Data Privacy Notice
In compliance with GDPR (General Data Protection Regulation)
Why we have the information provided when taking a test.
Data is collected via the online website and consent forms that we in GFCT and our partner groups use when individuals have a test. The vast majority of the time, this is at one of the organised events facilitated by us or another charity organisation or company. Before a blood sample can be taken, individuals are required to create an online account and complete the mandatory sections of the consent form. Certain consents requested within the consent form are optional and are clearly identified as such. These optional consents do not affect an individual’s ability to receive a test.
This data is then used for creating the blood form and gives permission for the laboratory to carry out the testing procedure. The information is held on a secure database and is used to reconcile the information provided by participants with the results received from the designated laboratory, which processes the blood sample and produces a PSA or other health result. Once the participant's information has been matched with the laboratory results, we communicate the test result to the participant either through their online account or by letter. Certain prostate medications identified as being used by the individual when inputting their information online can impact the PSA result and therefore potentially go over a threshold, rendering a different result being received, this is explained in the results communication.
GFCT also works with appropriately qualified clinical consultants who assist with the clinical review and interpretation of certain test results. Where appropriate, and in accordance with the participant’s consent and/or another lawful basis under applicable data protection legislation, relevant personal information may be shared with those clinical consultants to enable them to review results, provide clinical guidance, contact participants where appropriate, provide consultations and facilitate onward referral into appropriate NHS or other healthcare pathways. All such consultants are subject to contractual confidentiality and data protection obligations.
What we do with that information
The information is stored securely using appropriate technical and organisational measures designed to protect personal information against unauthorised access, loss, misuse or disclosure. Access to personal information is restricted to those individuals who require it in order to carry out their duties.
Statistics are updated by summarising the event data, not using any of the personal data (e.g. total numbers of red, amber and green letters for the event).
All records relating to participants receiving Green, Amber or Red results are retained to enable GFCT to provide follow-up communications, monitor outcomes and continue to provide support in accordance with this Privacy Notice.
Why we keep the information
The personal information held on the GFCT database enables us to administer and deliver our testing service, communicate test results, maintain participants’ testing history, identify trends in previous test results, provide follow-up support where appropriate and respond to future enquiries from participants.
We process your personal information on a number of lawful bases under the UK GDPR, depending on the nature of the processing activity. These include processing that is necessary to provide and administer our testing service, processing carried out in pursuit of our legitimate interests in delivering and improving our charitable services and, where applicable, processing based on your consent. Where we process special category personal data relating to your health, we do so only where an appropriate condition under applicable data protection legislation applies.
We retain your personal information for as long as is reasonably necessary to fulfil the purposes described in this Privacy Notice. Given the nature of the GFCT’s services, this may mean retaining your testing history over a prolonged period so that, should you have further tests with us, we can provide you with access to your previous results, identify trends over time and continue to offer services such as notifications of when to have your next test, and appropriate follow-up support. We periodically review our retention practices to ensure that personal information is not retained for longer than is necessary for these purposes.
Where you successfully exercise your right to request erasure of your personal information, we will delete your personal data unless we are required or permitted by law to retain some or all of it. Where information has been anonymised so that you can no longer be identified, we may retain and use that anonymised information for research or statistical purposes.
If we are notified that a participant has died, we will cease sending communications to that participant. Information relating to previous testing may be retained for research or statistical purposes and, wherever reasonably practicable, will be anonymised so that the individual is no longer identifiable.
Your personal information is encrypted and stored securely using appropriate technical and organisational security measures.
How we use your information
In addition to communicating your test results, we may use your information in the following ways:-
- Follow up notifications – If you have previously undergone testing with us, we will compare your latest results with your historical test results to identify trends over time. Where appropriate, we will notify you if those trends indicate that your results are increasing and recommend that you arrange a further test.
- Red results and clinical follow-up – Where you receive an Amber or Red result, we will provide you with a summary of your previous test history to assist you in discussions with your GP or other healthcare professional. Where appropriate, and in accordance with your consent and/or another lawful basis under applicable data protection legislation, one of GFCT’s clinical consultants may review your results, contact you to discuss them, provide clinical guidance or assist you in accessing appropriate NHS or other healthcare services.
- Access to your testing history – You may access your previous test results through your online account at any time. Alternatively, we can provide your testing history once we have verified your identity.
- Follow-up communications – Where you receive an Amber or Red result, we may contact you to enquire whether you have consulted your GP or otherwise acted upon the advice provided. Responding to these communications is entirely voluntary. Where appropriate, one of GFCT’s clinical consultants may also contact you to provide further clinical guidance or support. Any information you choose to provide may be used in anonymised form to help us understand outcomes and improve our services. Should you have difficulty contacting your GP, we provide a free consultation with a GP who may be able to assist you with your medical pathway.
- Statistical analysis – We use anonymised or de-identified information to produce statistics about our testing programme, including the number of Green, Amber and Red results and trends. Individuals cannot be identified from this information.
- Research and validation – Where information is used for research or validation purposes, only anonymised or de-identified information will be shared unless you have been informed otherwise and an appropriate lawful basis exists. This may include, for example, analysing trends within particular age or ethnic groups.
- Future testing events and GFCT updates – Where you have chosen to receive communications from us, we may use your contact details to inform you of future testing events in your area, developments in GFCT's work or other information which we believe may be of interest to you. You may withdraw your consent and unsubscribe from these communications at any time.
Who we share your information with
We only share your personal information where it is necessary for the purposes described in this Privacy Notice, where required or permitted by law, or where another lawful basis under applicable data protection legislation applies.
Depending on the circumstances, your personal information may be shared with:-
- Our appointed laboratories, for the purpose of analysing blood samples and providing test results.
- Appropriately qualified clinical consultants engaged by GFCT, who will review test results, provide clinical guidance where necessary, contact participants where appropriate, undertake consultations and facilitate onward referral into NHS or other appropriate healthcare services.
- Healthcare providers, including your GP or NHS healthcare professionals, where this is appropriate to facilitate your ongoing care and is carried out in accordance with your consent and/or another lawful basis under applicable data protection legislation.
- Service providers acting on our behalf, including providers of secure database hosting, IT systems and administrative support services, where they require access to personal information in order to support GFCT’s operations. Such providers are required to process personal information only in accordance with our instructions and appropriate contractual safeguards.
- Researchers or validation partners, but only where the information has been anonymised or de-identified so that you cannot be identified, unless you have been informed otherwise and an appropriate lawful basis exists.
We do not sell your personal information to third parties and do not share your personal information with third parties for their own marketing or fundraising purposes.
Your data will not be transferred out of the UK and EU.