Privacy, Membership and Affiliation Terms

These terms govern CISBM registration, membership, affiliation, participation and use of its services. Part A establishes the conditions of participation and the limits of the authority granted to members. Part B explains the processing of personal information. The terms apply to cisbm.org and every subdomain of cisbm.org operated by or on behalf of CISBM, including membership, research, communication and training services. Material new obligations apply only after the notice and acceptance required by law; the stated effective date does not establish earlier acceptance or retrospectively change anyone's status.

Part A — Membership, Affiliation and Participation

A1 CISBM Identity and Institutional Capacity

Centre for Immunology, Genetics, and Systems Biology Limited, operating as CISBM, is registered in England and Wales under company number 17398473. Its registered office is 36 The Glen, Sheffield, England, S10 3FN, United Kingdom. CISBM is the contracting organisation for its own membership and services, subject to the scope of each approved activity.

CISBM website or research membership is participation in a programme operated by the company. It does not, by itself, make the participant a shareholder, statutory member of the company, director, employee, partner, agent or holder of voting or ownership rights under company law. A title, directory entry, email account or advisory appointment confers only the authority expressly granted for that role.

CISBM does not represent a grant-awarding body, guarantee funding or act as a research ethics committee. It does not issue research ethics approval codes. No member may represent a CISBM membership number, project reference, supervisor's approval or internal review as independent research ethics approval.

A2 Acceptance and Service Rules

An applicant must be given access to these terms before registration or another clear act of acceptance. By accepting them, the applicant agrees to the membership and participation conditions in Part A and acknowledges the privacy information in Part B. Privacy acknowledgement does not amount to blanket consent for optional processing.

Published eligibility criteria, academic requirements, conduct rules and operating instructions for a particular service form part of the participation arrangements when clearly identified and reasonably available before the participant elects to use that service. A separate signature is not required for each ordinary instruction within the agreed scope. Participants must comply with lawful and reasonable directions issued by authorised personnel for the safe and proper administration of the activity.

Undisclosed rules do not become binding merely because they are later placed on a website. A new fee, materially different obligation, additional data-processing consent or other change requiring express agreement cannot be imposed solely through this clause. Mandatory statutory rights take precedence over inconsistent service rules. A project-specific written agreement prevails over general terms on the matters it expressly addresses, without displacing mandatory law or the privacy protections applicable to its processing.

A3 Free Services and Financial Separation

CISBM's registration, membership, affiliation assessment and its own research, training and participation opportunities are free. Selection and progression depend on merit, eligibility, available capacity and the stated requirements of the relevant opportunity. CISBM does not sell membership, institutional affiliation, authorship, ethics approval, academic rank or preferential access.

CISBM does not operate programmes requiring it to collect or disburse participant payments. It does not receive, hold, route or distribute membership fees, tuition fees, supervision payments, grant funds or participant funds under these arrangements. No participant may collect money in CISBM's name, issue a CISBM invoice, give CISBM payment instructions or commit the company to an expenditure without separate lawful corporate authority. These terms confer no such authority.

A project may nevertheless involve costs or funding outside CISBM, including a funder's award to an eligible institution, purchases of consumables by an investigator or host, journal charges, or independently contracted personal supervision. The relevant parties must arrange and document those matters directly. They must identify the actual recipient, payer, service provider and responsibility for any refund or dispute. Such arrangements are not CISBM fees, company receipts or company disbursements, and must not be represented as such.

A supervisor's private paid service is separate from their CISBM role. Acceptance of that service must not be a concealed condition of access to a CISBM opportunity advertised as free. Payment cannot purchase favourable membership decisions, affiliation, authorship or relief from conduct requirements. Any conflict between private financial interests and CISBM responsibilities must be disclosed and managed.

CISBM's intended non-trading, no-programme-payment model does not determine its statutory accounting or tax status. Dormancy and filing obligations depend on the applicable legal tests and actual transactions. Nothing in these terms authorises the concealment, misclassification or diversion of a company transaction.

A4 Eligibility and Applicable Obligations

Applicants must have legal capacity to enter the applicable arrangement, satisfy the published criteria, provide accurate information and be legally permitted to participate in a programme operated by a company registered in England and Wales. Any necessary parent, guardian, employer, institution or other authorisation must be obtained before the relevant participation begins.

Each participant confirms that they have taken reasonable steps to establish their eligibility under laws actually applicable to them and the activity. This includes relevant laws of England and Wales and UK-wide requirements, and applicable laws of their nationality, residence, ordinary residence and the place where work or data processing occurs. Nationality alone does not make every law of that country applicable to every activity. Sanctions, export controls, professional licensing, employment, research, data protection and institutional restrictions must be observed where relevant.

Participants must not breach a binding institutional agreement, employment duty, confidentiality undertaking, intellectual property obligation, funding condition or restriction on external affiliation or collaboration. CISBM membership does not override such obligations. Conflicts must be disclosed before undertaking the affected activity, without improperly disclosing confidential material.

Where eligibility is uncertain or circumstances change, the participant must notify CISBM promptly and pause any activity that may be prohibited. An applicant must not claim compliance without a reasonable basis or conceal a restriction to secure acceptance. CISBM may request proportionate evidence or decline to proceed where compliance cannot reasonably be established. The participant's confirmation does not transfer CISBM's own legal duties to the participant.

A5 Admission and Availability

Submission of an application, completion of identity verification or satisfaction of minimum criteria does not guarantee admission, progression, a particular supervisor or a project place. CISBM reserves discretion to accept, reject, defer or limit applications based on merit, suitability, capacity, the research scope, conflicts, verification results and documented legal or operational constraints.

