What is the purpose of this document?
UK-Med is committed to protecting the privacy and security of your personal information.
This privacy notice describes how we collect and use personal information about you during and after your relationship with us, in accordance with the General Data Protection Regulation (GDPR).
It applies to all members of the UK-Med Community of Practice.
UK-Med is a Charitable Incorporated Organisation (registered with number 1166956). Our main place of business is at UK-Med, c/o Humanitarian & Conflict Response Institute, C1.54 Ellen Wilkinson Building, The University of Manchester, Oxford Road, Manchester M13 9PL. Our telephone number is 0161 275 7873.
UK-Med is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.
This notice applies to any individual whose personal information we hold, including current and former members of the UK-Med Community of Practice (a “UK-Med Member”), anyone who wishes to support UK-Med’s charitable mission by donating their time and/or money and anyone who is interested in finding about more about what we do (both a “Supporter”) . We may update this notice at any time but if we do so, we will provide you with an updated copy of this notice as soon as reasonably practical.
It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.
Data protection principles
We will comply with data protection law. This says that the personal information we hold about you must be:
The kind of information we hold about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
There are certain types of more sensitive personal data which require a higher level of protection, such as information about a person’s health or sexual orientation. Information about criminal convictions also warrants this higher level of protection.
We may collect, store, and use the following categories of personal information about your: Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses, date of birth, gender, CV, marital status, next of kin and emergency contact information, your speciality and grade, employment status, your registration body and registration number, the year in which you were initially registered, passport details, Certificates of education, photographic image(s), payment card or bank account details.
We may also collect, store and use the following more sensitive types of personal information (or “Special Categories of Personal Data”, as defined by data protection legislation) from those applying to be a UK-Med Member:
Information about your health, including any medical condition, health and sickness records, including:
Information about criminal convictions and offences
Please see below for how we collect and process this sensitive personal information.
How is your personal information collected?
We initially collect personal information about potential UK-Med Members through our application process, either directly from potential UK-Med Members or sometimes from a background check provider. Either you or we may update your personal information from time to time. We may collect additional personal information in the course of any pre-deployment activities (such as Well Travelled Clinics) and other deployment-related activities whilst you are a member of the UK-Med Member.
We collect personal information about potential Supporters directly from the Supporter when they register their interest with us. However we may also collect your personal information through third-party fundraisers, such as JustGiving, GoFundMe and Virgin Money Giving. A complete list of these fundraising organisations is available on request. If your personal information is collected in this way it is treated no differently to any other personal information held by UK-Med, and is bound by the terms of this Privacy Notice as soon as it is received. We may gather information about you from publicly available sources – for example, Companies House, the Electoral Register, the internet and the media – to help us to understand more about you as an individual and your ability to support UK-Med.
We will aim to keep your details up to date, and we will conduct projects to check the contact details we have for you are correct, and, where appropriate, update them.
How we will use information about you
We will only use your personal information when the law allows us to. Most commonly, we will use your personal information in the following circumstances:
We may also use your personal information in the following situations, which are likely to be rare:
We set out how we use your sensitive personal information below in the paragraph titled “How we use particularly sensitive personal information
Situations in which we will use your personal information
We need all the categories of information in the list above primarily to allow us to facilitate any deployment and to enable us to comply with legal obligations. In some cases we may use your personal information to pursue legitimate interests, provided your interests and fundamental rights do not override those interests. The situations in which we will process your personal information are listed below.
Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.
We may need some of the categories of information in the list above to allow us to provide you with opportunities to support the furthering of UK-Med’s charitable mission. The situations in which we will process your personal information are listed below.
Fundraising is a key part of UK-Med’s strategic plan, and we are committed to working in a transparent, ethical, responsible and honest way when raising money when raising money. We ensure that we act in accordance with UK-Med’s Ethical Fundraising Policy at all times when using your personal information. We are a member of the Fundraising Regulator and committed to the Regulator’s Code of Practice; and we will always abide by our Fundraising Promise.
We strive to provide you with choices regarding the use of your personal information, particularly around fundraising. You will receive fundraising communications from us if you have requested information from us and have not opted out of from receiving such communication. You can ask us to stop sending you fundraising messages at any time by logging onto our website and checking or unchecking relevant boxes to adjust your marketing preferences or by following the unsubscribe links on any message sent to you.
If you fail to provide personal information
If you are or are applying to be a UK-Med Member and you fail to provide certain information when requested, we may not be able to consider your application to join the UK-Med Community of Practice, or to deploy you in the field if you are a member, or we may be prevented from complying with our legal obligations (such as to ensure the health and safety of members of the UK-Med Community of Practice).
Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
How we use particularly sensitive personal information
“Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We have in place an appropriate policy document and safeguards which we are required by law to maintain when processing such data. We may process special categories of personal information in the following circumstances:
Less commonly, we may process this type of information where it is needed in relation to legal claims or where it is needed to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.
Our obligations in relation to particularly sensitive personal information
We will use particularly sensitive personal information belonging to UK-Med Members in the following ways:
Do we need your consent?
We do not need your consent if we use special categories of your personal information in accordance with our written policy to carry out our legal obligations or exercise specific rights. In limited circumstances, we may approach you for your written consent to allow us to process certain particularly sensitive data. If we do so, we will provide you with full details of the information that we would like and the reason we need it, so that you can carefully consider whether you wish to consent. You should be aware that it is not a condition of your membership of the UK-Med Community of Practice that you agree to any request for consent from us. However, we may not be able to accept you as a member of the UK-Med Community of Practice or deploy you if you are not willing to consent to the disclosure of special categories of personal data.
Information about criminal convictions
We may only use information relating to criminal convictions where the law allows us to do so. This will usually be where such processing is necessary to carry out our obligations and provided we do so in line with our data protection policy.
Less commonly, we may use information relating to criminal convictions where it is necessary in relation to legal claims, where it is necessary to protect your interests (or someone else’s interests) and you are not capable of giving your consent, or where you have already made the information public.
We envisage that we will hold information about criminal convictions.
We only collect information about criminal convictions if it is appropriate given the nature of your role and where we are legally able to do so. Where appropriate, we will collect information about criminal convictions as part of the application process or we may be notified of such information directly by you in the course of your membership of the UK-Med Community of Practice.
Subject to a risk assessment, we may collect and process disclosure and barring data (DBS) on past criminal convictions (for example for clinicians proposed for on-call and/or deployment teams or other roles covered by the Rehabilitation of Offenders Act 1974 (Exceptions) Order 1975). We consider this data highly sensitive and its handling will be undertaken in line with the DBS Code of Conduct.
We are allowed to use your personal information in this way with your consent, which we will seek during the application process. We have in place an appropriate policy and safeguards which we are required by law to maintain when processing such data.
Automated decision-making takes place when an electronic system uses personal information to make a decision without human intervention. We are allowed to use automated decision-making in the following circumstances:
If we make an automated decision on the basis of any particularly sensitive personal information, we must have either your explicit written consent or it must be justified in the public interest, and we must also put in place appropriate measures to safeguard your rights.
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.
We may have to share your data with third parties, including third-party service providers.
We require third parties to respect the security of your data and to treat it in accordance with the law. We may transfer your personal information outside the EU.
If we do, you can expect a similar degree of protection in respect of your personal information.
Why might you share my personal information with third parties?
We will share your personal information with third parties where required by law, where it is necessary to administer our relationship with you or where we have another legitimate interest in doing so.
Which third-parties process my personal information?
We work in partnership with the Department for International Development (DFID) and other recognised partners, including Humanity and Inclusion (HI). If you are a rehabilitation or spinal injury specialist we will need to share your Community of Practice profile information and associated data with HI (including your CV as required), and on occasion other partners to facilitate training and deployment. Please contact us for a full list of specialties that fall within this partnership.
In the event of a sudden onset-disaster, DFID or a recognised NGO partner may request that we share CVs of members of the UK-Med Community of Practice that might meet specific requirements and/or considerations. Further data will be shared with DFID at the point of deployment, for example your name, contact number, employing Trust, speciality, email, address and passport details.
If you are confirmed as a member of a training or deployment team led by a recognised partner (such as Humanity and Inclusion (HI)), we will share essential personal data e.g. name, mobile telephone number, email address, medical outcome result, passport details and next of kin, registration number, CV and we may ask you to provide additional documentation such as registration and qualification certificates. If you have any concerns about the use of data for this purpose, please contact the UK- Med Membership Team by email to firstname.lastname@example.org or by writing to Membership Team UK- Med c/o Humanitarian Conflict Response Institute C1.54 Ellen Wilkinson Building University of Manchester Oxford Road M13 9PL.At the time of deployment overseas, we are required to share your name and professional registration data and on request, certificates of education and registration, with partner organisations in destination countries to ensure authority to practice.
Your personal data will not be shared with next of kin unless there is judged to be a genuine and serious threat to your health or safety.
How secure is my information with third-party service providers?
All our third-party providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-parties to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.
What about other third parties?
We may share your personal information with other third parties, for example in the context of the restructuring of UK-Med. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction.
We may also need to share your personal information with a regulator or to otherwise comply with the law.
