Image rights policy

An image is the part of a healthcare page a reader accepts without reading. Prose here is held against a prohibited-phrase list, a source hierarchy and a stated basis for every claim; a photograph placed above a headline to fill space is held against none of that, and it can assert an outcome the sentences were refused. A picture routes around a text check.

Every image declares a rights basis

An article declares one featured image, and that image carries a rights value from a closed vocabulary rather than free text. featuredImage: null is how an article declares that it leads with no picture at all.

• ORIGINAL_GMEDAC — made for this publication.
• LICENSED_STOCK — a licence exists, and its scope is recorded with the file.
• PUBLIC_DOMAIN — in the public domain, with the reason recorded rather than assumed.
• CC_BY and CC_BY_SA — the licence and the attribution string are recorded with the file. Recording is not display: no page renders a credit today, so putting the attribution where a reader sees it is an editorial obligation and not something the build can check.
• PERMISSION_ON_FILE — a named person or organisation permitted this use in writing.
• NONE — no rights basis has been established.

NONE exists because "found it, looks fine" is a real state and the model should hold it plainly. Declaring it stops the build rather than quietly withholding the article: the corpus fails to validate, and no page, feed or search index can be produced without the corpus. A value outside the vocabulary, or a missing one, refuses in the same way, so an image cannot arrive unclassified by staying quiet.

Two limits are worth stating plainly. The check reads a declaration, not a licence: LICENSED_STOCK is an assertion by the editor who typed it, and nothing in the pipeline inspects an invoice or a photographer's release. And the vocabulary reaches the featured image only — an image placed in the body of an article has no rights field for anyone to fill in, so its basis rests on the editor and reviewer named on the article. What the field buys is that somebody had to state a basis for the image the article leads with. It makes an unexamined image visible, not impossible.

Alt text is required

A reader using a screen reader on a healthcare page should not lose the illustration carrying half of an explanation. The featured image carries alt text, and the check refuses a featured image whose alt is missing or empty.

An empty alt is legitimate in one narrow case: an ornament repeating what the adjacent sentence already says, where announcing it twice is worse than silence. A featured image is not that case. It leads the page, and it is the image the article's structured data hands to anything reproducing the page elsewhere. A featured image is never decorative.

Alt text describes what the image shows. Restating the headline hands a reader who cannot see the image nothing the page had not already said. No check separates a description from a plausible restatement — it tests that the string is not blank and nothing more — and no check reaches an image placed in the body of an article, where an empty alt passes. Both rules rest on the editor and reviewer named on the article, and should be described as the human controls they are.

What no image may depict

• No stock imagery implying recovery, diagnosis or endorsement. The genre is recognisable: the relieved face, the hand on the shoulder, the clinician turning a scan towards the camera. An image of that kind asserts an outcome the prose beside it could not assert without a source. Every claim in an article names a basis, and a jurisdiction-specific claim resting on REASONED_INFERENCE, COUNSEL_CONFIRMATION_REQUIRED or UNKNOWN cannot be published at all. A photograph makes the same kind of claim with no basis field to fill in.
• No image that could be read as a real patient. This publication carries no patient stories, no comments and no user profiles, and GMedAC holds no clinical record and issues no clinical document. An image presented as somebody's patient fabricates material the publication does not hold. A model does not answer the rule and a clarifying caption does not either: the image travels into a preview card while the caption stays behind.
• No image of a person presented as a GMedAC professional who is not one. Verification on the marketplace is published as a summary of what was checked, never as an endorsement, and VERIFIED is a statement that somebody checked a document rather than permission to practise or to book. A stock portrait captioned as a verified professional manufactures precisely the endorsement the verification model declines to give. For the same reason no image may stage GMedAC as a place where care happens: GMedAC is not a clinic, not an EHR, not a medical messenger and not a video platform, and the consultation happens outside it.

A diagram is prose. An illustration asserting a pathway, a prevalence or a comparison is making a claim, and it belongs in claims with a basis and a source on the same terms as a sentence would.

Images are served from this repository

A request for an illustration on a healthcare page is itself information about the reader. Routed to a third-party image CDN, it reaches a company the reader has no relationship with, carrying an IP address, a user agent and a referring URL naming the page being read — a line in somebody else's log recording that a particular address read a page about a particular condition. The image never had to be interesting for the request to be.

So every image is a file in this repository, built into the static export and served from the same origin as the page showing it. Part of that is enforced. A featured image path must start with /images/ and must resolve to a file in the repository; a body image path beginning with / must resolve to one too; the sanitiser strips every image attribute except src and alt, so a srcset cannot reach a second host; a data: source is dropped; and there is no request-time image loader to leak through, because a static export runs no image optimiser and images.unoptimized serves the source bytes as they are. Part of it is not enforced. Nothing in the build refuses a body image whose src names a remote host, so no hotlinked file and no avatar service, embed or web font that drags an image request behind it is a rule the editor and reviewer keep, not one the pipeline keeps for them.

The rest of the deployment matches: no database, no authentication, no cookies of its own, no analytics, no advertising pixel, and reader search running in the browser against a static JSON index so no query leaves the machine.

The honest limit is that this does not make reading anonymous. The host serving these files still sees the request, and so does the reader's network. This removes a party, not a record.

What this policy does not control

The build can require a rights value and refuse an empty featured alt. It cannot look at a picture. Nothing in the pipeline sees that a photograph shows a relieved patient, that a portrait is a model in borrowed clothing, or that a licence covers editorial use but not this one. The depiction rules rest on people, and when they fail the remedy is a correction rather than a quiet file swap: a correction states previousClaim verbatim and names an editor, a material: true correction with no reviewer is refused, and so is a material: true correction with dateModifiedChanged: false.

Nothing above is a legal conclusion about copyright, licensing, personality rights or data protection in any jurisdiction. None of it has been researched here to a standard this repository would publish. An image accepted under this policy is accepted editorially, and that is the whole of what it means.