An opportunity may be limited to specified institutions or locations where this reflects legitimate eligibility conditions, available supervision, institutional permissions, funder requirements, legal restrictions or the ability to provide the service. CISBM may decline an application where an applicable sanctions, export-control or other legal restriction prevents participation, or where a necessary institutional arrangement is unavailable.

Decisions must comply with applicable equality and non-discrimination law. This reservation does not authorise arbitrary exclusion by nationality, ethnicity or another protected characteristic. A genuine operational restriction must not be used as a pretext for unlawful discrimination. CISBM need not disclose confidential third-party information or legally restricted compliance information when communicating a decision.

A6 Information Accuracy and Account Responsibility

All information submitted in applications, profiles, CVs, credential records, publication lists, correspondence and participation records must be accurate, complete in material respects and not misleading. A participant must not use a false identity, forged document, invented qualification, false institutional association, fabricated publication or metric, another person's account, or an undisclosed duplicate account to obtain a benefit.

Participants must correct errors promptly, report a material change of circumstances and cooperate with proportionate verification. Verification of a document or email address is not approval of every claim in an application. Acceptance based on inaccurate information does not prevent later review or cancellation of an improperly obtained benefit.

Credentials must be kept secure and used only by the authorised holder. Account sharing, impersonation, attempts to bypass a suspension or ban, and interference with access controls are prohibited. Deliberate or reckless material misinformation engages the termination and ten-year exclusion provisions below. An innocent, immaterial error corrected promptly is not automatically treated as fraud; CISBM may require correction or suspend a disputed claim pending verification.

A7 Membership Categories and Governance

Registered membership, also described as Regular membership where that label is used, permits only the activities expressly made available to that category. It gives no right to list CISBM as an institutional affiliation. Affiliated membership and any higher category require express approval and continuing satisfaction of the relevant conditions. A technical display error, unreviewed profile entry or administrative delay is not an affiliation approval.

Authorised administrators, supervisors and the Supreme Advisory Council may assess performance and suitability, allocate or end project participation, and recommend or decide promotion, demotion, renewal, suspension or removal within their delegated responsibilities. Decisions may take account of work quality, reliability, communication, timely delivery, research integrity, available supervision, conflicts and the published requirements of the role.

CISBM retains academic and operational discretion and does not guarantee progression. That discretion must be exercised honestly, for a relevant purpose and consistently with applicable law. A supervisor's decision to discontinue a project does not, by itself, erase an earned authorship contribution or determine every question of wider membership status. Decisions on misconduct and exclusion follow the provisions below.

A8 Affiliation Eligibility and Verified Academic Email

Only an actively approved Affiliated member or a member of a higher category that expressly includes affiliation rights may use the CISBM affiliation. Approval must cover the relevant period and, where required, the particular work. Registered or Regular members must not list CISBM as their institutional affiliation in a manuscript, abstract, preprint, conference submission, grant application, professional profile or other output.

Eligibility for Affiliated membership and higher categories requires at least one current, verified academic email address registered on the member's CISBM account. This must be a CISBM-issued address or an address issued by a recognised academic or research institution and accepted by CISBM for this purpose. A personal consumer email address alone does not satisfy the requirement. An email's domain alone is insufficient where control of the account or its institutional status cannot be verified.

In correspondence and submissions identifying a CISBM affiliation, the member must use their verified CISBM-issued address or the verified institutional academic address registered on their CISBM account, subject to the receiving service's requirements. A new address must be registered and verified before it is used for that purpose. An address must not be used after entitlement to it has ended.

Members who lose the required verified academic email, whose approval expires, or who cease to satisfy another essential affiliation condition must notify CISBM and stop making new affiliation claims pending reapproval. An email account, even one issued by CISBM, does not independently grant affiliation rights or authority to represent the company.

A9 Standard Affiliation and Publication Approval

The standard affiliation is:

Centre for Immunology, Genetics, and Systems Biology, South Yorkshire, Sheffield, S10 3FN, United Kingdom

Members must use this wording unless CISBM approves a variation required by the publisher or the accurate circumstances of the work. The address is an institutional attribution. It must not be represented as proof that the author resides in the United Kingdom, works at a physical laboratory there, holds immigration permission, is employed by CISBM or performed experiments at that address.

Approval must be active and applicable when an output is submitted and when it is published. If approval will expire before publication, the author must seek an extension in advance. Without renewal or specific written permission for accurate historical attribution, the author must arrange removal of the current CISBM affiliation before publication and notify the journal or organiser as necessary.

Already published work must remain historically accurate. Expiry of an otherwise valid later affiliation does not automatically make a truthful earlier attribution false. Conversely, a name appearing in an existing submission or profile does not entitle a member to preserve an affiliation obtained through material misrepresentation or used outside its approved scope. Questions about historical attribution must be resolved with CISBM and the publisher through an accurate correction process.

CISBM may require verification of affiliation, confirmation of institutional permissions and an integrity or attribution review before its name is used. Approval of affiliation is not endorsement of every scientific conclusion, a guarantee of research quality or permission to suppress legitimate findings or criticism.

A10 Institutional Outputs and Attribution Permission

By using an authorised CISBM affiliation on an output, the member permits CISBM to identify and list that output as research associated with CISBM, including in its website, directory, reports and public research records. This permission covers an accurate citation, title, author names, bibliographic details, DOI or link, and an original factual description of the work.

The permission is non-exclusive and carries no royalty or payment entitlement for the bibliographic listing. It does not assign copyright or authorise reproduction of a full article, figure, photograph or protected abstract beyond the member's rights, the applicable licence or legal permission. Members cannot grant rights belonging to co-authors, employers or publishers. Unpublished material must not be publicised contrary to an embargo or confidentiality obligation.

