1. Interpretations and definitions

Interpretation

Words with initial capital letters have meanings defined below. These definitions apply whether the terms appear in singular or plural.

Definitions

• Organisation: / We / Us / Our: MDS UK Patient Support Group, Springboard Business Centre, 24 Ellerbeck Way, Stokesley Business Park, Stokesley, TS9 5JZ.
• Website: www.mdspatientsupport.org.uk
• Service: Any services or resources We provide, including support services, newsletters, events, online forms, forums, campaigns, fundraising platforms and information services.
• You / Your: Any individual accessing or using the Service, or any organisation on whose behalf the individual is acting.
• Personal Data: Any information relating to an identified or identifiable individual.
• Sensitive Personal Data: Includes health information, ethnicity, or other special category data under UK GDPR.
• Device: Any device capable of accessing the Service (e.g. mobile, tablet, computer).
• Service Provider: Any external organisation processing data on behalf of MDS UK (e.g. Mailchimp, website hosts).
• Cookies: Small files placed on your device by a website to store information and enhance functionality.
• Usage Data: Data collected automatically from Your interaction with the Website, such as IP address, browser type, duration of visit, or page views.
• Country: United Kingdom.

 

2. What personal information we collect

We may collect and process Personal Data when You join MDS UK, contact Us for advice or support, use Our Website, participate in Our events, or otherwise interact with Our services. This applies whether or not You choose to become a member.

Personal Details

We may collect the following information when You contact Us or register for support or services:

• Name
• Postal address
• Email address
• Telephone number

Personal Characteristics

These may be collected to tailor support, ensure accessibility, or for equality monitoring. These are Special Category Data under UK GDPR.

• Gender (Special Category Data)
• Ethnicity (Special Category Data)
• Date of birth

Information Related to MDS

We may collect information related to Your health needs or the needs of the person You support, whether or not You join as a member.

This is Special Category Data.

• Your relationship to MDS (e.g., patient, family member, carer, healthcare professional)
• Information You choose to share about Your MDS diagnosis or the diagnosis of the person You support.

Note: This may include people who contact the charity for guidance, emotional support, or information but do not wish to become members.

Communication and Preference Data

• Your preferences for receiving updates, newsletters or event information
• Records of communications and support interactions
• Survey or feedback responses you choose to give

Usage Data

• Attendance at support meetings or events
• Engagement with Our email communications
• Website analytics (such as page views, navigation and the duration of visits)
• IP address and browser information collected automatically

Cookies and Tracking

We use cookies to operate, secure and improve Our Website:

• Essential cookies
• Analytical/performance cookies
• Marketing cookies

For more details, see Our Cookie Notice.

 

3. When and how we collect information

We collect Personal Data in several ways, depending on how You interact with MDS UK. This includes individuals who join as members and individuals who contact Us for advice, information, or support but choose not to join.

Information You Provide Directly

We collect Personal Data when You:

• Contact Us by phone, email, post, webform or social media
• Request information or support from Our team
• Register for events, support meetings or patient information sessions
• Become a member of MDS UK
• Request printed materials such as the MDS UK Patient Handbook
• Engage with Our fundraising activities or make a donation
• Complete surveys, feedback forms or evaluations
• Interact with Our online support resources or communication channels

This may include Personal Details, Personal Characteristics and Special Category Data relating to MDS, even if You choose not to become a member.

Information Collected Through Your Use of Our Website

When You visit or interact with Our Website, We may automatically collect:

• IP address and browser details
• Website navigation patterns and page access information
• Duration of visit and engagement with content
• Cookie and tracking data (see Cookie Notice)
• This helps Us improve the information and support we provide.
• Information From Trusted Third Parties
• We may receive information from:
• Email distribution platforms (e.g. Mailchimp)
• Event registration systems (e.g. Zoom)
• Fundraising or donation platforms (e.g. GoDonate, Just Giving)
• Website hosting and analytics providers

This information is used to deliver services You have requested, administer events, improve engagement, and ensure the smooth running of Our support services.

