Data protection

Mighty Health Creatives Ltd is the data controller for the information on this site. The quickest way to reach us about anything on this page is hello@mightyhealthcreatives.com.

• Account details: your name, work email address and the organisation you belong to, plus the permissions that decide what you may approve.
• Briefs and project content: the specialisms you choose, your written brief, timings, purchase-order details, the files you upload, and the comments and artwork pins you add.
• Scheduling: the date and time of your briefing call. Who attended from the studio is held privately and is not shown to you.
• Quotes and payment records: the quote versions you were shown, who approved them, invoices, the date you told us you had paid, and any late-payment decision we record. No card or bank account details are taken through this site.
• Sign-in and activity: password-protected sign-in, email confirmation, password resets, and a record of when your dashboard or a project is opened so we can tell whether the portal is being used.

• Doing the work you asked for (performance of a contract): your brief, files, approvals, scheduling and payment records.
• Running and securing the account (legitimate interests): sign-in, email confirmation, password resets, approval permissions, and the activity records that tell us the portal is working.
• Meeting legal and accounting duties (legal obligation): quote, invoice and payment history.
• Consent: we do not send marketing email and we do not ask for consent to advertise. Every message we send is about something you asked for or an action on your own account.

• People at your own organisation who are signed in and have the right permission. Approval rights are set person by person.
• The Mighty team, for the work they are handling. Administrative pages are limited to designated administrators.
• An independent specialist only ever sees the assignment they were invited to and the approved files they need. They never see your other projects, your commercial terms or another organisation's work.
• Client screens never show specialist fees, internal costs, studio capacity or margin calculations.

Uploads are private to the project they belong to. Before a proof image or delivery file is stored, it is sent to an external virus-checking service (Cloudmersive) and only files reported as clean are kept. If a file is infected, or the check cannot be completed, the file is refused rather than stored. Files that fail a check are never shown to a client.

Please do not send identifiable patient data. The work we do here does not need it, and it would create extra risk for you.

We use a small number of providers, and only for what they need to do: Lovable hosts this application, its database and its email delivery, and Cloudmersive checks uploaded files for malware before they are stored. Each of them processes data on our instructions and only for that purpose. We do not sell your data, and we do not use advertising networks.

• Project records, briefs, files and comments are kept while your account is open so you can come back to them.
• Quote, invoice and payment records are kept for at least six years, as UK accounting and tax law requires.
• Emails we send are logged for a short period so we can trace delivery problems.
• Ask us to close an account and we remove what we are not required by law to keep, and tell you what remains and why.

You can ask for a copy of what we hold about you, ask us to correct anything wrong, ask us to delete it, ask us to limit how we use it, or object to processing that relies on our legitimate interests. You can withdraw consent at any time where we asked for it. If you are unhappy with how we handle your information you can complain to the Information Commissioner's Office (ICO) in the United Kingdom.

To make a request, email hello@mightyhealthcreatives.com. We will confirm which account the request is about before we answer, so please use the address you signed up with.

• Sign-in is required for every client screen, and each record is checked against your organisation membership before it is shown.
• Uploads sit in private storage with per-project access rules, and are virus-checked before they are stored.
• Important changes - quote approvals, payment records, late-payment decisions, account approvals - are recorded with who made them and when.
• Your sign-in session is stored in your own browser so you stay signed in on your device. We do not use advertising cookies or tracking pixels.
• Administrators are added by a controlled owner step, never by a self-service button or a setting someone can change in a page.

Mighty Hub is not yet live for real client work. It is being tested with fictional projects and fictional clients, and some parts (email delivery, file scanning at scale, backups and retention) are still being checked before launch. The statements above describe how the system is built; they will be reviewed with legal and accounting advice before the site takes real work, and any change will be published here with the date it took effect.