CISBM may retain an accurate historical listing after membership ends, subject to applicable data protection rights and lawful retention. It may correct, annotate or remove a listing when affiliation, authorship or integrity is disputed or a publication is corrected or retracted. Listing an output does not mean that CISBM accepts legal responsibility for every act of every author.

A11 Representation and Member Communications

No member may bind CISBM, sign a contract for it, incur a liability in its name, offer employment, make a regulatory submission, solicit funds, issue a guarantee or speak as its official representative without express authority covering the particular act. Supreme Advisory Council membership permits representation only within the duties and authority delegated to that role; it is not unlimited corporate authority.

Statements, opinions and materials exchanged by members, including in internal groups, private discussions or member-managed channels, are their own unless expressly issued as an authorised CISBM communication. CISBM does not endorse content merely because a participant is a member, a channel bears its name or a message passes through its systems. Members remain responsible for the lawfulness, accuracy and professional character of their own communications.

CISBM does not assume responsibility for independent private communications or arrangements merely because it introduced the people involved. It may moderate, restrict access to, preserve or remove material within its control where reasonably necessary for safety, compliance or investigation, in accordance with Part B. This clause does not exclude responsibilities arising from CISBM's own acts, authorised representations, knowledge or legal duties.

Threats, harassment, discrimination, defamatory allegations, unauthorised disclosure, impersonation, unlawful material and attempts to conceal or facilitate misconduct are prohibited. Confidentiality does not prevent a lawful report to a competent authority, a protected disclosure, obtaining professional advice or the exercise of a legal right.

A12 Research Integrity and Publication Standards

Participants must observe applicable research and publication requirements, including the COPE Core Practices relevant to their role and the ICMJE Recommendations relevant to the work. These standards must be read together with the relevant journal, institution, funder and professional requirements. CISBM does not claim membership, certification or endorsement by COPE or ICMJE through this clause. The official standards are available at https://publicationethics.org/core-practices and https://www.icmje.org/recommendations/.

Fabrication, falsification, plagiarism, deceptive image manipulation, invented references, dishonest analyses, concealment of material limitations, manipulated peer review and misrepresentation of approvals, qualifications, contributions or conflicts are prohibited. Participants must preserve appropriate underlying records, use lawful and documented sources, disclose relevant methods and limitations, and correct errors responsibly.

For work governed by ICMJE authorship criteria, an author must make a substantial intellectual contribution to the study or its data, participate in writing or substantive intellectual revision, approve the final version and accept accountability for the work. All qualifying contributors must be included. A student, junior researcher or local collaborator must not be excluded by denying an opportunity to review or approve the manuscript. Supervision, payment, seniority, recruitment or membership alone does not earn authorship.

All authors must approve the version submitted and its authorship and affiliation details. Material changes require the approvals applicable to those changes. No participant may submit in another person's name, add an unwilling author, omit a qualifying contributor, or use a co-author's credentials without authority. Authorship disputes must be addressed through the responsible institutions and journal processes; membership sanctions cannot be used to remove legitimate scholarly credit.

Concurrent submission of substantially the same manuscript to multiple journals, undisclosed redundant publication and deceptive splitting or recycling of results are prohibited. Legitimate preprints, secondary publication and related papers must follow the receiving journal's rules and disclose relevant overlap. Participants must assess the legitimacy of a publication venue and must not knowingly use deceptive or predatory publication services or purchase fabricated peer review, authorship or acceptance.

Relevant financial and non-financial interests, funding and the funder's role must be disclosed. Use of artificial intelligence must follow the applicable journal and institutional rules, be disclosed where required and remain subject to human verification and accountability. AI cannot be an author. Confidential manuscripts, identifiable data and restricted material must not be supplied to an external AI service without the required authority and safeguards.

Participants must cooperate with legitimate correction, investigation and retraction processes. A disputed result is not automatically misconduct, and a retraction must not be described as a finding of fraud unless the evidence supports that description.

A13 Ethics Approval and Lawful Research

No participant may recruit research subjects, collect samples, access clinical or genetic records, conduct regulated experiments or transfer restricted data merely on the basis of CISBM membership or a supervisor's agreement. The responsible institution and investigators must obtain and maintain all necessary approvals, permissions, registrations, consent and data-access arrangements before the activity begins.

Applicable human research requirements, including the Declaration of Helsinki where relevant, and applicable animal welfare, biosafety and professional standards must be observed. An exemption from ethics review must be determined by the competent body or applicable rules, not invented by a member. Existing datasets and computational analysis do not automatically remove ethics, confidentiality, licensing or privacy obligations.

CISBM does not issue ethics codes and cannot replace a competent institutional review board or research ethics committee. Participants must accurately identify the approving body and reference, and must not retrospectively invent approval. The absence of a CISBM ethics committee is not permission to proceed without any approval required elsewhere.

A14 Grant Facilitation and External Arrangements

CISBM may facilitate introductions among scientists, collaboration planning, grant writing and preparation of applications. It does not represent a funding body, decide a funder's award, guarantee success or act as the recipient or financial administrator of a grant under these terms.

The actual applicants and eligible host or recipient institutions must satisfy funder requirements, obtain institutional approval, identify the correct legal entities and arrange lawful receipt, spending, reporting and auditing of funds. Members must not name CISBM as an applicant, grant recipient, financial host, sponsor or guarantor without separate written corporate authorisation and confirmation that the proposed arrangement is legally and operationally available. These terms provide no such authorisation.

Any funding for consumables, facilities, publication or personal supervision must be handled directly by the authorised parties under their own agreements. Describing an arrangement as independent does not make it independent if CISBM actually controls or undertakes it. Participants must not use CISBM introductions or affiliation to mislead a funder about facilities, employment, institutional support or financial responsibility.

