Ros
- The documents do not say whether your data trains AI.
- Your data is used for personalized ads, including by third-party ad companies.
- Data is shared with partners and affiliates; you can opt out.
- Staff may review your content; the policy does not describe an opt-out.
A UK charity site that collects health and contact data, uses Google/Meta ads cookies, and profiles donors from public records.
Agent Trust Hub uses AI and may make mistakes. Review reports and confirm their contents before relying on them.
Collected
Account and contact details, health answers, helpline notes, IP/device data, and public records about donors.
Read the exact line
Privacy policy
“Types of personal data collected – name, email, postcode (if supplied), gender, age, ethnic group, and health information supplied in answers to the initial assessment questions.”
Training
They use it for membership, fundraising, helpline support, and donor research; targeting cookies go to Google and Meta.
Read the exact line
Privacy policy
“As a fundraising organisation, we undertake in-house research and, from time to time, engage specialist agencies to gather information about you from publicly available sources”
Sharing
They say they do not sell your data; service providers, Google, Meta, and research agencies may still get some of it.
Read the exact line
Privacy policy
“The ROS does not sell, trade or rent your personal information to others, for marketing purposes or otherwise.”
Kept
Times vary: helpline recordings 6 months, other helpline notes 3 years, volunteers 6 years after they leave.
Read the exact line
Privacy policy
“Call recordings are retained for a period of 6 months and other information held about you is retained for 3 years.”
Controls
You can unsubscribe, object to profiling, and email them to access, correct, or delete your data.
Read the exact line
Privacy policy
“Please contact us if you wish to amend your communication preferences, update your contact information or to see what information we hold about you.”
Fine print
The site is as-is with no ; English courts decide disputes; they can change the rules by updating the page.
Read the exact line
Terms of service
“We provides the Website on an "as is" and "as available" basis, without representations or of any kind.”
Expand “Read the exact line” to see the source alongside the explanation.
What you can turn off
The controls and opt-outs their own documents describe, and where they say to find them.
Refuse non-essential and targeting cookies
Cookie notification on the website; also update browser settings as described in the privacy policy
Opt out of fundraising profiling
Contact dataprotection@theros.org.uk or Membership & Supporter Care (supporters@theros.org.uk / 01761 473287)
Ask them to delete or show your data
Email dataprotection@theros.org.uk
Unsubscribe from emails
Unsubscribe link in emails, forum notification settings, or call 01761 473287
If a switch is not where they say, the deletion request above still applies.
Line by line
The lines that matter most, worst first.
If you allow extra cookies, Google can track how you use the site and use that for ads.
Read the exact line
Privacy policy
“Where you have consented to targeting cookies, Google will set a cookie that tracks your progress through the website.”
For example, after you accept cookies, you might later see ROS ads on other sites because Google linked your visit.
Accepting third-party cookies can let Facebook match your email to your account for targeted ads.
Read the exact line
Privacy policy
“We also send Meta information about your email address if you’ve provided us with one and have consented to this by accepting third party cookies.”
For example, Meta could show you charity ads because your hashed email matched your Facebook account.
They look you up in public records and may hire agencies to build a picture of you as a donor.
Read the exact line
Privacy policy
“As a fundraising organisation, we undertake in-house research and, from time to time, engage specialist agencies to gather information about you from publicly available sources”
For example, they might check Companies House or LinkedIn to decide how to ask you for money.
Using the risk checker also gives them a location based on your IP address.
Read the exact line
Privacy policy
“We’ll collect your location information using the IP address of the device that you access our osteoporosis risk checker from.”
For example, filling in the checker from home can add an approximate location to your answers.
Phone helpline calls can be recorded if you agree, and those recordings are stored.
Read the exact line
Privacy policy
“If you contact our Helpline by phone we may record your call. We rely on your explicit consent to record your call”
For example, a call about your diagnosis could be kept as a recording for six months.
They say they will not sell or rent your personal information.
Read the exact line
Privacy policy
“The ROS does not sell, trade or rent your personal information to others, for marketing purposes or otherwise.”
For example, they should not put your name on a list sold to another charity.
You can say no to the extra donor research and profiling.
Read the exact line
Privacy policy
“You will always have the right to opt-out of this processing.”
For example, you can tell them not to use agencies to look up your public records.
They do not promise the site is accurate, complete, or always working.
Read the exact line
Terms of service
“We provides the Website on an "as is" and "as available" basis, without representations or of any kind.”
