ECLO Privacy Policy

We promise to respect any of your personal information which is under our control and to keep it safe. We aim to be clear when we collect your information and about what we will do with it.

We are a service provided by Royal National Institute of Blind People and we have relationships with the NHS, Social Care and Voluntary Support Services, so we use personal information on a day to day basis to offer you the best services. Our use of personal information allows us to make better decisions and deliver client specific support. Thus, creating a world where there are no barriers to people with sight loss. So, societies, communities and individuals, view people with sight loss differently.

This policy is effective from 7th January 2019.

Royal National Institute of Blind People

Grimaldi Building,

154a Pentonville Road,

London,

N1 9JE

Helpline Number: 0303 123 9999

The Data Protection Officer
RNIB

Grimaldi Building,

154a Pentonville Road,

London,

N1 9JE

Email: [email protected]

In this Privacy Policy, “Royal National Institute of Blind People”, “we”, or “our” means Royal National Institute of Blind People - a registered charity in England and Wales (no. 226227), Scotland (no. SC039316) and the Isle of Man (no. 1226). Also operating in Northern Ireland. A company incorporated by Royal Charter. Registered in England and Wales (no. RC000500). Registered office Grimaldi Building, 154a Pentonville Road, London, N1 9JE

We collect information in the following ways:

Information you provide to us directly

• You may give us your information when you:
• Sign up for one of our events/training
• Receive advice on welfare benefits
• Receive advice about remaining in employment or re-training
• Receive advice on children’s services and where to get help with difficult schools
• Receive assistance in completing your Certificate of Vision Impairment
• Receive support on your mental health and emotional wellbeing
• Use our eye health information services or otherwise communicate with us.

Information you provide us indirectly

Your information may be shared with us by 3rd parties:

• The Department of Works and Pensions
• The National Health services
• Social Services
• Local voluntary society for sight loss.

In the following scenarios:

• You have been diagnosed as being blind or partially sighted by your consultant and have been referred to us to support you
• You have been deemed in need of support by your carer/social services/DWP and as a result been referred to us.

• Name
• Contact details (including postal address, telephone number, e-mail address)
• Date of birth
• Gender
• Ethnicity
• Education
• Employment
• Eye condition
• Last eye test
• Details about eye condition
• Other diagnosed health condition
• Your living arrangements
• GP Name & address
• Eye hospital address & consultant
• If you are a care giver
• Any other personal information you provide us.

Certain types of personal information are in a special category under data protection laws, as they are more sensitive. Examples of this type of sensitive data would be information about health, ethnicity, religious beliefs, political views, trade union membership, sex life or sexuality or genetic/biometric information.

We only collect this type of information when there is a clear reason for us to do so. For example, asking for health information, is to assist you with the service we provide you, to ensure we meet your specific needs.

Wherever it is practical for us to do so, we will make clear why we are collecting this type of information and what it will be used for.

Providing you with support

The information we collect from you will be used to deliver a personalised service. This might mean providing you with information that is specific to your sight loss condition, referring you to other services for which you are eligible, or signposting you to organisations which may be able to support you.

Details about your sight loss, other diagnosed health conditions, your living arrangements, your age range and if you are a care giver, helps us to assess your needs and identify situations where support is urgently required.

When we refer you to another RNIB service or services provided by an external organisation, we will discuss this with you before releasing your information.

In line with good practice for health and support services, we will keep a detailed history of the support we provide to you, including all correspondence, interactions and decisions that are relevant.

Managing our services

In-order for us to be able to ensure high standards of care, we conduct routine reviews of case files. This means that your record may be reviewed by internal staff or auditors from the NHS, to check that the support you received and the way it was recorded meet our quality requirements. The information reviewed will be kept strictly confidential.

Measuring our impact and performance

Some of the information we ask you to provide may not have a direct effect on the support that you receive but will allow us to measure whether our services are reaching different sections of our communities equally.

For example, your ethnicity, education, or employment situation may not have a direct bearing on the advice that is given to you, but it allows us to make sure that support is available to everyone who needs it and that we can put the right resources into place to provide this.

