Privacy policy – Rare Dementia Support

Rare Dementia Support Privacy Policy (updated April 2024)

This privacy notice is provided to explain how we use and protect the information obtained from any individual who:

contacts Rare Dementia Support (RDS) by any means;
visits and uses RDS’ website (www.raredementiasupport.org) (the “website”);
participates in the RDS members forum via the website
requests information under the information compliance legislation, e.g. data protection or freedom of information;
provides RDS with unsolicited personal information.

RDS is a UCL-led collaborative service. UCL (the “University”, “us” or “we”), a company incorporated by Royal Charter (number RC 000631), is the entity that determines how and why your personal data is processed. In accordance with data protection legislation, UCL is the ‘Data Controller’ and this means that UCL is legally responsible for the personal data that we collect and hold about you. RDS is committed to protecting your privacy. One of our responsibilities is to tell you about the different ways in which we use your personal data – what information we collect (and our legal basis for doing so), why we collect it, where we collect it from and whether (and with whom) we will share it. We also need to tell you about your rights in relation to the information. This statement provides further details about all of these issues.

Information RDS collects to help us manage your RDS membership

Your personal and special category data will be collected and held by RDS, as part of UCL. Personal data, or personal information, means any information about an individual from which that person can be identified. In order to communicate with you, to provide you with services or information, we may collect, use, store and transfer different kinds of personal data about you. Depending on your relationship with us, this may include:

Personal details (such as your name, contact details and email address) that you provide by contacting us, requesting information or submitting your information via the website.
Your responses to surveys which we ask you to complete for service evaluation and/or research purposes.
Any other information you post, email or otherwise send to us.
How you use the RDS digital platform (e.g. website, forum) and where available, your IP address, operating system and browser type.
Your interest in RDS (e.g. as a carer, professional, and/or person living with a diagnosis).
Which support group(s) you are interested in.
Information you provide when you register for and participate in the RDS members forum.

Information provided by you to RDS for you to receive direct support

When you contact the RDS Direct Support Team (including by email) whether in respect of yourself or someone you care for/work alongside, you may be required to provide personal information, some of which may be special category personal information. Special category data includes information about an individual’s health. This could include details relating to the health of the relevant individual, medication details for the individual, health-related and other information such as: legal & financial support, relationships & emotions, living with a condition, support options, and research interests. We will also record actions we have agreed with you (if any), and the outcome of those actions. You do not have to give us this information, but if you do so we will manage it securely in accordance with the UK General Data Protection Regulation and this privacy notice.

Personal information provided to us through or by third parties: Sometimes, we receive personal information about you when you engage with other organisations. When this happens we will treat the information in the same way as if you had shared it directly with us.

In some cases you may choose to provide unsolicited personal information (information we have not asked for) to us, such as additional medical information you wish to discuss with the RDS team. Where this is the case, this personal data will be handled with the same care as any other personal data we process and in accordance with data protection legislation as laid out in this notice.

We will also collect personal information about website usage through cookies in accordance with our Cookies Policy.

How will we use the information

We will only use these personal and special category data when the law allows us to do so.

Most commonly, we will use your personal and special category data for the following purposes:

to help you with your RDS membership enquiry or request
to comply with a legal or regulatory obligation
to enable us to provide you with information about RDS
to enable us to provide you with the RDS service
to process feedback and improve our services
to manage and improve the website and troubleshoot problems
to enable you to register and participate in the members forum
where personal and sensitive information is collected on RDS’ website, for instance through a web form, users will be informed that the information is being captured in accordance with this local privacy notice
where you have requested information from UCL under freedom of information or data protection legislation, or more generally, we may share your personal data with UCL colleagues in order to deal with your request.
with your consent, we will use these data collected as part of the RDS service to assist in the research and development of our dementia support, and could be analysed by our research team.

Data protection legislation requires that we meet certain conditions before we are allowed to use your data in the manner described in this notice, including having a “legal basis” for the processing. These bases are explained below.

Consent: You have given us your consent for processing your personal data.

Public task: The processing of your personal data may be necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us.

Legitimate interests: The processing of your personal data may be necessary for the purposes of the legitimate interests pursued by us or by a third party, except where such interests are overridden by your interests or by fundamental rights and freedoms which require protection of personal data. It may be necessary for our legitimate interests to collect your personal data to enable us to manage certain operations of the University effectively.

Legal obligation: Processing is necessary for compliance with a legal obligation to which the controller is subject.

Performance of contract: The processing of your personal data may be necessary in relation to the contract we have entered into with you or an organisation you represent, to provide UCL’s services to you, or because you have asked for something to be done so you can enter into such contract.

Vital interests: We have a basis to use your personal and sensitive information where it is necessary for us to protect life or health; for instance, if there were to be a safeguarding issue which required us to share information provided to RDS. In certain exceptional circumstances, we may be required to share your information with other agencies, such as the police and ambulance services where we consider it is necessary or appropriate to do so. Where possible, we will consult with you prior to sharing any information and limit the amount of information provided to a minimum, pertinent to the required purpose. We will also ensure that appropriate steps are taken to protect your information according to UK data protection laws and this privacy notice.

