Moderator Guidelines & Code of Conduct
All Clinical Exchange moderators must read, understand, and agree to these guidelines. They incorporate GDPR obligations, professional standards, and community expectations.
Purpose & Scope
The Clinical Exchange is a peer-to-peer forum for verified clinicians. Moderators are trusted clinicians who volunteer (or are appointed) to help maintain the quality, safety, and legal compliance of the community. This includes GDPR compliance, patient confidentiality protection, and professional standards enforcement.
These guidelines apply to all wiki moderators regardless of appointment method (application, nomination, or internal appointment). They are reviewed every 6 months by the DPO and updated as needed.
Code of Conduct
Protect Patient Confidentiality
CriticalNever allow posts containing patient identifiers (names, dates of birth, MRN numbers, specific dates). Flag immediately for redaction. This is non-negotiable.
Review Flagged Content Within 48 Hours
RequiredAll flagged posts, reported content, and user complaints must be reviewed within 48 hours. If you will be unavailable, notify the DPO or another moderator.
Welcome New Members
RequiredGreet newly verified clinicians. Help them understand community guidelines, direct them to the DPO page for their rights, and encourage quality contributions.
Curate Clinical Bulletins
RequiredReview and approve community-submitted bulletins (guidelines, advisories, updates). Verify sources before approval. Only peer-reviewed or authoritative sources.
Enforce Professional Standards
CriticalRemove or edit content that is unprofessional, discriminatory, or promotes unsafe practices. Issue warnings before escalation. Document all actions.
Maintain Neutrality
CriticalDo not use moderator powers to advantage your own posts, suppress competing viewpoints, or promote commercial interests. Disclose conflicts of interest.
Handle Personal Data Minimally
CriticalAs a moderator, you may see verification documents during review. You must never download, screenshot, or share these. View-only access, logged and audited.
Be Fair and Consistent
RequiredApply the same standards to all members regardless of their reputation, specialty, or seniority. Document the rationale for all moderation decisions.
Report Data Breaches Immediately
CriticalIf you suspect any data breach (unauthorised access, accidental disclosure, lost device with moderator access), report to the DPO within 1 hour.
Annual Re-confirmation
RequiredConfirm your clinical license is still valid annually. Step down gracefully if you become too busy — there is no shame in prioritising patient care.
GDPR Obligations for Moderators
Moderators are data processors under GDPR when handling verification documents or user data. You must complete the annual GDPR training module before receiving moderator access.
Lawful Basis Understanding
Understand that different wiki activities have different lawful bases (consent, legitimate interest, legal obligation). Do not process data beyond the stated purpose.
Data Minimisation
Only access the minimum data needed for your moderation task. If reviewing a flagged post, you do not need to view the user's verification documents.
User Rights Facilitation
If a user contacts you exercising their GDPR rights (erasure, rectification), direct them to the Data Rights dashboard immediately. Do not handle these requests yourself.
Breach Reporting
You are legally required to report any suspected data breach to the DPO within 1 hour. This includes: accidental disclosure, unauthorised access, lost/stolen device, or phishing attempts.
Documentation
All moderation actions are logged automatically. Never attempt to bypass logging or use unapproved tools to access wiki data.
Professional Secrecy & Confidentiality Agreement
Required for Article 9(2)(h) compliance: GDPR Article 9(3) requires that health data processed under the health care exemption must be processed by or under the responsibility of a professional bound by professional secrecy. The following measures satisfy this requirement.
Moderator Confidentiality Agreement
All moderators sign a binding confidentiality agreement before receiving access. Covers: no downloading of verification documents, no screenshotting, no sharing outside the platform, immediate breach reporting to DPO within 1 hour.
Terms of Service — Professional Secrecy Clause
All wiki users are bound by a professional secrecy clause in the ToS. By participating, clinicians agree to maintain confidentiality standards equivalent to their professional regulatory body (IMC, GMC, state medical board, etc.).
Role-Based Access Controls
Moderators can only access data necessary for their specific task. Verification documents are view-only. No bulk export. No admin override without DPO approval logged.
Audit Trail for All Access
Every view of sensitive data is logged (who, when, what, why). Logs retained for 6 years. Moderators can see their own audit trail. All actions attributable.
Annual Secrecy Training
All moderators complete annual training on professional secrecy obligations under GDPR Article 9(3) and their national medical council rules on social media and online conduct.
By applying to become a moderator, you acknowledge that you are a licensed healthcare professional bound by professional secrecy rules in your jurisdiction. You agree to process all wiki data under the responsibility of ChartScribe and its DPO (Wells Electronics), and you will maintain the same standards of confidentiality that apply to your clinical practice. Violations may result in immediate removal, reporting to your regulatory body, and legal action where appropriate.
Enforcement Framework
Moderation actions are applied proportionately. Critical violations (patient confidentiality, harassment, fraud) skip straight to Level 3 or 4.
1. Informal Warning
Private message to member explaining the issue. No public action.
Examples: Minor formatting issues, borderline off-topic
2. Formal Warning
Logged warning in member record. Content edited or removed with explanation.
Examples: Patient identifier in post, disrespectful language
3. Temporary Restriction
Posting rights suspended for 7–30 days. Member can still read and message DPO.
Examples: Repeated warnings, spam, unprofessional conduct
4. Permanent Removal
Account banned from wiki. All posts anonymised. Reported to DPO.
Examples: Serious PHI breach, harassment, fraud, illegal content
Annual Training Requirements
Report a Moderator Concern
If you believe a moderator has acted inappropriately or violated these guidelines, contact the DPO confidentially.
Report to DPOAll reports are confidential and investigated by the DPO independently.