A15 Protective Suspension and Investigation

CISBM may immediately restrict accounts, suspend project participation, pause affiliation use or remove access to sensitive material where there are reasonable grounds to suspect serious misconduct, unlawful activity, a material eligibility failure, a security threat or a significant breach of these terms. Advance notice is not required where delay would expose people, records, research or the organisation to material risk. Notice and an explanation will follow as soon as reasonably practicable, subject to lawful confidentiality restrictions.

A protective suspension is not a final finding of wrongdoing. CISBM may preserve relevant records and seek explanations, source data, approvals and proportionate verification. Participants must cooperate honestly, avoid interference with witnesses or evidence, and must not delete relevant records to frustrate a legitimate investigation. Disclosure and preservation of personal information remain governed by Part B and applicable law.

Before a final adverse finding, the affected person will ordinarily receive the substance of the concern and a reasonable opportunity to respond. Urgent measures may remain in place meanwhile. Decisions will be made by authorised personnel, with conflicts managed and reasons recorded. CISBM may rely on credible institutional or judicial findings while considering relevant contrary information; an untested allegation must not be presented as an established fact.

A16 Termination and Ten Year Exclusion

Deliberate or reckless material falsification of identity, qualifications, eligibility, publications, contributions or other information supplied to CISBM is a fundamental breach. Serious research misconduct, unlawful activity materially connected with CISBM participation, knowing affiliation misuse, or deliberate circumvention of a ban may also constitute a fundamental breach. Following a substantiated finding, the normal consequence is immediate termination of all relevant membership and affiliation permissions and a ten-year exclusion from reapplication and participation, subject to applicable law and any proportionate exception required by the circumstances.

The exclusion period is calculated from the established date of the misconduct. For a continuing course of wrongdoing, it runs from the last established act in that course. The decision must state the conduct date, decision date and resulting expiry date separately. If the ten-year period has already elapsed when the matter is discovered, the person does not automatically regain membership: any return requires a fresh assessment under current eligibility criteria. Further misconduct or circumvention may justify a separate decision and exclusion period for that new conduct.

For other breaches, CISBM may require correction or training, restrict a role, demote, suspend, remove a participant from a project, refuse renewal or terminate membership, having regard to seriousness, impact, intent, recurrence and cooperation. Reporting a concern in good faith, exercising a legal right or correcting an honest error must not itself be treated as misconduct.

There is no guaranteed reinstatement after a ban expires. A participant may request reconsideration on the basis of a material error, relevant new evidence, a conflict of interest or procedural unfairness. Wherever practicable, someone not responsible for the original finding will review the request. A review does not automatically stay protective restrictions. External complaint and legal rights are unaffected.

A17 Invalid Eligibility and Historical Affiliation

Affiliation permission is conditional on truthful material information, legal eligibility, current category approval and the other essential affiliation conditions. Permission cannot authorise unlawful conduct or an output outside the approved scope. A person who knows that an essential condition is no longer satisfied must stop relying on the permission immediately, whether or not CISBM has yet updated its systems.

If a later investigation establishes that approval was obtained by fraud or that an essential condition was absent during an identifiable period, CISBM may, to the extent permitted by law, rescind the improperly obtained approval or determine that affiliation permission was unavailable for that period. It may require cessation of the claim and seek an accurate correction from a journal, institution or other recipient. A later discovery does not validate an earlier false claim merely because the website displayed it at the time.

A retrospective finding must identify the evidence, the condition that was not satisfied and the period affected. CISBM's records must preserve both the original administrative history and the later determination. CISBM must not falsely state that it issued a termination notice earlier than it did or that every activity by the person was necessarily unlawful. Ordinary misconduct does not, by itself, erase a factually valid earlier membership or create a blanket exemption from CISBM's responsibilities.

Where participation was legally prohibited, CISBM may treat the affected activity or permission as ineffective to the extent required by applicable law and terminate or restrict the relationship accordingly. These terms do not make an otherwise lawful act a criminal offence, determine a court's findings, or remove an innocent third party's rights. Historical attribution must distinguish genuine past involvement from unauthorised representation.

A18 Service Interruption, Withdrawal and Closure

CISBM may change, reduce, suspend or discontinue an opportunity or service for legitimate reasons, including lack of capacity, withdrawal of supervision, failure to meet standards, legal restrictions, security incidents, loss of infrastructure, insolvency or dissolution. Where practicable, affected participants will receive reasonable notice and information about outstanding work and records. CISBM does not guarantee completion of a programme, uninterrupted membership, continued supervision, publication, a qualification, employment or a grant.

A participant may withdraw by notifying CISBM. Withdrawal or termination ends the permissions dependent on the role, but does not extinguish valid confidentiality obligations, outstanding integrity matters, lawful recordkeeping or the rights of co-authors and other parties. Participants must cooperate in an orderly handover of shared work and must not retain access credentials or copies they have no right to keep. They may retain material they are legally entitled or required to preserve.

An interruption or closure does not itself create a right to compensation merely because an anticipated free opportunity did not continue. This does not exclude a claim arising from a separate enforceable promise, CISBM's actionable breach or a right that cannot lawfully be excluded. Independent private supervision and funding arrangements remain matters for their actual contracting parties.

A19 Responsibility and Limits of Liability

Participants are responsible for their own submissions, research acts, representations, institutional permissions and independent arrangements. CISBM does not guarantee the accuracy of member-generated content or the performance of independent supervisors, publishers, funders or collaborators. It does not accept liability merely by providing a free platform, introduction or valid affiliation where the law does not otherwise impose responsibility.