Transferring information outside the EU
We may transfer the personal information we collect about you to countries outside the EU to which you are to be deployed for the purposes of facilitating your deployment. We will advise you whether or not there is an adequacy decision by the European Commission in respect of any such country. This will determine whether the country to which we transfer your data is deemed to provide an adequate level of protection for your personal information.
However, to ensure that your personal information does receive an adequate level of protection we will put in place appropriate measures to ensure that your personal information is treated by those third parties in a way that is consistent with and which respects the EU and UK laws on data protection. If you require further information about these protective measures, you can request it from the Membership Team by email to email@example.com or by writing to Membership Team UK-Med c/o Humanitarian Conflict Response Institute C1.54 Ellen Wilkinson Building University of Manchester Oxford Road M13 9PL.
We have put in place measures to protect the security of your information. Details of these measures are available upon request.
Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from the Membership Team by email to firstname.lastname@example.org or by writing to Membership Team UK-Med c/o Humanitarian Conflict Response Institute C1.54 Ellen Wilkinson Building University of Manchester Oxford Road M13 9PL.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
How long will you use my information for?
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our retention policy which is available from our Membership Team by email to email@example.com or by writing to Membership Team, UK-Med c/o Humanitarian Conflict Response Institute C1.54 Ellen Wilkinson Building University of Manchester Oxford Road M13 9PL.
To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer a member of the UK-Med Community of Practice we will retain and securely destroy your personal information in accordance with our data retention policy.
Rights of access, correction, erasure, and restriction Your duty to inform us of changes
It is essential that the personal information we hold about you is accurate and current particularly in relation to professional data, current CV and contact details. Please keep us informed if your personal information changes during your membership of the UK-Med Community of Practice. We may contact you periodically to update your details.
Your rights in connection with personal information
Under certain circumstances, by law you have the right to:
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the Membership Team by email to firstname.lastname@example.org or by writing to Membership Team, UK-Med c/o Humanitarian Conflict Response Institute C1.54 Ellen Wilkinson Building University of Manchester Oxford Road M13 9PL.
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Right to withdraw consent
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact the Membership Team by email to email@example.com or by writing to Membership Team, UK-Med c/o Humanitarian Conflict Response Institute C1.54 Ellen Wilkinson Building University of Manchester Oxford Road M13 9PL. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
Changes to this privacy notice
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
UK-Med is committed to looking after any information that is made available to us when you visit our websites in accordance with data protection law. This section of our Privacy Notice outlines what categories of information we retain and how we use it.
When you visit our website the following information is received and stored by our web servers: anonymised details of your IP address, browser type and operating system; and the web pages you visited. This data is known as web server logs. We use this information strictly to analyse how our website is used by our visitors and we may archive this information in an anonymous form for historical records.
Our websites use ’cookies’ which are text files placed on your computer when you visit a site which help us understand how you use our websites. Cookies don’t collect personal data from your computer, only the data created by your browsing. Some cookies remain on your computer after you leave the website; these are called ‘persistent’ cookies. Others are deleted automatically when you close your browser and others simply expire. We use the following cookies on our websites:
Analytics cookies and advertising cookies set by Google Analytics
We may collect non-person-identifying information relating to your use of our sites via Google Analytics technology. This may include: which pages you see; how long you stay; what you click on our pages; if you visit the website again; which country and city you are browsing from; etc. This data is collected for the purpose of monitoring and understanding the effectiveness of our website. We also collect data relating to the demographics and interests of our users via Google Analytics and cookies set by Google advertising networks. This data is used in aggregated form to help improve the site and UK-Med’s marketing efforts.
Facebook custom audience pixel
Each Facebook user possesses a clear and device-independent Facebook ID, meaning it’s possible to recognise the user on the social network and their interactions with UK-Med’s website. It’s then possible to retarget website visitors for advertising purposes by means of Facebook adverts.
For example, the pixel allows UK-Med to serve Facebook advertising to all users who have visited a specific page on its website during a set time period of up to 180 days. After 180 days, the user information is deleted. If the visitor accesses our website again after this period, user information will reset and be collected as stated above (browser setting, hashed version of Facebook ID and URL being visited). No personal information is disclosed to UK-Med in relation to individual website visitors.
How to delete and manage cookies in your browser
You can choose not to accept cookies and delete existing cookies on your computer or mobile device using your browser settings. Please use the links below to find out how to do this for your browser:
For browsers not listed here, please refer to the manufacturer’s website.
If you have any questions about this privacy notice, please contact the UK-Med Membership Team by email to firstname.lastname@example.org or by writing to Membership Team, UK-Med c/o Humanitarian Conflict Response Institute C1.54 Ellen Wilkinson Building University of Manchester Oxford Road M13 9PL.