 

4. Information We Automatically Collect

When You interact with Our Website or digital services, We may automatically collect certain technical information. This helps Us understand how people use Our resources, improve accessibility, and ensure the Website functions securely and reliably.

4.1 Usage Data

We may collect information automatically transmitted by Your browser or device, including:

• IP address
• Browser type and version
• Device information (e.g., mobile, desktop, tablet)
• Operating system
• Approximate geographical location (derived from IP)
• Dates, times and duration of Your visit
• Pages viewed and navigation paths
• Referral sources (how You reached the Website)
• Interaction patterns, such as scrolling, clicks, and resource downloads

This information helps Us understand how Our Website is used and allows Us to improve the content and accessibility for people affected by MDS.

4.2 Cookies and Tracking Technologies

We use Cookies and other tracking technologies to support Website functionality and improve user experience. These may include:

Essential cookies

• Required for the Website to function (e.g., security, session management).

Analytical/performance cookies

• Used to understand how visitors use the Website, identify which pages are helpful, and improve information delivery. These do not directly identify You.

Marketing cookies

• Used to help raise awareness of MDS and ensure Our content reaches relevant audiences e.g., via search . These are not essential and only set with Your consent.
• Non‑essential cookies (such as analytics and marketing cookies) will only be set with Your clear, opt‑in consent, in accordance with PECR Regulation 6. You can change Your cookie preferences at any time.

The Data Use and Access Act 2025 introduces simplified consent rules for certain low risk non essential cookies. We apply these rules where appropriate and maintain clear records of cookie consent decisions. You will always have accessible options to manage or withdraw your cookie preferences.

For more details on the Cookies We use and how You can manage Your preferences, please refer to Our Cookie Notice.

4.3 Third‑Party Analytics

Our Website may use analytics services provided by trusted third parties (e.g., hosting platforms or embedded analytics tools). These services help Us evaluate:

• Website performance
• User experience
• Accessibility
• Content engagement

Third-party analytics providers process this data on Our behalf in accordance with data protection law.

 

5. Why we collect your personal information

We collect and process Personal Data to help Us deliver support, information and services to people affected by MDS, whether or not they choose to become members. We use Your information for the following purposes:

5.1 To Provide Support, Information and Services

We use Your Personal Data to:

• Respond to Your enquiries and provide personalised support or guidance
• Offer information about MDS, treatments, care pathways and available resources
• Deliver our support services, including helpline assistance, email support and one‑to‑one guidance
• Tailor the information We provide based on Your needs or relationship to MDS

This applies to both members and non‑members who contact Us.

5.2 To Administer Events, Meetings and Programmes

We collect data to:

• Manage Your registration for patient support meetings, information days or online sessions
• Provide event details, reminders and follow‑up materials
• Understand attendance patterns and accessibility needs

This helps Us improve the relevance and availability of Our support.

5.3 To Send Updates and Communications (According to Your Preferences)

With Your consent or legitimate interest (depending on the communication), We may contact You with:

• Newsletters, information updates and educational resources about MDS
• Details of upcoming patient meetings, webinars or support services
• Research updates, advocacy opportunities and charity news

You can update Your communication preferences or opt out at any time.

5.4 To Support Fundraising and Charity Sustainability

We may use Personal Data to:

• Process donations and Gift Aid claims
• Acknowledge and thank donors
• Send fundraising information when You have opted in
• Maintain accurate financial and regulatory records

We never sell or rent Your Personal Data to other organisations.

5.5 To Improve Our Services and Understand Community Needs

We analyse information to help Us:

• Understand what information and support people affected by MDS need most
• Identify trends in service use
• Improve accessibility across Our Website, resources and communications
• Develop new services and refine existing ones
• Evaluate the impact and effectiveness of our programmes

This enables Us to fulfil our charitable objectives and ensure Our support remains relevant.

