Data protection policy

1. Aggregated statistics only

Everything published here is aggregated statistical output: percentages, counts and summary statistics for population groups, republished from the Directorate for Health Information and Research (DHIR) and the Infectious Disease Prevention & Control Unit (IDCU). No microdata, no individual survey or case records and no identifiable information about any person is contained in, or derivable from, this portal.

2. Statistical confidentiality

• The underlying responses and notifications were collected by the publishing directorates under national statistical and public health legislation and processed for statistical and surveillance purposes only.
• Results are published only in grouped form. Estimates based on small numbers are shown here with the same caution markers as in the source publications and are not disaggregated further.
• No attempt may be made to re-identify individuals from these tables, whether alone or by combining them with other sources.

3. Who is responsible for this portal

This portal is an independent project by Dr Stefan Buttigieg, who is the controller for the limited personal data the portal itself processes (see below). It is not an official product of the DHIR or IDCU, which remain the controllers of their own survey and surveillance records.

4. Data we process about you

• Browsing — visiting, searching, exploring and downloading statistics requires no personal data. No analytics or advertising technology runs on the site.
• Contributor accounts — if you sign in to the admin area (by invitation only), we process your email address, display name, assigned role and sign-in events to operate access control and keep an audit log of content changes. Legal basis: legitimate interests (Art. 6(1)(f) GDPR) in securing and auditing the service. Accounts are created and managed by the portal administrator.
• “Ask the Data” chatbot — questions you type are sent to an AI model provider solely to generate an answer from the portal's statistics. Do not include personal details in your questions. Chat content is not used to train models.
• Technical request data (IP address, user agent, requested URL, timestamp) is processed transiently by the hosting infrastructure to deliver pages and protect the service. Legal basis: legitimate interests (Art. 6(1)(f) GDPR). It is not used for profiling and is retained only for a short operational period by the host.
• Correspondence — email you send travels directly to the recipient's mailbox; this portal neither stores nor forwards it.

5. Service providers

The portal is hosted on Lovable Cloud (hosting, database and authentication) and uses the Lovable AI Gateway (AI answers) and Google Fonts (typography). Each provider processes the minimum technical data needed to deliver its service under its own data protection terms.

6. Your rights

Under the GDPR and Malta's Data Protection Act you have the rights of access, rectification, erasure, restriction, objection and data portability with respect to personal data held about you. For data held by this portal (contributor accounts and correspondence), contact Dr Stefan Buttigieg at info@stefanbuttigieg.com. For survey or surveillance records held by the directorates, contact the Directorate for Health Information and Research, Ministry for Health, Malta, 95 G'Mangia Hill, Pieta' PTA 1313, Malta, which may also direct you to the Ministry's Data Protection Officer.

7. Research exemptions

Processing for statistical and scientific research purposes benefits from the safeguards and derogations in Art. 89 GDPR: data minimisation, pseudonymisation and publication in aggregate form only. Certain rights may be limited where their exercise would seriously impair statistical purposes.

8. International transfers

Content is served through a content delivery network, which may cache static pages outside Malta, and AI questions are processed by an AI gateway. Only technical request data and the text of questions you submit are involved; no personal data from the source statistics is transferred.

9. Complaints

If you believe your data protection rights have been infringed you may lodge a complaint with the Office of the Information and Data Protection Commissioner (IDPC), Malta.

10. Questions about this policy or the portal

Queries about this Data Protection Policy, the Cookie Policy, the Terms & Conditions or any other portal question should be addressed to Dr Stefan Buttigieg, Specialist in Public Health Medicine, at info@stefanbuttigieg.com.

Questions about the underlying survey or surveillance records, or any personal data held by the Directorate for Health Information and Research or IDCU, should continue to be addressed to the Directorate for Health Information and Research, Ministry for Health, Malta, 95 G'Mangia Hill, Pieta' PTA 1313, Malta.

11. Changes

Material changes to this policy are recorded in the portal version history on the Document information page.