This policy explains how DeepLabel collects and uses personal data when you visit deeplabel.io, contact us, work with us as a client or supplier, or review work as a clinician.
1. Who we are
DeepLabel is part of BiteWorld Ltd, a company registered in England and Wales (company number 12565515), whose registered office is at The Old School House, West Street, Fareham, Hampshire PO17 6EA. In this policy, "DeepLabel", "we", "us" and "our" mean BiteWorld Ltd acting through its DeepLabel business.
BiteWorld Ltd is the controller of the personal data described in this policy. This policy covers deeplabel.io and DeepLabel's services only. Other BiteWorld websites, including bitelabs.io, have their own policies.
Contact details
- General enquiries: azeem@deeplabel.io
- Data protection officer: Dr Zac Hana, zac@biteworld.io
You have the right to complain at any time to the Information Commissioner's Office (ICO), the UK regulator for data protection (ico.org.uk). We would appreciate the chance to deal with your concerns first, so please contact us in the first instance.
2. Who this policy covers
This policy applies to:
- visitors to deeplabel.io;
- people who send us an enquiry or contact us;
- contacts at our clients, prospective clients and suppliers;
- clinicians and other professionals who apply to review work, or who review work on DeepLabel projects ("reviewers").
Our website and services are not intended for anyone under 18, and we do not knowingly collect data about children.
Data in client projects
When a client asks us to annotate, review or evaluate data that contains personal data (for example, medical images, clinical records or AI-generated outputs), we normally act as a processor on that client's behalf, and the roles are confirmed in our written agreement with each client. As a processor, we process that data only on the client's documented instructions and under our written agreement with them. The client's own privacy notice explains how that data is used. We do not use client project data for our own purposes.
3. The data we collect
Personal data means any information about an individual from which that person can be identified. Depending on how you interact with us, we may collect:
- Identity data: name, title and similar identifiers.
- Contact data: email address, telephone number and business address.
- Professional data: job title, organisation and, for reviewers, specialty, qualifications, professional registration details, CV and experience.
- Enquiry data: information you give us about your project, needs and timeline.
- Financial and transaction data: billing details for clients and payment details for reviewers and suppliers, and records of payments.
- Project performance data (reviewers): quality assurance results, agreement metrics and feedback relating to your review work.
- Technical data: IP address, browser type and version, device and operating system, time zone setting and similar information.
- Usage data: information about how you use our website.
- Marketing and communications data: your preferences for receiving marketing from us.
We also use aggregated data, such as statistics about website use. Aggregated data is not personal data if it cannot identify you.
We do not ask for special category data (such as health information, ethnicity or religious beliefs) through our website or enquiries. Please do not include patient data or other sensitive personal data in enquiries.
If you do not provide data we need under a contract or by law, we may not be able to perform that contract.
4. How we collect your data
- Directly from you when you complete a form, email or call us, apply to review work, agree a contract with us, or give us feedback.
- Automatically when you use our website, through cookies and similar technologies. Optional analytics only run if you agree. See our Cookies Policy.
- From the BiteLabs network, when you are part of the BiteLabs community and have expressed interest in DeepLabel projects (see section 7).
- From public sources, such as professional registers (for example, the General Medical Council register), Companies House and professional networking sites.
- From service providers, such as payment providers.
5. How we use your data
We only use personal data when the law allows us to. The table below sets out our purposes and the lawful bases we rely on.
| Purpose | Data | Lawful basis |
|---|---|---|
| Responding to your enquiry and discussing a potential project | Identity, contact, professional, enquiry | Legitimate interests (responding to business enquiries); taking steps before entering a contract |
| Delivering services and managing our relationship with clients | Identity, contact, professional, financial, transaction | Performance of a contract; legitimate interests (running our business) |
| Recruiting, verifying, onboarding and paying reviewers | Identity, contact, professional, financial, transaction | Performance of a contract; legal obligation; legitimate interests (making sure reviewers are appropriately qualified) |
| Quality assurance of review work | Identity, professional, project performance | Performance of a contract; legitimate interests (delivering reliable, high-quality outputs to clients) |
| Administering and protecting our business and website | Identity, contact, technical | Legitimate interests (running our business, IT security, fraud prevention); legal obligation |
| Understanding how our website is used | Technical, usage | Consent, where optional analytics are used |
| Sending you updates about DeepLabel | Identity, contact, marketing and communications | Consent; or legitimate interests for existing business contacts, with an easy way to opt out |
We will only use your data for the purpose we collected it for, unless we reasonably consider a new purpose is compatible with the original one. If we need to use your data for an unrelated purpose, we will tell you and explain the lawful basis.