5.6 For Internal Administration and Compliance

• We process Personal Data to:
• Maintain accurate internal records
• Respond to feedback, complaints or safety concerns
• Meet Our legal obligations as a UK registered charity
• Prevent misuse, fraud or security risks

This includes data required for governance, audit, reporting or regulatory purposes.

 

6. Lawful basis for processing your data

Under the UK General Data Protection Regulation (UK GDPR), We must have a valid lawful basis to collect and use Your Personal Data. The lawful basis We rely on depends on the purpose of the processing and the type of data involved.

Under the Data Use and Access Act 2025 we may contact you by email or SMS about information, support services, events or resources that directly effect our charitable purposes without explicit consent where:

• You provided your contact details while engaging with our services, events, support or resources;
• The communication relates soley to our charitable purposes
• You were offered a clear opportunity to opt out at the point of data collection in earlier communication.

This lawful basis applies only to personal data collected on or after 5 February 2026. We do not use the charitable soft opt in for fundraising communications unless they directly relate to our charitable purpose. You may opt out of the communications at any time.

We may rely on one or more of the following lawful bases:

6.1 Consent

We rely on Your explicit consent when:

• You sign up to receive email newsletters, updates or fundraising communications
• You join optional Support and Speaker Led meetings
• You choose to share sensitive health information (Special Category Data) through membership forms, support requests or surveys
• You provide feedback or participate in optional surveys

You can withdraw Your consent at any time by contacting membership@mdspatientsupport.org.uk or by clicking “unsubscribe” in Our email communications.

6.2 Contract

We rely on this basis when processing is necessary to deliver a service You have requested, such as:

• Contacting MDS UK for personalised support
• Registering You for an event, support meeting or online session
• Providing materials or resources You have asked Us to send
• Administering Your free membership

This applies whether You are a member or an individual who registers for specific services.

6.3 Legal Obligation

We rely on legal obligation when We must process data to comply with the law, including:

• Financial record‑keeping
• Processing Gift Aid declarations
• Meeting Our duties as a registered UK charity

Certain information must be retained to meet regulatory, audit and financial requirements.

6.4 Legitimate Interests

We rely on legitimate interests when processing Your Personal Data is necessary for Our charitable purposes and does not override Your rights. This includes:

• Providing support and responding to enquiries from members and non‑members
• Understanding the needs of people affected by MDS and improving Our services
• Managing internal administration and communication records
• Evaluating event attendance and engagement to improve Our support offer
• Sending essential updates about Our services (not marketing)
• Ensuring Website functionality, security and analytics

When relying on legitimate interests, We always assess that the processing is proportionate, expected, and does not negatively impact Your privacy.

6.5 Special Category Data (Health, Ethnicity, etc.)

When We process Special Category Data, such as:

• Information about Your MDS diagnosis or treatment
• Health information relating to the person You support
• Ethnicity
• Other sensitive information You choose to share

We rely on explicit consent or the “substantial public interest” condition under UK GDPR and the Data Protection Act 2018, specifically relating to:

• Charitable purposes,
• Safeguarding,
• Support for individuals with a particular health condition, and
• The provision of confidential support services.

We only collect this information when You proactively choose to share it with Us.

 

7. Sharing your personal information

We do not sell or rent Your Personal Data to any third parties. We only share Your information when it is necessary to deliver Our services, fulfil a request You have made, meet Our legal obligations, or operate Our charity effectively. Any third parties We work with must meet strict data protection standards and process Personal Data only under Our instruction.

Sharing may include the following:

7.1 Trusted Service Providers

We may share Your Personal Data with carefully selected third‑party service providers who support the delivery of Our charitable activities. These include:

• Email distribution providers (e.g., Mailchimp)
• Used to send newsletters, updates, and essential communications.
• Event platforms and support tools (e.g., Zoom)
• Used for managing registrations, sending joining instructions, and administering patient support meetings or information days.
• Website hosting and analytics providers
• Who support the functioning of Our Website and help Us understand how it is used.
• Fundraising and donation platforms (e.g., GoDonate, Just Giving)
• To process donations securely and administer Gift Aid where applicable.
• Third‑party providers can only use Your information to perform the specific service We have engaged them for. They are not permitted to use it for their own purposes.

