the assessment

HIV Risk Report intentionally separates direct contact information, such as an email address, from the information submitted to the AI service for preparation of the report.

The workflow is initiated by a human operator. Customers do not directly interact with ChatGPT through the HIV Risk Report website as part of this process.

The fact that direct identifiers are excluded does not necessarily mean that assessment information is legally considered anonymous in every circumstance. We therefore continue to treat the underlying assessment information as sensitive and apply appropriate privacy protections.

7. Service Providers and Data Disclosure

We may use third-party service providers where reasonably necessary to operate HIV Risk Report.

Depending on the service being used, these may include:

• Squarespace for website, hosting, and form infrastructure
• OpenAI / ChatGPT to assist a human operator with preparation of a requested report. Direct identifiers such as name, email address, and payment details are not intentionally included in the information submitted to ChatGPT.
• Stripe or another payment processor for payment processing
• Email or communications providers used to communicate with users or deliver reports
• Hosting, storage, security, or technical-service providers where reasonably necessary
• Professional advisers where reasonably necessary for legal, accounting, regulatory, or security purposes

We may also disclose information where disclosure is required by applicable law, a valid court order, or other binding legal process.

We do not sell personal information or consumer health data.

We do not intentionally provide assessment answers to advertising networks for behavioural advertising.

8. Data Retention and Deletion

We seek to retain sensitive assessment information only for as long as reasonably necessary to prepare, review, deliver, and support the requested report.

Assessment Forms and Generated Reports

When personalised assessments are available, submitted assessment forms and generated report files are deleted on a rolling basis.

Our standard process is to delete submitted assessment forms and generated report files at least twice per week.

Information may be retained for longer where reasonably necessary to investigate an active dispute, security incident, fraud, valid legal request, or to establish or defend legal rights.

Transaction and Accounting Records

Payment and transaction records may need to be retained for longer where necessary for accounting, tax, fraud-prevention, or legal requirements.

Where transaction records must be retained, this does not mean the underlying sexual-health questionnaire must also be retained.

Service Provider Backups

Some deleted information may temporarily remain in service-provider backup systems until those backups are overwritten or expire through normal backup processes.

9. Your UK and European Privacy Rights

Where applicable, you may have the right to:

• Request access to personal information held about you
• Request correction of inaccurate personal information
• Request deletion in applicable circumstances
• Request restriction of processing
• Object to certain forms of processing
• Receive qualifying data in a portable format
• Withdraw consent where processing relies on consent
• Complain to the relevant data-protection supervisory authority

UK users may lodge a complaint with the Information Commissioner's Office.

To exercise a privacy right, contact: team@hivriskreport.com

We may need to take reasonable steps to verify the identity of a person making a privacy request before disclosing or deleting information.

10. U.S. Consumer Health Data Privacy

Consumer Health Data We May Collect

When a personalised assessment is available, consumer health data may include:

• Sexual activity and sexual-exposure information
• HIV-related information
• PrEP or PEP-related information
• Physical health factors voluntarily reported
• Testing and exposure-date information
• Information concerning sexual health or sex life
• Health-related information generated from submitted assessment answers

Sources of Consumer Health Data

Consumer health data may be obtained directly from the user when the user voluntarily submits an assessment or contacts HIV Risk Report.

Additional health-related information may be generated from those answers for the purpose of preparing the requested report.

Why We Use Consumer Health Data

Consumer health information may be used to:

• Prepare the assessment requested by the user
• Generate and deliver the requested report
• Provide relevant educational information
• Respond to questions about a report
• Protect the security and integrity of the service
• Meet applicable legal requirements

Consumer Health Data Sharing

HIV Risk Report does not sell consumer health data.

Consumer health information may be processed by service providers where reasonably necessary to provide the requested service.

These categories may include:

• Website and form-hosting providers
• AI-assisted report-preparation providers
• Email or report-delivery providers
• Security, storage, and technical-infrastructure providers
• Professional advisers where reasonably necessary

When ChatGPT is used to assist in report preparation, HIV Risk Report does not intentionally submit the customer's name, email address, or payment information to ChatGPT.

U.S. Consumer Health Privacy Rights

Depending on where you live and whether a particular state law applies to HIV Risk Report, you may have rights to:

• Confirm whether we collect certain consumer health data
• Access qualifying consumer health data
• Request deletion of qualifying consumer health data
• Withdraw qualifying consent
• Receive information concerning qualifying disclosures of consumer health data
• Appeal certain decisions concerning a privacy request where applicable

Requests may be sent to: team@hivriskreport.com

11. Cookies and Analytics

HIV Risk Report may use cookies and similar technologies that are necessary for website functionality, security, payment processing, and privacy preferences.

Non-essential analytics or similar technologies are subject to the website's cookie controls where consent is required by applicable law.

Continuing to browse the site is not treated as consent to non-essential cookies where affirmative consent is legally required.

We do not intentionally configure analytics or advertising services to receive sexual-health questionnaire answers, HIV-status information, or personalised risk-report results.

12. International Data Transfers

Some providers used to operate the website or prepare reports may process information outside the United Kingdom, including in the United States.

Where UK data-protection law treats a transfer as a restricted international transfer, we seek to rely on an appropriate transfer mechanism available under applicable law.

Depending on the provider and circumstances, this may include:

• UK adequacy regulations
• An applicable UK-approved data-transfer framework
• The UK International Data Transfer Agreement
• The UK Addendum to approved standard contractual clauses
• Another legally permitted safeguard or exception

We do not treat general use of this website as consent to an otherwise unlawful international transfer.

13. Data Security

HIV Risk Report uses reasonable technical and organisational measures intended to protect personal information, taking account of the sensitivity of the information processed.

Measures may include:

• Encrypted HTTPS connections
• Restricted access to assessment information
• Account authentication and access controls
• Data minimisation
• Short retention periods for assessment information
• Use of established hosting and payment providers

No online service can guarantee absolute security. If a qualifying personal-data or consumer-health-data security incident occurs, we will assess and respond to it in accordance with applicable law.

14. Children and Minors

The personalised HIV Risk Report assessment, when available, is intended only for individuals aged 18 or over.

Individuals under 18 should not submit sexual-health information through the personalised assessment.

If we become aware that a minor has submitted sensitive assessment information contrary to this policy, we will take reasonable steps to delete or appropriately handle that information, subject to applicable law.

15. Automated Decision-Making

HIV Risk Report does not use assessment information to make decisions concerning employment, insurance, credit, housing, or other decisions producing legal or similarly significant effects.

Statistical information contained in a report is not used by HIV Risk Report to determine eligibility for services, insurance, employment, financial products, or other legal rights.

16. Privacy and Security Incidents

Where applicable law requires notification following a qualifying privacy or security incident, HIV Risk Report will provide notification to affected individuals or relevant authorities as required.

17. Changes to This Privacy Policy

We may update this Privacy Policy when our practices, providers, technology, or legal obligations change.

When changes are made, the "Last Updated" date at the top of this page will be changed to reflect the actual date of revision.

Where a material change requires additional notice or consent under applicable law, we will provide that notice or obtain that consent.

Continued use of the website will not be treated as explicit consent to a new use of special-category health or sexual-health information where affirmative consent is required.

18. Contact Information and Privacy Requests

Questions, privacy requests, deletion requests, or consent-withdrawal requests can be sent to:

HIV Risk Report
Email: team@hivriskreport.com
Website: hivriskreport.com

This Privacy Policy describes HIV Risk Report's privacy practices and is not intended to limit any rights that cannot lawfully be limited under applicable privacy or data-protection law.