The IBD Registry is closing current activities by Easter 2024, and is in discussions through Spring 2024 about possible transition to an NHS organisation. See our Closure Announcement, Data Transfer Update, Closure FAQs and Achievements. 

Privacy Statement

The IBD Registry is closing on 31 March 2024, with contact available through April. Read this page to find out about how we process your data. If you are looking to make a data subject request to access or delete your personal data that the Registry may hold about you, please contact us at [email protected]

Background

The IBD Registry (often known as ‘the Registry’ and called this here) understands that your privacy is important to you and that you care about how your personal data is used and shared. We respect and value the privacy of everyone and will only collect and use personal data in ways that are described here, and in a manner that is consistent with our obligations and your rights under the law.

This privacy framework operates as our privacy notice and tells you what you can expect us to do with your personal data when you:

  • Visit our website or receive our newsletters where we collect information about you to manage our general or public communications with you.
  • Participate in the Registry as someone with inflammatory bowel disease (IBD) so that we collect information within the Registry about you, your IBD, the impact that it has on you, and the medical care and treatment that you receive. This data collection is in order to improve the health of people living with IBD in the UK by improving understanding of the care of people with IBD and their treatments and to facilitate research.
  • Have agreed to be contacted by us in relation to your participation in the Registry and/or about participating in further research.
  • Are a healthcare or related professional interacting with us regarding activities and interests of the Registry and we collect information to support our communications with you based on our Registry work and activities that we think are relevant to you (such as our clinical data collection, service quality improvement, clinical newsletters, etc)
  • Are applying for a job with us, are an employee, or are otherwise working for or with us and we collect information to support recruitment, to enter into and fulfil a relevant contract with you, and, for employees, to meet relevant legal obligations under employment law or other legislation.
  • Are an individual interacting with us for any other Registry purposes, such as our Patient Advisory Group, and we collect information about you to manage our communications with you plus our relevant legitimate interests (such as checking conflicts of interest).

Each of these categories has its own specific privacy notice which you can access by clicking on the link in that section.

In each of these we’ll tell you:

  • what purposes we are processing your data for;
  • if you have a statutory or contractual obligation to provide it to us and, if so, we will tell you what this is;
  • if we do not gather personal data from you directly, what types (categories) of personal data we obtain;
  • where we obtain your personal data from (if it is not obtained from you directly);
  • whether there are other recipients of your personal data;
  • why we are able to process your data;
  • whether we intend to transfer it to another country;
  • how long we store it for; and
  • whether we do automated decision-making or profiling.

Information about us

The IBD Registry is a company limited by guarantee registered in England under company number 11197749, whose registered address is 1 St Andrews Place, Regent’s Park, London NW1 4LB.

We are a not-for-profit organisation, founded by three joint members – the Royal College of Physicians, The British Society of Gastroenterology and Crohn’s & Colitis UK.

We act as the Data Controller for the personal data that you submit to us, unless otherwise stated, and protect that data in accordance with all relevant laws.  We are registered with the ICO (Information Commissioner’s Office) and our registration number is: ZA334069.

Your rights under data protection law

Under data protection law, you have rights we need to make you aware of.  The rights available to you depend on our reason for processing your personal data.

Your right to be informed – You have the right to be informed if we are processing your personal data.  We do this by providing you with this Privacy Notice and by providing you with additional or supplementary information at the point at which we collect any personal data from you.  You can read more about this here.

Your right of access – You have the right to ask us for copies of your personal data. There are some exemptions, which means you may not always receive all of the information we process. You can read more about this here.

Your right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. You can read more about this here.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances. You can read more about this here.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances. You can read more about this here.

Your right to data portability – This only applies to information you have given to us. You have the right to ask that we transfer the information you gave to us to another organisation, or to give it to you. The right only applies if we are processing information based on your consent or under a contract, or are in talks about entering into a contract and the processing is automated. You can read more about this here.

Your right to object to processing – You have the right to object to us processing your personal data if this is taking place on the basis of a public task, or is in our legitimate interests. You can read more about this here.

You are not required to pay any charge for exercising your rights. We have one month to respond to you, however we may extend the time to respond by a further two months if the request is complex or we have received a number of requests from the you.  If this is the case we will let you know within one month of receiving your request and explain why the extension is necessary.

Please use our Data Subjects Rights Portal to make a request.

Special categories of personal data

We sometimes process data that is which is considered to be more sensitive and requires additional protection. This is called special category data (it used to be called sensitive data), and includes, for example:

  • You have informed us that you (or someone you are a carer for) has IBD.
  • You take part in patient panels and clinical trials and have provided health information to be invited to relevant opportunities.
  • You are an employee and have provided health and/or disability information to ensure suitable and safe working conditions.
  • You complete an equal opportunities monitoring form.

Where we process Special Category data, we set out the specific purposes for which we may do this and the lawful basis which supports our processing.

How long we keep personal information

We set out how long we can keep each type of personal data, which is aligned by our retention policy.

Who we share your data with

We set out each of the specific purposes for which we may process your personal data and in which circumstances we will ordinarily or routinely share this with others.

In addition, we may be legally required to share certain data held by us, which may include your personal data, for example where we are involved in legal proceedings, where we are complying with legal obligations, a court order, or a governmental authority.

We also share your personal data with third-party organisations where we have engaged them to process personal data on our behalf as a data processor.  We only share data or appoint third parties to act as data processors on our behalf where they can give sufficient guarantees they will implement appropriate technical and organisational measures to ensure their processing will meet the requirements of the General Data Protection Regulation (GDPR) and protect data subjects’ rights.  We also hold written contracts with all third-party data processors which require them to only process data on our written instructions and to treat the data in a confidential manner.

Contact us

We work to high standards when it comes to processing your personal information. If you have queries or concerns, please contact us and we’ll respond as quickly as possible.

It helps us if you can contact us by email. If you want to request access to and/or deletion of your personal data, please use our Data Subjects Rights Portal.

If you want to write to us, our postal address is:

1 St Andrews Place,
London,
NW1 4LB

Our Data Protection Officer is Adam Spinks, who can be contacted by email or at the postal address given above.

Complaints

Please let us know if you have any concerns or a complaint. If you remain dissatisfied, you can make a complaint about the way we process your personal information to the Information Commissioner’s Office.

We keep our privacy notice under regular review to make sure it is up to date and accurate. Details of any changes made to our privacy framework or privacy notices will be listed here. We recommend that you review this page from time to time.

Last updated: January 2024