BBSUK

BBS UK and BBS UK Clinics Ltd Privacy Notice

Introduction                                                                                                                               

BBS UK is a registered charity, primarily supporting those with Bardet-Biedl Syndrome, their families and/or carers.  BBS UK maintains a database of individuals who have indicated they would like to receive newsletters, other publications and information about relevant events.  BBS UK also processes information in respect of its employer responsibilities. BBS UK does not use automated decision-making, including profiling.

BBS UK Clinics Ltd is a subsidiary of BBS UK, contracted by NHS England to support the specialised Bardet-Biedl Syndrome Clinics held in London and Birmingham. BBS UK Clinics Ltd maintains a database of individuals who attend the specialised BBS Clinics, in line with its contract with NHS England.  BBS UK Clinics Ltd also stores and processes information about service users’ support and advocacy requirements and information in respect of its employer responsibilities.  BBS UK Clinics Ltd does not use automated decision-making, including profiling.

BBS UK and BBS UK Clinics Ltd comply with GDPR and the Data Protection Act 1998, and do not share data with third parties except where required by law. We do not transfer data outside of the EU. Rigorous procedures have been established to reduce the risk of compromise and ensure data is processed lawfully. Any suspected data breaches will be reported to the Information Governance Lead who will assess impact and consider further action in accordance with statutory guidance issued by the Information Commissioners Office.

Throughout this Notice, unless otherwise defined, ‘BBS UK’, ‘we’ and ‘our’ should be understood as referring to and representing Bardet-Biedl Syndrome UK and its wholly owned subsidiary, Bardet-Biedl Syndrome UK Clinics Ltd. 

Data Collection and Processing

Key Roles: Data Controller or Data Processor?

  • BBS UK is Data Controller for BBS UK data processing
  • BBS UK Clinics Ltd is Data Controller for BBS UK Clinics Ltd data processing in relation to employer responsibilities and patient support and advocacy information.
  • NHS England is Data Controller for data collected and stored on the BBS UK Clinics Ltd patient database; BBS UK Clinics Ltd is contracted to act as Data Processor for this data.

How do we collect information?

We collect personal information from you when you make an online, written or telephone enquiry, attend an event or BBS clinic, register with us, make a donation, volunteer or otherwise provide us with personal information.

Why do we process data?

Across the charity and clinics service, we aim to provide service users with the highest quality information and support services. To do this we need to keep records about service users and, for BBS UK Clinics Ltd service users, the support we have provided or plan to provide to them.  We know that our service users, trustees, staff and volunteers value their privacy and the security of personal information held about them and this Notice outlines our commitment and sets out how we use and protect any information that service users, trustees, staff and volunteers give to BBS UK and BBS UK Clinics Ltd.

Your rights as a ‘data subject’

The ‘data subject’ will have access to certain rights which could include:

√  Right to be Informed

√  Right of Access

√  Right to Rectification

√  Right of Erasure

√    Right to Restrict Processing

√    Right to Data Portability

√    Right to Object

√    Rights related to Automated Decision Making and Profiling

We will ensure that the rights of our service users, staff, trustees and volunteers are complied with in accordance with guidance provided by the Information Commissioners Office under GDPR.

What Information is recorded/processed?

  • BBS UK Service Users:

√    Name, address, contact numbers, email address, IP address, date of birth, contact preferences and information requirements

  • BBS UK Clinics Ltd Service Users:

√    Name, address, contact numbers, email address, IP address, NHS number, date of birth, gender, names of family members, GP contact information, ethnic status, contact preferences and information requirements

√    Benefits, education, health and social care information where provided

√    Referral information which may include symptoms/treatments where given

  • BBS UK Clinics Ltd and BBS UK Staff, Trustees and Volunteers

√    Name, address, contact numbers, email address, IP address, names of family members (i.e. emergency contact information)

√    Staff Only: Contact information as above plus qualifications, employment history, bank details, pension details, tax details, pay, sick leave, ethnicity

Legal basis for data processing

Legitimate Interest is the primary legal basis on which BBS UK and BBS UK Clinics Ltd process personal data.  We have undertaken an assessment of our data processes to ensure that our Legitimate Interest is necessary and proportionate and is the least intrusive basis for processing our service users’ data:

  • The storing and processing of data is necessary to enable the effective provision of our services
  • The data we process, as part of our day to day operations, has minimal impact on the service user’s privacy
  • The principle beneficiaries of the data we process on this basis are service users

We will only use individuals’ data in ways they would reasonably expect, unless we have a very good reason not to, such as an overriding duty to ensure a person’s safety.

