Privacy policy
Information for data subjects according to Article 13 (Information to be provided where personal data are collected from the data subject) of the UK General Data Protection Regulation (UK GDPR).
There are two uses of data on this website:
- Those who browse the website: We have taken effort to ensure that we do not collect any personal data other than that which cannot be avoided for the purpose of showing you the website (i.e., IP address). We do not retain this data beyond 30 days.
- Those who submit reports on the website, for whom we collect the information provided in the report, as well as some metadata, and retain it for a longer duration. The rest of this privacy policy concerns this scenario and provides further details.
Personal data provided by you that we process
- IP address;
- User Agent String (This is a string of text that your web browser sends to the server every time it makes a request. It normally contains the the name and version number of the browser.)
- Information provided by you in your answers to the GP practice report form including but not limited to your report of your overall experience with a GP practice. Please note that we do not ask you, nor do we encourage you, to provide special categories of personal data as part of your report, i.e. data about your health, sexuality, gender identity, ethnicity, however if you do decide to provide such personal data, we will only process it with your consent.
Purpose(s) of processing
- Track the quality and accessibility of transgender healthcare across Cambridgeshire;
- Collate and publish on our dedicated website feedback on individuals' experience with accessing transgender healthcare from NHS and/or private GP practices in Cambridgeshire.
How we will use the data
Your IP address and browser user agent string will be used to monitor the service and prevent spam. The information provided by you in your answers to the GP practice report form will be used to create a list and map of GP practices and their feedback, including summary information.
Legal basis
- For processing your IP address, User Agent String and general information provided as part of your report: Legitimate interest (art 6.1.e UK GDPR) of the Project as a community-led grassroot organisation, e.g. providing a database of shared knowledge on various experiences with GP practices in Cambridgeshire;
- For processing special categories of personal data (data about your health, sexuality, gender identity, ethnicity) if you decide to provide them as part of your report: your consent (art 6.1.a and 9.2.a UK GDPR) to include this information.
Who has access to the data
Only Moderators of The Cambridgeshire Trans-friendly GP Project will have access to IP addresses and User Agent Strings, and any un-redacted versions of reports as originally submitted. Anyone who visits the website will see any reports that have been approved, which may be partially redacted.
How your data is secured
Your data is stored securely on a private server that is not used for other purposes.
Data retention
Your data will be stored by the GP Project for as long as it is relevant on the website, or until you request for your report to be deleted.
Your rights
Under data protection law, you have a range of rights over your personal information, which you may exercise by using your unique code on the Manage Consent page, which allows you to access your report and delete your report. You can also contact us for any other requests. Your rights are the following, subject to relevant and applicable limitations under data protection law:- Right to be informed about the collection and use of your data
- Right to access your data
- Right to request rectification or erasure of your data
- Right to object to the processing of your data
- Right not to be subject to automated decision-making and profiling (i.e. without any human intervention)