Information Commissioner Office powers under Data Use and Access Act. Under this Act the ICO has expanded powers to request information; conduct interviews

And issue notices electronically. We may be required to share personal data with the ICO where legally mandated. Any such sharing will be limited to what is strictly necessary to comply with the Act.

7.2 Gift Aid and Financial Processing

If You make a donation and choose to include Gift Aid, We are legally required to share relevant details with HM Revenue & Customs (HMRC) to process the claim.

This is limited to the data required by law for audit and compliance purposes.

7.3 Professional Advisers and Legal Obligations

We may disclose Personal Data when necessary to:

• Comply with a legal obligation
• Respond to a regulatory request
• Protect the charity’s rights, operations or beneficiaries
• Seek advice from Our professional advisers (e.g., legal advisers, accountants, auditors)

Any such sharing is carried out only when lawful and strictly required.

7.4 Safeguarding or Serious Risk Concerns

If We believe someone is at risk of serious harm, We may need to share relevant information with safeguarding bodies, health professionals, or emergency services.

This is done only where necessary and in accordance with UK GDPR and safeguarding principles.

7.5 Aggregated or Anonymised Data

We may use or share aggregated, anonymised data for:

• Reporting
• Research insights
• Funding applications
• Service evaluation

This information cannot be used to identify You.

 

8. Data storage and security

Your Personal Data is stored securely using a combination of:

• Password‑protected and access‑controlled systems
• Secure cloud‑based platforms used for email, newsletters, event administration, and donation processing
• Encrypted storage environments, where applicable
• Secure physical storage for any paper‑based information

We limit access to Your data to staff, volunteers, or contractors who require it to perform their role and who are subject to confidentiality obligations.

8.2 Data Retention

We keep Your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including:

• Providing You with support or responding to enquiries
• Administering Your membership and communications preferences
• Maintaining charity governance, audit, and financial records
• Meeting legal, regulatory, and safeguarding requirements

Retention periods are defined in accordance with Our Data Retention Notice, which reflects legal requirements, charity best practice, and proportionality.

8.3 Protecting Special Category Data

Where We process Special Category Data, including health or ethnicity information, We apply additional safeguards such as:

• Strict access controls
• Limited storage locations
• Encryption and enhanced security measures
• Explicit consent or substantial public interest conditions (as per Section 6)

This helps ensure that any sensitive information You choose to share with Us remains confidential.

8.4 Security Measures

To protect Your Personal Data from unauthorised access, alteration, loss, or disclosure, We implement:

• Secure servers and encrypted connections (HTTPS)
• Regular system updates and security monitoring
• Firewalls and anti‑malware protection
• User authentication controls within Our systems
• Staff and contractor training on data protection responsibilities
• Clear internal procedures for handling and safeguarding Personal Data

Despite these measures, no method of transmission over the internet or electronic storage is completely secure. We continually review and improve Our systems to keep Your information safe.

8.5 If a Data Breach Occurs

In the unlikely event of a data breach that presents a risk to Your rights or freedoms, We will:

• Take immediate steps to minimise any potential harm
• Notify You without undue delay
• Report the breach to the Information Commissioner’s Office (ICO), where required

 

9. Data Retention

We keep Your Personal Data only for as long as necessary to fulfil the purposes for which it was collected, including providing support, responding to enquiries, administering membership or donations, and meeting legal, regulatory, or safeguarding obligations.

Retention periods vary depending on the type of information and Our legal requirements. When Personal Data is no longer needed, We delete it securely or anonymise it so You can no longer be identified.

Data Use and Access Act requires organisations to document the justification for retention periods and ensure they are proportionate to the purpose for which the data was collected. Our retention schedule reflects these requirements.