In circumstances where Legitimate Interest is not the most proportionate basis to process data we will seek the consent of the person concerned. Personal data will be processed by employees, contracted staff and volunteers in accordance with this Privacy Notice.

Special Category Data

BBS UK and BBS UK Clinics Ltd collect and record limited Special Category Data of its employees including health, ethnicity and disability information.  The legal basis for processing this information is Article 9(2)(b); ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law...’

BBS UK Clinics Ltd collects and records service user ethnicity data for service user monitoring purposes. The legal basis for processing this information is Article 9 (2)(h); ‘processing is necessary for the purposes of … …the management of health or social care systems and services.’

BBS UK Clinics Ltd collects and records service users’ benefits, health, education and social care needs as provided by service users in the provision of support and advocacy services. The legal basis for processing this information is Article 9 (2)(h); ‘processing is necessary for the provision of health or social care…’

Sharing information

We will not sell, distribute or lease any personal information to third parties unless we have permission or are required by law to do so.

The information held about you will only be shared where the following statements apply:

  • You ask us to do so;
  • We ask and you give us specific permission;
  • We are required by law;
  • We are permitted by law, for example where public interest overrides the need to keep the information confidential.

Third Party Processer Contracts

BBS UK and BBS UK Clinics Ltd may from time to time engage the services of third party processors, i.e. for information technology support and security services or secure data/IT equipment destruction services.  As Data Controller, we retain responsibility for this aspect of data processing and will always ensure that robust contracts and security processes and procedures are in place and that the third party complies with the requirements of the GDPR.

Consent

Consent will be used by BBS UK and BBS UK Clinics Ltd in respect of consent to receive general information including newsletters, activities and events information, research information and fundraising and will be reviewed regularly. Any consent request will be unambiguous and involve a clear affirmative action (an opt-in) with the option to opt in (or out) of BBS UK and BBS UK Clinics Ltd separately and the option to choose a preferred method of communication. Any personal data obtained through consent will be retained securely, will be used solely by BBS UK and BBS UK Clinics Ltd and will not be passed to third parties except where required by law. Where consent is the legal basis for processing, ‘data subjects’ retain the right to withdraw consent at any time.

Data retention periods

Data retention periods are reflective of the purposes of processing and will be reviewed subject to need and any changes in legislation. 

Access to personal information

BBS UK tries to be as open as it can be in terms of giving people access to their personal information. You can find out if we hold any personal information by making a ‘subject access request’. If we do hold information about you we will:

√    Give you a description of it

√    Tell you why we are holding it

√    Tell you who it could be disclosed to

√    Give you a copy of the information in an intelligible form

To make a request for any personal information we may hold, write to us at the address at the bottom of this Privacy Notice.  If you believe that any information we are holding about you is incorrect or incomplete, you should contact us as soon as possible so that we may correct any information found to be incorrect.

BBS UK Website

Information submitted and statistics from BBS UK's service usage will be used to enable us to provide, manage and improve the BBS UK services and to email customers occasionally about any BBS UK resources we think may be of interest. BBS UK tracks usage of our websites through the use of cookies.

How we use cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added and the cookie helps analyse web traffic or lets you know when you visit a particular site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

We use traffic log cookies to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

We take your privacy very seriously and comply with the UK and EU law on handling cookies and provide (you) the user with means to remove such cookies or prevent your computer from accepting them in the future.