For example, if health info on the site is wrong, they say you cannot hold them to a .
Online donations are treated as final unless your card was used without permission.
Read the exact line
Terms of service
“When a donation is made on the Website and charged to your card the transaction is final and not disputable unless unauthorised use of your payment card is proved.”
For example, if you donated the wrong amount, they may not have to refund it as a dispute.
They can change the website rules by editing the page; you are expected to notice.
Read the exact line
Terms of service
“We may revise our Terms and Conditions at any time by amending this page. You are expected to check this page from time to time”
For example, a new rule could apply the next time you visit even if they did not email you.
If they decide you broke the rules, they can cut off your access right away.
Read the exact line
Terms of service
“Immediate, temporary or permanent withdrawal of your right to use our Website.”
For example, a forum post they dislike could get your account removed without warning.
Words to know
Legal words from the lines above, in plain English.
- personal data
- Any information that is about you or can be linked to you, from your name to your phone's ID. For example, your email, your IP address and the list of apps on your phone are all personal data.
- sell or share
- Under California law, selling means passing your data to others for money or other value; sharing means passing it on for targeted ads. For example, letting an ad network use your browsing history in return for ad space counts as a sale.
- retention
- How long a company keeps your data before deleting it. For example, a policy might keep your messages for 30 days after you delete them, or for as long as it likes.
- as is
- You get the service in whatever state it is in, with no promise that it works or will keep working. For example, if the app deletes your photos by mistake, it is not promising to fix that or pay you back.
- warranty
- A promise that a product will work as described; most apps say they make no such promise at all. For example, if a paid feature never works on your phone, a no-warranty clause says that is your problem.
- cookies
- Small files a website saves on your device so it can recognise you and remember what you did. For example, a cookie keeps you logged in and can also tell an ad company which sites you visited.
- third parties
- Any company or person other than you and the app, such as advertisers, partners or analytics firms. For example, an analytics company that receives a record of every screen you tap is a third party.
- consent
- Your clear agreement to something, given by an action like ticking a box or tapping Accept. For example, a pop-up asking if the app may use your location is asking for consent.
- opt out
- Something is on by default and stays on until you find the setting and turn it off. For example, your chats may be used for training unless you go into settings and switch it off.
How we got here · grade F · score 32/100 · 15 of 15 policy answers backed by a verified quote · 2 not stated
What does the app collect beyond what it needs to work?
They collect more than account basics: health answers, ethnicity, IP and device data, cookies, helpline notes, and public-record research on donors.
Does it record your voice, face or body, and what happens to that?
Helpline phone calls may be recorded with your consent and kept for six months.
Are your chats and uploads used to train AI models, and is that off by default?
Not stated in the documents.
Can employees or contractors read your conversations, and when?
They say they monitor forum posts for guidelines and safety; they do not describe an opt-out from that review.
Are you profiled or tracked for advertising?
If you accept targeting cookies, Google and Meta can track visits and match hashed emails for ads.
Do they sell or share your data, and can you opt out?
They say they do not sell data, but they use research agencies and ad platforms; they say you can opt out of profiling.
What rights do they take over what you type and what the AI makes?
Not stated in the documents.
How long do they keep your data after you delete it, and can you delete it in the app?
Some periods are listed, but deleting BoneMed and other data is by emailing them, not a simple in-app delete with a 30-day wipe.
Does it build a lasting memory or profile of you, and can you see, edit or turn it off?
They build donor profiles from public sources and agencies; you can opt out of that processing, but viewing or editing a memory is not described.
Do they commit to basic security, and have they leaked data?
They describe encryption, UK/EEA storage where possible, supplier certifications, and NCSC guidance, but no named audit of themselves.
Is there a real age gate, and are teens protected?
There is no stated minimum age for the site; interactive use by a minor needs a parent’s consent, but that is advice, not a hard gate.
Will they tell you when the rules change, and is the policy specific?
The privacy policy is dated and they say they will post changes and sometimes email you; the terms say continued checking of the page is enough.
Can they close your account without warning, and can you get your data out first?
For a rules breach they can immediately take away your right to use the site and remove your posts.
If something goes wrong, who pays?
The site is as-is with all warranties disclaimed and they say they are not liable for losses from using it.
Do subscriptions renew on their own, and can you get a refund?
Card donations on the site are described as final and not disputable unless the card was used without permission.
The privacy policy is 5,622 words at a professional or legal expert level (Flesch reading ease 11.3); the terms are 1,895 words at a professional or legal expert level.
