Patient Advisory Group Privacy Notice
This privacy notice should be read in conjunction with Privacy Statement found at: https://ibdregistry.org.uk/privacy-policy
The purposes of the processing and recipients of personal data
This privacy policy applies to the information we hold about you in relation to your application to and/or membership of our Patient Advisory Group (PAG).
It is designed to allow us to collect personal details from you as part of any application that you make to us to join our Patient Advisory Group. These details include:
a. Your contact information, so that we can contact you regarding the PAG
b. Your IBD diagnosis (if any), to allow us to assess that we have a balanced representation of the IBD community in the PAG
c. Any further information that you choose to disclose to us as part of your application to join the PAG or your ongoing involvement in the group.
d. Demographics information that you voluntarily disclose to us as part of your application or equality and diversity monitoring
Categories of personal data
The data we process is personal data as defined by data protection law. It includes contact data, information about your IBD diagnosis and demographic information which may include information relating to your racial or ethnic origin. Some of this information is a special category of data under the Data Protection Act (which incorporates the UK’s General Data Protection Regulation (GDPR)). This means that we need a lawful basis under Article 6 of the UK GDPR to carry out the processing as well as meeting a condition under Article 9 of the UK GDPR.
Source
You provide your details to us directly. These are collected during the application process, through equality and diversity monitoring and through your ongoing involvement as a member of the PAG.
Recipients
We will not share this data with anyone without your prior written permission (for example, sharing contact details of PAG members with each other for the purposes of involvement the Group).
The lawful basis for the processing
We have identified the lawful basis for processing your data in the Registry as being:
Personal Data
6.1 (f) processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.
Special Categories of Personal Data
9.2 (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.
or
9.2 (j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.
Your rights
In addition to the rights outlined in our Privacy Statement, you have the following rights under the GDPR, which this Privacy Notice and our use of personal data have been designed to uphold:
- your right to withdraw your consent where this has been relied upon as the lawful basis for processing
International Transfers
Your data will only be stored within the European Economic Area (“the EEA”) (The EEA consists of all EU member states, plus Norway, Iceland, and Liechtenstein).
Retention
We only keep your personal data for as long as we need to in order to use it in relation to your PAG membership and/or for as long as we have your permission to keep it.
Automated decision-making or profiling
We do not undertake any automated decision-making or profiling in relation to your personal data processed for communications purposes.