Blocking and removing cookies

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer.
Below are instructions on removing cookies for all major web and mobile browsers so that you can find out about how to manage your cookies.

Data protection and confidentiality

Some services on the BBS UK website may require us to collect personal information from you. To comply with the General Data Protection Regulations, we have a duty to tell you how we store the information we collect and how it is used. Any information you do submit will be stored securely and will never be passed on or sold to any third party.

Conditions of use

Use of this website constitutes agreement with the following terms and conditions.

While Bardet-Biedl Syndrome UK takes every care to ensure that the materials, information and data (together the ‘Materials’) provided on this site (the ‘Website’) are accurate and up-to-date, we must emphasise that the Materials are provided ‘as is’ and without warranty or guarantee of any kind, whether express, implied or statutory, or whether relating to title, the rights of third parties or otherwise.

Bardet-Biedl Syndrome UK reserves the right, at its absolute discretion, to add, revise or remove any Materials without notice.

Disclaimer

Bardet-Biedl Syndrome UK uses reasonable care to ensure the content of this website is accurate and up to date. Bardet-Biedl Syndrome UK does not guarantee the comprehensiveness, accuracy, suitability, currency or adequacy of this information on the website and disclaims all liability arising from its use. BBS UK shall not be liable for any losses as a result of reliance on information provided. The content of this web site may be changed at any time without notice. 

The Materials are designed for general information purposes only and Bardet-Biedl Syndrome UK assumes no responsibility for information contained in the Website and disclaims all liability in respect of such information. Those who choose to access the site (the “Users”) shall assume all risks of use and shall indemnify and hold Bardet-Biedl Syndrome UK its trustees, officers, employees, and agents harmless from and against any and all damages, liabilities, losses, costs, and expenses, including reasonable attorney’s fees, arising out of or related to use of information, services or products offered and/or presented on this Website. Bardet-Biedl Syndrome UK makes no warranty that the Materials are free of infection by computer viruses or other contamination, or that data or information is created and structured in files that are technically error-free. The downloading of any of the Materials is at the individual user’s own risk and the user will be solely responsible for any damage, loss, or problems, whether suffered by the user or a third party in consequence of the user’s actions, which results from a download and/or use of any such Materials, or from any linked external sites.

Links to other websites

Bardet-Biedl Syndrome UK is not responsible for any content of any other website accessible from the Website, nor does it endorse or in any respect warrant any third party products or services by virtue of any information, material or content referred to or included on, or linked from or to the Website. Bardet-Biedl Syndrome UK has no control over, the data protection or privacy policies of these sites and makes no representation that the information or opinions contained on these sites, or associated links to these sites, are accurate, reliable or complete. Visitors should consult the privacy policies of these other websites and enter these sites at their own risk.

Copyright Notice 
All information and copyright incorporated within this website is the property of BBS UK and any unauthorised reproduction is prohibited. Unauthorised use of BBS UK trademarks, trade names and logos is prohibited. 

Complaints or Queries

BBS UK and BBS UK Clinics Ltd tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate; if anyone wants to make a complaint about the way we have processed their personal information please see contact details below.  We would also welcome any suggestions for improving our procedures.

This privacy notice was drafted with brevity and clarity in mind. It does not provide exhaustive detail of all aspects of data collection and use of personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

Changes to this Privacy Notice

We keep our Privacy Notice under regular review which means it may change from time to time in line with legislation or industry developments. We will not explicitly inform our service users of these changes. Instead, we recommend that you check this page occasionally for any Privacy Notice changes.

This privacy notice was last updated on 24th May 2018.

How to contact us:

The person responsible for data protection at BBS UK and BBS UK Clinics Ltd is:

Tonia Hymers, 43 Balton Way, Dovercourt, Harwich, Essex, CO12 4UP

E: info@bbsuk.org.uk

E: tonia.hymers@bbsuk.org.uk

T: 07591 206680

Queries and complaints may also be directed to:

Abbie Geeson

Secretary, BBS UK

E: abbie.geeson@bbsuk.org.uk