 

10. Your Data Protection Rights

Under UK data protection law, You have a number of rights regarding Your Personal Data. These rights apply whether You are a member of MDS UK or an individual who contacts Us for support, information or advice.

We are committed to ensuring You can exercise these rights easily and transparently.

10.1 Your Rights under UK GDPR:

• Right of Access - You have the right to request copies of the Personal Data We hold about You.
• Right to Rectification - You have the right to ask Us to correct any information You believe is inaccurate or incomplete.
• Right to Erasure - You have the right to ask Us to delete Your Personal Data in certain circumstances, such as when it is no longer needed for the purpose it was collected.
• Right to Restrict Processing - You can ask Us to limit how We use Your Personal Data in certain situations (for example, while a concern is being investigated).
• Right to Object to Processing - You can object to the processing of Your Personal Data when We are relying on legitimate interests. You may also object to receiving marketing communications at any time.
• Right to Data Portability - You may request that We transfer the Personal Data You provided to another organisation, or directly to You, where technically feasible.
• Right to Withdraw Consent - When We rely on consent to process Your Personal Data, You may withdraw this consent at any time. This includes withdrawing consent for newsletters or for sharing sensitive health information.

10.2 How to Exercise Your Rights

You may make a Data Subject Access Request (DSAR) verbally or in writing, including by phone or in person. You do not need to mention the phrase “Data Subject Access Request” for Your request to be valid. We will treat all valid requests in line with Our DSAR Notice.

You are not required to pay a fee to exercise any of Your rights. If You make a request, We have one month to respond.

For DSARs, please contact Our Data Protection Lead directly at: lharris@mdspatientsupport.org.uk.

All DSARs received by any staff member will be forwarded to the Data Protection Lead in accordance with Our DSAR Notice.

You can otherwise contact Us at:

Name: MDS UK Patient Support Group
Address: Springboard Business Centre, 24 Ellerbeck Way, Stokesley Business Park, Stokesley, TS9 5JZ
Phone Number: 020 7733 7558
E-mail: info@mdspatientsupport.org.uk

If You are raising a complex request, We may extend the response time by an additional two months, and We will inform You if this is necessary.

10.3 When We May Not Be Able to Comply

There may be circumstances where We cannot fully comply with Your request, for example:

• When We are required to retain certain information for legal or audit reasons
• When deletion of data would compromise safeguarding obligations
• When We need the data to establish or defend legal claims

 

11. How to complain

If You have any concerns about how We collect, use or store Your Personal Data, We encourage You to contact Us so We can address the issue promptly and transparently.

11.1 Contact Us First

You can raise a concern or make a complaint using the following details:

Name: MDS UK Patient Support Group
Address: Springboard Business Centre, 24 Ellerbeck Way, Stokesley Business Park, Stokesley, TS9 5JZ
Phone Number: 020 7733 7558
E-mail: info@mdspatientsupport.org.uk

Under Data Use and Access Act we acknowledge data related complaints within 30 days and maintain a record of complaint volumes and outcomes. This helps ensure transparency and compliance with Data Use and Access Act requirements.

11.2 If You Are Not Satisfied

If You are unhappy with how We have handled Your Personal Data or responded to Your complaint, You have the right to contact the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection.

You can contact the ICO at:

Information Commissioner’s Office

4th Floor

No 3, Circle Square

5 Hawkshaw St;

MANCHESTER

M1 7BL

Helpline: 0303 123 1113

Website: www.ico.org.uk

You do not need to contact Us first before contacting the ICO, but We encourage You to do so where possible so We can help resolve the issue.

---

 

Version Control – Approval and Review

 

• Version No - 1.0
• Approved By - Board
• Date: March 2026
• Main Changes: Initial draft approval
• Review Period: Annually

 

• Approved By - Board
• Date: July 2026
• Main Changes: Inclusion of references to the Data Use and Access Act
• Review Period: Annually

 

• Approved By - Chair / Vice Chair
• Date: Nov 2026
• Main Changes: Reviewed
• Review Period: Annually