Last updated 27 October 2026

Privacy notice

This notice explains how Still Ask uses the personal information you share through stillask.com, including our patient registry.

Who we are

Still Ask is run by Benaiah AI Ltd, a company registered in England and Wales (company number 17403584), with its registered office at 167–169 Great Portland Street, 5th Floor, London W1W 5PF. Benaiah AI Ltd is the controller of the information described here. Contact hello@stillask.com about anything in this notice.

What we collect

• Your email address, and a record of when you joined, confirmed or left the registry and which version of the form and this notice you saw.
• Who you’re registering as: living with a condition, a family member or carer, a clinician or researcher, or something else.
• Optional details: your first name, the condition (yours or that of the person you care for), whether you or they have a connection to the Armed Forces (serving, a veteran, or family), the country you live in, roughly when the condition or injury started, what would make the biggest difference to you, how you use a computer or phone today, and whether you’d like a research conversation.
• Campaign tags from the link you arrived by (for example utm_source), if present.
• Short-lived security data: a one-way hash derived from your IP address, used only to limit repeated sign-ups and repeated visit notifications, and deleted within 24 hours.

A condition, when it started, and how you use a computer or phone because of it, is health information, which the law treats as special category data. We only collect it if you choose to give it. An Armed Forces connection isn’t special category data, but we treat it with the same care: it’s optional, never included in our notifications, and only ever shared as aggregated counts.

We count page visits as anonymous daily totals. When you open a page, we also send ourselves a private notification showing which page it was, the website that linked you here (if any) and an approximate town or country worked out from your network connection. We don’t store your IP address: to send only one notification per visit, we keep a one-way hash of it, combined with your browser type, for 30 minutes.

We don’t use advertising pixels, session replay, cross-site tracking or email-open tracking, and we don’t set analytics cookies or store anything on your device for analytics. After you confirm your email, we set one strictly necessary, short-lived cookie so you can save your optional answers.

How we use it and why

• To run the registry and contact you about Still Ask research, studies, pilots and research conversations you might be eligible for, and occasional updates on our progress. Our lawful basis is your consent, and for health information your explicit consent (UK GDPR Articles 6(1)(a) and 9(2)(a)), which you give by ticking the consent box and confirming your email.
• To understand who we’re building for, using aggregated counts (for example, how many people living with MND, or how many veterans, have joined). We may share aggregated figures with research partners, funders or investors, but never your email address or anything that identifies you.
• To keep the service secure and prevent abuse, based on our legitimate interests.

If you tell us about an Armed Forces connection, we may use it to let you know about studies we run with Armed Forces or veterans’ rehabilitation services. Some studies are run with university research partners; we’ll tell you who runs a study before you decide, and we only pass your details to them if you ask us to. Joining the registry doesn’t enrol you in any study. If you’re invited to one, you’ll get separate information about it and decide then whether to take part.

We won’t sell your information, share it with anyone for their marketing, pass your details to another organisation without asking you first, or use it to train an AI model.

Who processes it

The website, database and emails run on Cloudflare (Cloudflare, Inc. and its affiliates), acting as our processor. Confirmation emails may also be delivered through Resend, which processes your email address and the message for delivery. These providers may process information outside the UK, under safeguards for international transfers in their data processing terms, including the UK International Data Transfer Addendum.

When someone joins, we get an email notification with their address and who they’re registering as. When someone joins, confirms, answers the optional questions or leaves, we also get a short WhatsApp notification saying what happened and who they’re registering as, plus an approximate location for sign-ups. Notifications never include the condition or other health details, and WhatsApp ones never include your email address. WhatsApp (WhatsApp Ireland Ltd, part of Meta) delivers them to our phone.

How long we keep it

• If you don’t confirm your email, we delete your details after 30 days.
• Registry details are kept for up to 24 months from when you joined, then deleted unless you’ve asked to stay.
• If you leave the registry, we delete your registry details straight away and keep only a minimal record that you left, so we don’t email you again.
• Backups held by our providers expire on their own schedules, so deletion from backups may not be immediate.

Your rights

You can withdraw your consent and leave the registry at any time, using the link in any email from us or by writing to hello@stillask.com. You also have rights to access, correct, delete or restrict the use of your information, to object to processing based on legitimate interests, and to data portability.

If you’re unhappy with how we handle your information, you can complain to the Information Commissioner’s Office at ico.org.uk. We’d appreciate the chance to put it right first.

Age

The registry is for adults aged 18 and over. A parent, carer or clinician can register on behalf of someone else if that person has agreed.

Changes

If we change how we use your information, we’ll update this notice and, if the change is significant, tell you before it applies.