6. Marketing
We will only send you marketing emails if you have opted in (for example, by ticking the box on our contact form), or if you are an existing business contact and we are telling you about similar services. You can unsubscribe at any time using the link in any email or by contacting us.
We do not sell your personal data, and we do not share it with third parties for their own marketing.
7. BiteWorld and BiteLabs
DeepLabel and BiteLabs are both part of BiteWorld Ltd. DeepLabel draws on the BiteLabs clinician network to find reviewers for projects. If you are a member of the BiteLabs community and have agreed to hear about relevant opportunities, we may use your BiteLabs profile information to consider you for DeepLabel projects.
We do not pass enquiry or client contact data to other BiteWorld brands for their marketing unless you have agreed to this.
8. Who we share your data with
- Service providers acting as processors, such as website hosting, email, document storage, customer relationship management and payment providers. They may only use your data on our instructions.
- Clients, in the case of reviewers, where a client needs limited information to confirm the review team's suitability (for example, specialty and level of experience). We share the minimum needed and anonymise where we can.
- Professional advisers, such as lawyers, accountants, auditors and insurers.
- HM Revenue & Customs, regulators and other authorities where we are required to by law.
- Buyers or successors, if we sell, transfer or merge any part of our business. They may use your data in line with this policy.
We require everyone we share data with to keep it secure and to process it lawfully.
Website and booking providers
- Netlify, Inc. (United States) hosts deeplabel.io and processes our enquiry and specialist panel forms. When you submit a form, Netlify receives and stores the details you enter and emails them to us. Netlify also processes technical data, such as your IP address, to deliver and secure the website.
- Calendly LLC (United States) provides our call booking page. If you book a call, Calendly collects the details you enter, such as your name, email address and any answers you give, and shares them with us. Calendly's own privacy notice also applies when you use its booking page.
9. International transfers
Some of our service providers may process data outside the UK. Where they do, we make sure your data is protected to UK standards, for example by relying on UK adequacy regulations or by using the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses.
Netlify and Calendly are based in the United States, so data you submit through our forms or booking page may be processed there. Where a provider is certified under the UK Extension to the EU-US Data Privacy Framework, we rely on the UK adequacy regulations for that transfer. Otherwise, we rely on the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses in that provider's data processing terms.
10. Security
We use appropriate technical and organisational measures to protect personal data from being lost, used or accessed in an unauthorised way, altered or disclosed. Access is limited to people who need it, and they must keep it confidential. We have procedures to deal with any suspected personal data breach and will notify you and the ICO where we are legally required to.
11. How long we keep your data
- Client, supplier and reviewer records: usually six years after our relationship ends, for legal, accounting and tax purposes.
- Enquiries that do not lead to a project: up to two years after our last contact, unless you ask us to delete them sooner.
- Marketing preferences: until you unsubscribe, after which we keep a record so we do not contact you again.
- Client project data: as set out in our agreement with the client.
We may anonymise data so it can no longer identify you and use it for statistical purposes without further notice.
12. Your rights
Under UK data protection law, you have the right to:
- request access to your personal data;
- request correction of inaccurate or incomplete data;
- request erasure of your data;
- object to processing based on legitimate interests, and to direct marketing at any time;
- request restriction of processing;
- request transfer of your data to you or a third party;
- withdraw consent at any time, where we rely on consent.
To exercise any of these rights, contact us using the details in section 1. You will not usually need to pay a fee, although we may charge a reasonable fee or refuse a request that is clearly unfounded, repetitive or excessive. We may ask you to confirm your identity. We aim to respond within one month, and will let you know if it will take longer.
If your request relates to client project data, we will pass it to the relevant client, who is the controller of that data.
13. Changes and contact
We review this policy regularly. Previous versions are available on request. Please tell us if your personal data changes while you are working with us.
Our website may link to other websites. We are not responsible for their privacy practices, so please read their policies.
Questions about this policy can be sent to azeem@deeplabel.io or to our data protection officer at zac@biteworld.io.