To the extent permitted by applicable law, CISBM is not responsible for loss caused solely by a participant's unauthorised acts, an independent third party's conduct outside CISBM's control, or an event beyond CISBM's reasonable control that could not reasonably have been prevented or mitigated. Nothing relieves CISBM of reasonable steps required by its own legal or contractual duties.

For business use, and only so far as legally enforceable, CISBM excludes liability for indirect or consequential loss and loss of anticipated profit, revenue, opportunity or expected publication resulting from use of its free services. This provision does not impose a zero liability limit based on the absence of fees and does not remove any protection available to an individual under mandatory law.

Nothing excludes or limits liability for fraud or fraudulent misrepresentation, death or personal injury caused by negligence, or any other liability that cannot lawfully be excluded or limited. No participant agrees to surrender data protection rights, protected reporting rights, legitimate authorship credit or access to a court or competent authority. Liability remains determined by the applicable law and the actual facts.

A20 Governing Law and Administration

These terms and contractual disputes arising from them are governed by the law of England and Wales. The courts of England and Wales have jurisdiction, subject to any mandatory right to rely on another country's law or bring proceedings in another competent court. UK-wide company, regulatory and other requirements apply where relevant; this clause does not override laws that otherwise apply to a participant or an activity.

CISBM may update these terms for legal, regulatory, security, organisational or service reasons. Material changes will be brought to affected participants' attention before they apply where required. A person who does not accept a material change may stop the affected participation, subject to obligations already validly incurred. Continued participation may evidence acceptance only where the change has been properly communicated and that method is legally sufficient. Silence or an old privacy acknowledgement is not unlimited advance acceptance of future terms.

If a provision is unenforceable, the remaining terms continue to the extent legally possible. CISBM's delay in enforcing a right does not automatically waive it. Any waiver or special permission must come from a person authorised for that purpose. An informal assurance by a member cannot override a legal restriction or confer unapproved corporate authority.

Enquiries, review requests and notices may be sent through the contact details published at https://cisbm.org/contact/ or to the registered office identified in A1. CISBM may send individual administrative notices to the verified address held on the account; members must keep that address current. These contact arrangements do not restrict any legally valid method of giving notice or exercising a statutory right.

Part B — Privacy Policy

B1 CISBM Identity

Centre for Immunology, Genetics, and Systems Biology Limited, operating as CISBM, is a company registered in England and Wales under company number 17398473. Its registered office is 36 The Glen, Sheffield, England, S10 3FN, United Kingdom.

CISBM is responsible as controller for personal information used to operate its website, administer its membership, and organise activities for which it determines the purposes and means of processing. This policy explains the collection, use, disclosure, retention and protection of that information, together with the rights available to individuals.

Privacy enquiries, complaints and requests to exercise data protection rights may be sent to CISBM through the contact details published at https://cisbm.org/contact/ or by post to its registered office, marked "Privacy enquiry". No particular form or legal terminology is required to make a request.

B2 Policy Scope

This policy applies to visitors to https://cisbm.org and every subdomain operated by or on behalf of CISBM, account holders, membership applicants, members, advisors, collaborators, supervisors acting for CISBM, and participants in CISBM projects, training, mentorship and events. It also covers personal information supplied in correspondence, references, applications, complaints and administrative records.

A particular study, collaboration or activity may require additional privacy information identifying its controller, the information involved, recipients and retention arrangements. Such information supplements this policy for that activity. A university, research institution, journal or independently engaged supervisor may have separate responsibilities for information that it controls.

Part B concerns personal information. Membership, affiliation, research conduct and representation are governed by Part A. Acknowledging the privacy information does not waive statutory rights or constitute consent to every processing activity described here.

B3 Free Participation and Independent Supervision

CISBM does not charge fees for its own website services, registration, membership or CISBM participation. Eligibility, selection and progression depend on merit and the criteria stated for the relevant category, opportunity or activity. Payment is not a criterion for CISBM membership or advancement.

A supervisor may separately offer a paid service in a personal or independent capacity. Such an arrangement is separate from CISBM and must not be presented as a CISBM fee or as a purchase of CISBM membership, affiliation, authorship or preferential treatment. The independent provider is responsible for explaining its own processing of personal information. This policy covers information CISBM actually processes; it does not automatically cover the independent provider's payment, supervision or client records.

The financial separation requirements in A3 and A14 apply. CISBM will not request personal bank details as part of ordinary free membership registration. Members should not upload payment credentials or financial documents to membership, profile or identity-verification fields.

B4 Categories of Personal Information

Account and membership information. Name, email address, account and authentication identifiers, membership identifier, application information, requested and approved membership category, membership status, verification status, and records of relevant notices, permissions and agreements.

Academic and professional information. Qualifications, institution, country of affiliation, research interests and experience, ORCID identifier, biography, photograph, CV, professional links, publications, contributions and academic metrics supplied or associated with the relevant membership or profile function.

Identity-verification information. Submitted identity-document images, the information visible within them, and verification outcomes and review records. Depending on the document, the image may include a name, photograph, date of birth, nationality, document number, signature, address or other identifying details. The presence of a field on a document does not make that field necessary for every verification purpose.

Participation and governance information. Project applications, activity preferences, contributions, attendance or completion records where relevant, supervision correspondence, reviewer assessments, membership and affiliation decisions, conflicts of interest, complaints, and information needed to investigate a concern.

Communications and technical information. Messages and attachments supplied to CISBM; account, delivery and support records; and technical information generated when using the website or authentication service, such as request and security events, timestamps, browser or device information, and network identifiers where recorded by the relevant service.

Collection depends on the function used and the information supplied. Members should avoid adding unnecessary identity details, private addresses, health information or information about other people to biographies, CVs or free-text fields.

