Privacy Notice
July 2024
This Privacy Notice contains important information about the types of personal information we collect and process; what we do with it; who we may share it with and why; and your rights when it comes to the personal information that you provide us with.
We may need to make changes to our Privacy Notice in line with regulatory requirements; so please check our website for updates from time to time. If there are significant changes, we will contact you to let you know.
1. Who we are
We are the Global Alliance for Patient Access (GAfPA).
GAfPA is a U.S. based non-profit corporation with registered address of 2020 K Street, NW, Suite 505, Washington, D.C. 20006.
Phone: (202) 951-1139
Email: info@gafpa.org
Contact person: Brian Kennedy
GAfPA manages a project called the Global Patient Alliance for Kidney Health (GloPAKH) and the Make the Change campaign.
2. The data that we process and our legal bases:
On our ‘contact us’ form, we ask for your:
| Type of data we process | Why we need it | Our legal basis for processing |
|---|---|---|
| First and last name and your email address | We ask for these so that we may send you the newsletter and updates that you have requested | Consent – you provide us with the personal data that we need in order to send you information. |
| Position and name of organisation if you are a patient, advocate, health care provider, policy maker, etc. | We would like to know if you are a patient or a health care provider or involved in any advocacy or policy work. | Legitimate interest – we are interested in knowing who you are and if you are a patient or an advocate or a health care provider. This helps us to understand who is engaging with our website and the Make the Change campaign. We may also be in touch with some people to see if they would like to work more closely with us. |
| Country | We ask for your country in order to put you in touch with the organisation in your country. | Legitimate interest – we have partner organisations in different countries and we would like to share your data with that organisation so they may also contact you. Please let us know if you would prefer that we don’t share your data like this. |
Special category data
The UK and the EU GDPR defines special category data as:
- personal data revealing racial or ethnic origin;
- personal data revealing political opinions;
- personal data revealing religious or philosophical beliefs;
- personal data revealing trade union membership;
- genetic data;
- biometric data (where used for identification purposes);
- data concerning health;
- data concerning a person’s sex life; and
- data concerning a person’s sexual orientation.
We don’t process any special category data.
3. Statutory or contractual requirements or an obligation to provide your data
You do not have any obligations at all to provide us with your data. Any data that you provide to us is with your consent and that consent can be revoked at any time.
Please note that if you provide inaccurate personal data, we won’t be able to send you the information that you have requested.
4. Automated decision making
We don’t do any automated decision making.
5. Who we share your data with
| Entity | Legal basis for sharing |
|---|---|
| Our member organisations in different countries. | Legitimate interest – we would like to put you in touch with our partner organisation in your country. Please let us know if you don’t want your data shared this way. Please click here for a list of our partners. |
| Third parties to whom we outsource certain services such as IT systems or software providers, IT support service providers, PR and marketing companies who manage our newsletters and the Make the Change campaign. | Legitimate interest – we have a legitimate interest in using third party providers to help us. |
Whenever we share your personal information, we will do so in line with our obligations to keep your information safe and secure.
We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub-contractor to ensure that they process personal data appropriately and according to our legal and regulatory obligations.
Astra Zeneca is a partner in the Make the Change campaign but we do not share any personal data with them.
6. Where your information is processed
We are a US based organisation and your data is held in the USA. The USA is a ‘non-adequate’ country as determined by the EU Commission and the UK government.
7. How we protect your information
We take information and system security very seriously and we strive to comply with our obligations at all times. Any personal data which is collected, recorded, or processed in any way, whether on paper, online or any other media, will have appropriate safeguards applied in line with our data protection responsibilities.
Your data is protected by controls designed to minimise loss or damage through accident, negligence, or deliberate actions. Our employees are trained to protect sensitive or confidential information when storing or transmitting data in any medium including electronically and must undertake annual refresher exercises on this.
8. How long we keep your information for
| Organisation or campaign | Retention period |
|---|---|
| GloPAKH newsletter | We will keep your data for as long as you are happy to receive our newsletters and updates. We review our subscribers list every three months and inactive users are archived. You can unsubscribe at any time. |
| Make the Change campaign | We will keep your data for the duration of the campaign, likely five years but maybe longer, depending upon the length of the campaign. You can unsubscribe at any time. |
| Unsubscribes | If you unsubscribe to either the GLoPAKH newsletter or Make the Change campaign updates, we will hold your data in a suppression list for five years so that we don’t contact you again by mistake. |
9. How to access your information and your other rights
You have the following rights in relation to the personal data we hold about you:
- Your right of access
If you ask us, we’ll confirm whether we’re processing your personal data and, if necessary, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee. - Your right to rectification
If the personal data we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified. If you are entitled to rectification and if we’ve shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly. - Your right to erasure
You can ask us to delete or remove your personal data in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable). If you are entitled to erasure and if we’ve shared your personal data with others, we’ll let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly. - Your right to restrict processing
You can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you object to us. If you are entitled to restriction and if we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly. - Your right to data portability
You have the right, in certain circumstances, to obtain personal data you’ve provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice. - Your right to object
You can ask us to stop processing your personal data, and we will do so, if we are:- relying on our own or someone else’s legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or
- processing your personal data for direct marketing purposes.
- Your right to withdraw consent
If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time. - Your right to lodge a complaint with a Supervisory Authority in your country
If you have a concern about any aspect of our privacy practices, including the way we’ve handled your personal data, you can report it to the Supervisory Authority in your country. We would, however, appreciate the chance to deal with your concerns before you approach the Supervisory Authority so please contact us in the first instance.