How we handle health data

Your blood group, blood pressure, weight, medication and any deferral reason are health data. They are visible only to the people running the camps, and never to another donor.

Every table has row-level security enabled with explicit policies. A donor's session can read that donor's rows and no others, not because the application asks nicely but because Postgres refuses the query. An application bug cannot widen that.

Sign-in codes are stored only as a SHA-256 hash, and the table holding them has security enabled with no policies at all: no browser session can reach it under any circumstance.

It is not profiled, scored, sold or shared. The console's assistant can read it to answer an organiser's question, and it runs under that organiser's own permissions, so it cannot reach a record they could not open themselves.

If you are turned away, the reason is recorded so the next camp knows whether it still applies. It is not a mark against you, and it is visible to you on your own page.