B5 Sources of Information

Information is obtained directly when an individual registers, applies, uploads a document, edits a profile, submits an enquiry or participates in an activity. It may also be supplied by authorised supervisors, reviewers, collaborators, institutions verifying credentials, and individuals raising concerns.

Relevant professional information may be obtained from ORCID, publication records, journal websites and other publicly available academic sources. Where information is obtained indirectly, CISBM will provide the privacy information required by applicable law, including the source or source category. Public availability does not remove an individual's data protection rights.

An individual supplying information about someone else must have lawful authority to disclose it and should provide only what the relevant process requires. Membership forms are not a channel for depositing patient records, identifiable research datasets or third-party identity documents.

B6 Processing Purposes and Lawful Bases

CISBM must identify and document an applicable lawful basis before processing personal information. The basis depends on the purpose, rather than on a general acceptance of this policy.

Accounts and requested participation. Information necessary to create and administer an account, assess a requested application, communicate a decision and deliver agreed participation is processed to take steps requested before entering an agreement or to perform that agreement, where the contractual basis applies. Administrative processing outside that necessity requires a separately documented basis, such as the legitimate interests described below.

Identity and credential verification. CISBM's legitimate interests are to prevent impersonation, detect fraudulent applications, maintain reliable membership records and protect participants. Reliance on these interests requires an assessment of necessity, less intrusive alternatives and the effect on applicants' rights. This policy does not assert that every applicant is subject to a statutory financial-services identity check.

Assessment and governance. Maintaining accurate institutional publication records, administering substantiated restrictions and preventing circumvention serve the legitimate interests of reliable academic attribution and protection of the organisation and its participants. Output listing under A10 remains subject to data protection rights, accuracy and a documented assessment; contractual permission concerning a citation is not blanket consent to other uses of personal information. Proportionate assessment of eligibility, contributions, progression, affiliation and project suitability serves CISBM's legitimate interests in allocating opportunities fairly, maintaining academic standards and administering its organisation. Information necessary to deliver an agreed activity may instead fall within the contractual basis described above.

Security, correspondence and integrity. Protecting accounts and systems, responding to enquiries, addressing misuse, examining credible integrity concerns and maintaining necessary decision records serve CISBM's legitimate interests in operating a reliable service and protecting participants and research. These interests must be balanced against the rights and reasonable expectations of the people concerned.

Optional publication and communications. Where consent is the basis for optional profile publication, publicity or communications, it must be specific to that purpose and capable of withdrawal. Required administrative messages concerning an application, account, security issue or ongoing activity are distinct from optional promotional messages.

Legal obligations and claims. Information may be processed to satisfy an applicable legal obligation, or where necessary for the legitimate interests of establishing, exercising or defending legal claims. A legal obligation must arise from an identifiable requirement; this category does not authorise unrestricted collection or retention.

CISBM must not use legitimate interests where an individual's interests or fundamental rights override them. Where consent is legally required, another basis cannot be used merely to avoid obtaining it. New or materially different purposes require an assessment of compatibility and further information or consent where applicable.

B7 Identity Verification

Identity documents are used to establish that an applicant is the person they claim to be, prevent impersonation and resolve verification discrepancies. They must not be used for publicity, unrelated research, academic ranking, marketing or training artificial-intelligence models. Any exceptional preservation or disclosure required by law or necessary to address suspected impersonation must be limited to that purpose and supported by an appropriate lawful basis.

Identity review must be limited to the information reasonably needed for the check. CISBM must consider whether a less intrusive method or a document with unnecessary fields obscured would meet the verification purpose. An applicant may contact CISBM before uploading a document to discuss an appropriate alternative or redaction. Where identity cannot reasonably be established, CISBM may be unable to complete the application.

CISBM does not publish identity documents or distribute them to other members, collaborators, independent supervisors or funding bodies as part of ordinary participation. Necessary processing by its contracted infrastructure providers, specifically authorised reviewers and support personnel is distinct from public or general member disclosure. A legally required or otherwise lawful and necessary exceptional disclosure remains subject to the restrictions in this policy.

Access to identity documents is restricted under this policy to personnel specifically authorised to perform identity review and personnel who require access for necessary technical support or a lawful investigation. Membership of the Supreme Advisory Council, a supervisory role or general administrative status does not, by itself, justify access. A verification outcome should be used instead of a document copy where it is sufficient.

Identity documents must not form part of public profiles, researcher directories or downloadable public CVs. Document images and verification records have different retention needs. A document image must not be retained merely because a membership remains active once the image is no longer needed for verification, an unresolved review or a specific lawful preservation purpose.

B8 Sensitive Information and Research Records

A photograph on an identity document is not automatically special-category biometric data. Technical processing of a face or other characteristics for unique identification can create additional legal requirements. Ordinary membership registration does not authorise biometric identification, genetic analysis or unrelated assessment of sensitive characteristics.

Health, genetic, biometric and other special-category information requires an applicable special-category condition as well as a general lawful basis. Information concerning criminal convictions or offences requires the separate safeguards and authority prescribed by applicable law. CISBM must establish these requirements before undertaking the relevant processing.

Research involving identifiable individuals, human tissue, biological samples, clinical records or genetic information requires its own lawful data arrangements, permissions and any necessary independent ethics approvals. This policy supplies neither research consent nor ethics approval. CISBM membership does not authorise a participant to obtain, upload, transfer or analyse restricted research material.

Confidential manuscripts, unpublished results and project records must be shared only through authorised arrangements. Copyright, confidentiality, authorship and research ethics obligations apply separately from the protection of personal information.

B9 Public Profiles and Professional Visibility

Profile and directory functions may make professional information available to other members or to the public. The audience for a field, file or profile must be made clear when publication is offered. Optional public disclosure must not be inferred merely from submission of an application or an identity document.