You can choose not to supply this information if you prefer and this will not affect the quality of service provided to you.

When we use information for measuring the impact of our services, assessing the equality and diversity of our clients, or monitoring how our services are performing, we will always remove the parts that identify you (such as names, addresses, date of birth) and only work with the information as statistics.

Lawful Basis for Processing

Data protection laws mean that each use we make of personal information must have a “lawful basis”. The relevant lawful basis is set out in the General Data Protection Regulation (EU Regulation 2016/679) and in current UK data protection legislation.

Consent

Consent is where we ask you if we can use your information in a certain way, and you give us permission (for example when you agree to participating in our survey). Where we use your information for a purpose based on consent, you have the right to withdraw consent for any future use of your information for this purpose at any time.

Contractual Obligation

In certain circumstances you may enter an expressed or implied contract with Royal National Institute of Blind People, where we process data on that basis. For example, when you contact us to assist you with any of the services/support we offer to meet your specific needs).

Legal obligation

We may need to collect and process your personal data when the law or our statutory obligation requires. These reasons include retention and providing information for crime, taxation and reporting. We are also bound by the requirements of the National Health Service, General Optical Council, and other professional bodies to process records to a suitable standard of quality and care, to provide certain information to authorities, and to retain records for a minimum period.

Legitimate interests

We have a basis to use your personal information if it is reasonably necessary for us (or others) to do so and in our/their “legitimate interests” (provided that, what the information is used for, is fair and does not unduly impact your rights).

We consider our legitimate interests to include all day-to-day activities the ECLOs carry out with personal information. Some examples not mentioned under the other bases above where we are relying on legitimate interests are:

• Managing our services
• Measuring our impact and performance

We only rely on legitimate interests where we consider that any potential impact on you (positive and negative); how intrusive it is from a privacy perspective and your rights under data protection laws do not override our (or others’) interests in us using your information in this way.

We ensure that there are appropriate technical and organisational controls in place to protect your personal details. For example, our network is protected and routinely monitored.

Royal National Institute of Blind People has specific criteria to determine how long we will retain your information. For information pertinent to health and social care we retain adult information for 8 years after the last interaction and till the 25th or 26th birthday for children (dependent on when they turn 18).

We will not share your data with any third parties for direct marketing. However, we may disclose your information to third parties in-order for them to further assist you and our business.

These parties may include:

• IT service providers
• Health and social welfare organisations
• Partner Organisations

For 3rd parties that assist our business such as IT Service providers, we have contracts in place, which means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

Where we are under a legal or regulatory duty to do so, we may disclose your details to the police, regulatory bodies, or legal advisers and/or where we consider it necessary to protect the rights, property or safety of Royal National Institute of Blind People, its personnel, visitors, and users.

Under the data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

• Right to be informed - This means you have a right to be informed about the way we collect and use your data
• Right to be forgotten- This means you have the right to have some, or all your data deleted, this applies in certain cases, and is subject to certain exceptions.
• Right to access - also sometimes called a Subject Access Request - this means you have a right to request a copy of the data we hold about you
• Right to rectification - This means that you can request that we correct your personal data if it is inaccurate
• Right to restrict processing - This means that you can request that processing of your data is limited and your data is stored separately
• Right to data portability - This means that under certain circumstances you can request that the data we hold on you be sent to you
• Right to object – This means you have the right to object to processes being carried out under legitimate interest

If you wish to exercise your rights, please contact RNIB by email: [email protected] or by phone on 0303 123 9999.

If you are unhappy with any aspect of how we are using your personal information we’d like to hear about it. We appreciate the opportunity this feedback gives us to learn and improve. Please contact our Helpline by calling 0303 123 9999 or email [email protected].

You also have the right to lodge a complaint about any use of your information with the Information Commissioners Office, the UK data protection regulator.

We may change this Privacy Policy from time to time. If we make any significant changes in the way, we treat your personal information we will make this clear by contacting you directly.