Exceptional circumstances may include:

Where we are legally required to do so by a court order or other law enforcement agencies, professional regulators, and/or safeguarding agencies.
Where you or someone you are calling about is at risk of serious harm, neglect, death, or other significant threat to self or personal safety and wellbeing and lack capacity under the Mental Capacity Act 2007.
Where you have told us that a child may be experiencing harm or other threats to their personal safety and well-being, either from their own actions or the actions of others.
Where disclosure is deemed necessary to prevent a crime or serious offence being committed.

The legal basis for processing special category data

When we collect special category personal data, we require an additional legal basis to do so under data protection laws, so will either do so on the basis of your explicit consent (including verbal consent) or another route available to us at law for using this type of information (for example if you have made the information manifestly public, we need to process it for health and social care reasons, your vital interests, or, in some cases, if it is in the public interest for us to do so).

Sharing your personal information

We may have to share your personal data with the parties set out below for the purposes outlined above:

External third party service providers: there may be times when external organisations use your personal information as part of providing a service to us or as part of checking the quality of our service, such as our auditors. We may use third party providers to deliver our services e.g.

website hosting and web development services provided to RDS. Provision of these services will be subject to a data processing agreement.
externally hosted software, cloud providers and voicemail/messaging services, and those providers may involve transfers of personal data outside the UK. These third-party services are not owned or managed by UCL. Where we use a third party provider, we ask you to refer to that provider’s legal terms and privacy policies.
Law enforcement or other government and regulatory organisations (see ‘Vital Interests’ section above)

Links to other websites from www.raredementiasupport.org or our materials do not imply an endorsement of the materials or policies on those websites. If you follow a link to other websites please note that these websites will have their own privacy policies and that we do not accept responsibility or liability for these policies. You should read the privacy policies of each site you visit to determine what information that site may be collecting about you.

Data transfers outside of the UK

In certain circumstances we may transfer your personal data outside the UK, e.g. where we use a third party cloud services provider based outside the UK to store personal data. Where we transfer your personal information across national boundaries to a third party, such as one of our service providers or to our research collaborators, we will protect your personal information by ensuring that those transfers are made in compliance with all relevant data protection laws. Generally, this means where we transfer your personal information to a third party that is located in a country which does not have adequate privacy protection, we will put in place a contract with the third party that includes the standard international data transfer contractual terms approved by the UK’s Information Commissioner.

How we will protect information about you

RDS is responsible for storing your personal information securely. We use rigorous procedures and strict security features when we collect your personal information in order to prevent unauthorised access. However, no data transmission over the Internet is 100% secure and although we try to protect your personal information, RDS and/or UCL cannot guarantee the security of any information you transmit to us and you do so at your own risk.

Data protection legislation obliges us to follow security procedures regarding the storage and disclosure of personal information in order to avoid unauthorised loss or access. As such we have implemented security systems and procedures in place to protect information from unauthorised disclosure, misuse or destruction. We have established procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

Data retention

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any service, research, legal, accounting, or reporting requirements. UCL’s data retention schedule can be found here: https://www.ucl.ac.uk/library/about-us/records-office/records-retention

Your rights

Under certain circumstances, you may have the following rights in relation to your personal data:

Right 1: A right to access personal data held by us about you.

Right 2: A right to require us to rectify any inaccurate personal data held by us about you.

Right 3: A right to require us to erase personal data held by us about you. This right will only apply where, for example, we no longer need to use the personal data to achieve the purpose we collected it for; or where you withdraw your consent if we are using your personal data based on your consent; or where you object to the way we process your data (in line with Right 6 below). Some exceptions may apply here e.g. where your data have already been included in research and the data must be retained for research governance purposes

Right 4: A right to restrict our processing of personal data held by us about you. This right will only apply where, for example, you dispute the accuracy of the personal data held by us; or where you would have the right to require us to erase the personal data but would prefer that our processing is restricted instead; or where we no longer need to use the personal data to achieve the purpose we collected it for, but we require the data for the purposes of dealing with legal claims.

Right 5: A right to receive personal data, which you have provided to us, in a structured, commonly used and machine readable format. You also have the right to require us to transfer this personal data to another organisation.

Right 6: A right to object to our processing of personal data held by us about you.

Right 7: A right to withdraw your consent, where we are relying on it to use your personal data.

Right 8: A right to ask us not to use information about you in a way that allows computers to make decisions about you and ask us to stop.

If you wish to exercise any of these rights, please contact the Data Protection Officer using data-protection@ucl.ac.uk or +44 (0)20 3108 8726.

You have the right to lodge a formal complaint with the UK Information Commissioner’s Office. Full details may be accessed on the complaints section of the ICO’s website.

How to contact us

You can contact RDS directly by emailing contact@raredementiasupport.org.

If you have any questions about our privacy notice, please email contact@raredementiasupport.org. You may also contact the UCL Data Protection Officer (data-protection@ucl.ac.uk) University College London, Legal Services, 6th Floor, Bidborough House, London, WC1H 9BF.

Changes to the RDS privacy notice: this privacy notice may be updated from time to time. Any updates will appear on this webpage. The notice was last updated on 18-May-2021.