Public information can be accessed internationally, indexed by search engines, downloaded or copied. A public CV may contain contact details or other information beyond what a directory needs. Individuals should review documents carefully before choosing to publish them.

Changing a profile setting or removing a profile listing may not, by itself, revoke a separately accessible file link or remove copies held by search engines and third parties. A request to withdraw a CV or another file should identify the file as well as the profile. CISBM must address the access to the underlying file within its control, rather than treating removal of a visible link as sufficient.

Individuals may request correction or removal of information that CISBM publishes about them. Where publication relies on consent, that consent may be withdrawn through the available profile controls or by contacting CISBM. Withdrawal does not invalidate earlier lawful processing and cannot guarantee the removal of independent third-party copies.

B10 Membership Assessment and Affiliation Records

CISBM may use relevant application details, verified credentials, contributions, participation records and substantiated concerns to assess project suitability, membership category, progression, suspension, removal and affiliation approval. Access for supervisors, authorised administrators and Supreme Advisory Council members must be limited to the information needed for their assigned responsibilities.

Professional metrics and rankings may support assessment but can contain errors or omit relevant context. The criteria and significance of an applicable scoring scheme must be explained through the relevant scheme information. Individuals may challenge inaccurate inputs and request review of a decision affecting them. Where applicable law requires safeguards for a significant automated decision, CISBM must provide them, including meaningful human intervention and an opportunity to make representations and contest the outcome.

Registered or Regular membership alone does not establish an approved CISBM affiliation. Records of affiliated membership must distinguish the approved status, scope and duration from other membership categories. Affiliation at publication must reflect an active approval applicable to the work; expiry or a change of status requires renewal or an accurate alternative attribution agreed for the circumstances. An accurate historical statement about work must not misrepresent a current appointment.

The verified academic email, affiliation wording, approval and output-listing requirements in A8 to A10 apply. Records may establish the approved category, authorised period, account email, relevant output and any later correction. Affiliation does not establish employment, immigration status, UK residence or authority to act on behalf of CISBM.

B11 Communications and Email Records

CISBM may review messages sent to or from its official accounts, messages submitted to it, and relevant service or delivery records where necessary to resolve a support issue, administer participation, protect security or investigate a specific concern. Access must be authorised, proportionate and limited to the relevant purpose.

Registration and acceptance of this policy do not give CISBM permission to enter an individual's private email account, obtain passwords or inspect unrelated correspondence. A request for evidence should identify the relevant material and avoid collecting an entire mailbox when a limited exchange is sufficient. Confidential information concerning other people should be excluded or redacted where appropriate.

Optional promotional communications require the permissions prescribed by applicable law and an effective way to decline further messages. Declining optional communications does not prevent receipt of necessary account, application or security notices.

B12 Service Providers and Other Recipients

CISBM uses Supabase for member-data services. Other recipients depend on the service being delivered and may include providers responsible for website hosting and delivery, account authentication, communications, technical support and security. Providers acting on CISBM's behalf must be subject to appropriate contractual restrictions and may process information only within their authorised role, except where they have an independent legal responsibility.

Relevant information may be shared with authorised reviewers, supervisors, collaborators or institutions where necessary for a stated membership or activity purpose. An entire application or identity document must not be disclosed where a limited record or verification result is sufficient.

Information may be disclosed to professional advisers, competent authorities, institutions or journals where there is a lawful and proportionate reason, including handling a substantiated integrity concern, correcting a research record, meeting a legal obligation or addressing a legal claim. An allegation alone does not establish misconduct. Disclosures must distinguish allegations, evidence and findings.

Where organisational restructuring or closure requires a transfer of records, CISBM must establish the lawful purpose, necessary safeguards and any required notice before the transfer. Public profile information is disclosed to the audience identified for that profile. CISBM does not sell personal information.

B13 International Processing

Online services, international collaboration and access by authorised personnel can involve processing outside the country in which an individual resides. The location of a company's registered office does not establish the location of its database, backups or support operations. Use of Supabase does not, by itself, establish that information remains exclusively in the United Kingdom.

Before a transfer subject to international-transfer restrictions takes place, CISBM must establish an applicable adequacy arrangement, appropriate contractual or other safeguards, or a lawful exception available for the particular circumstances. Additional protections must be applied where the relevant assessment requires them. The requirements applicable to UK transfers and those applicable to other jurisdictions must be assessed separately.

Individuals may contact CISBM for information about the international processing applicable to their records and for a copy or explanation of relevant safeguards, subject to necessary protection of confidential information. A privacy-policy acknowledgement is not blanket consent to international transfers.

B14 Data Retention and Deletion

Personal information must not be retained longer than necessary for its stated purpose. Retention is determined by the category of information, the stage of the application or relationship, outstanding review or complaint issues, legal obligations, and any properly identified need to establish or defend a claim.

Applications and membership records. Records may be needed during assessment and active membership, and afterwards to resolve outstanding matters, document decisions or meet a specific legal need. Unsuccessful or withdrawn applications must be assessed for deletion rather than retained indefinitely as prospective membership records.

Identity documents. Images must be reviewed for deletion when verification and any necessary reconsideration are complete. A limited verification outcome may remain necessary for longer than the image. Any extended preservation must relate to an identified issue or legal requirement, with access limited accordingly.

Profiles and files. Public display must be reviewed when publication is withdrawn, an account closes or the relevant role ends. Deleting a profile and deleting an uploaded file are separate operations where the system stores them separately. A file-removal request must be handled across the relevant locations controlled by CISBM.

Exclusion and integrity records. A limited restriction record may be retained to administer a substantiated exclusion, prevent circumvention and resolve a review or legal claim. It should identify the person sufficiently for that purpose, the material grounds, the conduct and decision dates, the exclusion expiry and review outcomes. Full identity-document images must not be retained for ten years merely because a ban lasts ten years. A decision overturned on review must be reflected in the records, and continued retention must be reassessed when the restriction and any separate lawful need end.

Participation and research records. Retention depends on the activity, attribution needs, applicable research obligations and unresolved integrity or contractual issues. A project-specific schedule must govern regulated or identifiable research records. The label "research" does not justify indefinite retention of all membership information.

Correspondence, security and complaint records. Retention must reflect the support or investigation purpose, the resolution of the issue and any remaining legal need. Records must not be kept indefinitely merely because they might become useful.

Deletion from an active service may not immediately remove information from backups or copies lawfully retained for a separate purpose. Such residual information must remain protected and must not be returned to ordinary use without a lawful reason. CISBM must account for valid deletion requests if a backup is restored. Individuals may request the retention criteria applicable to a particular record.

B15 Security and Access Management

CISBM requires technical and organisational measures proportionate to the nature and sensitivity of the information. These include limiting access to authorised responsibilities, managing account permissions, protecting document access, and handling security concerns through an appropriate response process. Identity documents require stricter access than public professional information.

Access rights must be reviewed when a person's role changes or ends. Administrative authority does not authorise browsing records out of curiosity, downloading documents for unrelated purposes or forwarding information to personal recipients without a lawful operational need.

No online service can guarantee absolute security. Suspected unauthorised access, disclosure or loss should be reported promptly through CISBM's published contact details. CISBM must assess incidents and provide notifications where applicable law requires them. This policy does not limit responsibility for a breach or remove anyone's legal remedies.

B16 Cookies and Browser Storage

The website uses browser-storage functions in connection with account access and interface features, including authentication state, display preferences and announcement settings. Cookies, local storage and session storage are subject to the relevant rules even when they are described by different technical names.

Storage or access that is strictly necessary to provide a service requested by the user may operate without optional consent where permitted by law. Other storage, analytics or similar technologies must operate only with the consent or other specific exemption legally applicable to that use. A preference setting and a research or advertising tracker must not be treated as equivalent merely because both use browser storage.

Where optional technologies are introduced, information about their purposes, providers and duration must be provided before they operate where required, together with the applicable choices. Consent must be capable of withdrawal. This policy does not authorise undisclosed advertising pixels or analytics.

Browser controls can clear or restrict stored information. Clearing authentication storage may sign the user out, and blocking necessary storage can affect account functions. A browser setting does not necessarily remove information already held on a server.

B17 Individual Rights

Depending on the applicable law and circumstances, individuals may request access to their personal information and a copy of it; correction of inaccurate or incomplete information; erasure; restriction of processing; and portability where the relevant conditions apply. These rights are subject to legal conditions and exceptions, which CISBM must explain when relevant to a request.

Right to object. Individuals may object to processing based on legitimate interests on grounds relating to their particular situation. CISBM must stop the processing unless a lawful ground permits it to continue. An objection to use for direct marketing must be respected, including related profiling.

Withdrawal of consent. Where processing relies on consent, consent may be withdrawn at any time by contacting CISBM or using the relevant available control. Withdrawal does not affect processing lawfully undertaken before it was received. It does not automatically require deletion of a record held for a separate lawful purpose, which must be explained.

Requests may be made through the contact arrangements in B1. CISBM may seek proportionate information to verify the requester's identity where necessary; a full identity document must not be demanded as a routine response where a less intrusive check is sufficient. Responses will be provided within the time required by applicable law, normally one month for a UK data protection rights request, with any lawful extension or adjustment explained.

Individuals may raise a privacy complaint with CISBM and may complain to the competent data protection supervisory authority. Using CISBM's internal process is not a condition of exercising an external complaint right or seeking a judicial remedy.

B18 Account Closure and Membership Changes

An individual may request account closure, withdrawal from membership or deletion of personal information. These are related but distinct requests. Ending membership does not automatically resolve every record needed for an outstanding complaint, attribution issue, legal obligation or claim; retaining such a record requires its own justification.

Where information cannot lawfully be erased immediately, CISBM must explain the relevant reason and restrict its continued use to that purpose. Closure does not authorise continued optional publicity or marketing. Access to project systems and administrative functions must be reviewed when participation or authority ends.

B19 Children and Vulnerable Participants

Participation involving a person under 18 requires an assessment of the activity, the individual's understanding, applicable age and consent rules, and appropriate safeguards before information is collected for that participation. Where parental or guardian involvement is legally required, it must be arranged without collecting more family information than necessary.

Identity checks, public profiles and research participation can create particular risks for younger or vulnerable individuals. General acceptance of this policy is not a substitute for age-appropriate information, a valid lawful basis, safeguarding measures or necessary research permissions.

B20 External Services and Applicable Law

Links to journals, ORCID, institutions and other websites may lead to services with their own privacy notices. Their independent processing is governed by their responsibilities and the law applicable to them. CISBM remains responsible for the lawfulness of personal information it discloses to another service.

CISBM's handling of personal information is subject to the UK General Data Protection Regulation and the Data Protection Act 2018 to the extent applicable, together with other applicable privacy and electronic-communications requirements. The application of laws in other jurisdictions depends on the relevant circumstances. A contractual choice of law does not remove mandatory data protection rights.

B21 Policy Administration and Updates

CISBM will review this policy when its activities, systems or legal obligations change. Material changes affecting the use of personal information will be communicated through the website or another appropriate channel. Where a new purpose requires consent or further notice, a revised policy alone is not sufficient.