Rare Disease Watch respects the privacy of people who visit our website, join our community, contribute to our activities or work with us professionally.
We recognise that information relating to rare diseases can be particularly sensitive. Even where a condition is not explicitly identified, a combination of personal details may make an individual identifiable.
This policy explains what personal information we collect, why we use it, when it may be shared, how we protect it and the rights available to individuals.
It applies to the Rare Disease Watch website, membership services, directory, communications, community activities and other services operated by or on behalf of Rare Disease Watch.
Website: https://rarediseasewatch.com/
Rare Disease Watch is a rare disease information and community platform operated by a UK-registered limited company.
For data protection purposes, the operating company is responsible for determining how and why personal information is processed, except where another organisation acts as an independent data controller or the parties have agreed different responsibilities.
The operating company's verified legal name, registered details and any applicable data protection registration information should be provided here.
For privacy enquiries, requests concerning personal information or questions about this policy, contact:
The information collected depends on how an individual uses Rare Disease Watch.
It may include the following categories.
Website Information
Technical information such as IP address, browser type, device information, website activity and information collected through cookies or similar technologies.
Contact Information
Names, email addresses and other details provided when contacting Rare Disease Watch, subscribing to communications or making an enquiry.
Membership Information
Information provided during registration, including membership category, account details, profile information, interests and relevant organisational affiliations.
Community and Profile Information
Information members choose to provide about their experiences, areas of interest, professional background or rare disease-related activities.
Organisational Information
Details supplied by charities, patient organisations, researchers, healthcare organisations, sponsors and commercial partners.
Directory Information
Information submitted for organisational directory listings, including public contact details, organisational descriptions and relevant registration information.
Financial and Transaction Information
Information required to administer paid sponsor and partner memberships, sponsorship arrangements and other transactions.
Contribution and Participation Information
Information provided through articles, interviews, consultations, events, volunteer activities or other forms of participation.
Communications
Correspondence and information relating to enquiries, complaints, membership administration and professional relationships.
We aim to collect only information that is reasonably necessary for the relevant purpose.
Some members may choose to provide information about their health, diagnosis, disability or experience of living with a rare disease.
Under UK data protection law, information concerning an identifiable person's health is generally classified as special category personal data and requires additional protection.
Rare Disease Watch does not require every member to disclose a diagnosis or detailed medical history.
Where sensitive information is requested, the purpose should be explained and an appropriate legal basis and additional condition for processing established.
Where explicit consent is relied upon, individuals should be given a clear choice and an appropriate means of withdrawing that consent.
Members should avoid including unnecessary medical details in profile fields intended for wider visibility.
Rare Disease Watch does not use membership as a means of creating unrestricted patient databases for commercial organisations.
We may process personal information for the following purposes:
Personal information should not be used for unrelated purposes without an appropriate legal basis and any additional information or consent required by law.
Rare Disease Watch processes personal information only where an appropriate legal basis applies.
Depending on the activity, this may include:
Consent
Where an individual has freely agreed to a particular use of their information, such as optional profile discovery or certain communications.
Contractual Necessity
Where processing is necessary to provide membership services or fulfil an agreement with an individual.
Legitimate Interests
Where processing is necessary for legitimate organisational purposes, such as maintaining security, responding to relevant enquiries or administering appropriate services, provided those interests are not overridden by individuals' rights and freedoms.
Legal Obligations
Where information must be processed to comply with applicable legal requirements.
Other legal bases may apply in particular circumstances.
Processing special category personal data requires both an appropriate legal basis under Article 6 of the UK GDPR and a separate condition under Article 9.
The specific legal basis and, where relevant, special category condition must be determined for each processing activity.
Rare Disease Watch operates a membership system for eligible adults aged 18 and over.
Community membership is free for:
Paid membership arrangements apply only to sponsors and partners.
Free community membership does not require members to participate in research, advisory activities, commercial projects or introductions.
Information provided during registration is used to administer accounts and provide the relevant membership services.
Members may be asked to provide information about their interests, experiences, professional activities or organisational affiliations.
Some information is necessary for account administration. Other information may be optional.
Members should be informed which profile information may be visible to others and which remains restricted.
Website administrators and other appropriately authorised personnel may access account information where necessary for legitimate administrative purposes.
Related document:
Membership & Introduction Policy
Rare Disease Watch provides an optional profile discovery service through which eligible members can make selected profile information discoverable to authorised users.
Profile discovery is genuinely opt-in. It is not automatically enabled when someone joins Rare Disease Watch.
Members must make an affirmative choice to participate.
Registration alone does not constitute consent to discovery.
Members who choose to participate should be informed about:
Members may choose not to participate in discovery while remaining part of the Rare Disease Watch community.
Where a member withdraws from discovery, their profile should cease to be available through that optional service, subject to the operation of the platform and any applicable lawful retention requirements.
Withdrawal does not necessarily remove information previously and lawfully disclosed to another organisation.
Rare Disease Watch may facilitate introductions between members, researchers, patient organisations and approved sponsors or partners.
Introductions operate through a controlled process intended to preserve member choice.
A requesting party may submit an introduction request through the platform.
The member receiving the request should be informed of the requesting party's identity and the purpose of the proposed contact.
The member may accept or decline.
Personal contact details must not be disclosed through the introduction process without appropriate authority and a lawful basis.
Accepting one introduction does not constitute permission for unrelated future contact.
Declining an introduction does not affect ordinary community membership.
Rare Disease Watch does not sell unrestricted access to member contact information.
Researchers and approved sponsors or partners may participate in designated Rare Disease Watch services.
Participation does not provide unrestricted access to patient information.
Where an organisation wishes to invite members to participate in research, advisory activities or other projects, the purpose and nature of the activity should be explained.
The organisation responsible for the activity must establish its own appropriate legal basis for processing any personal information it collects.
Where personal data is shared between organisations, their respective responsibilities must be identified.
Research-related information must not be treated as consent to research participation merely because an individual is a Rare Disease Watch member.
Commercial participation does not provide automatic permission to contact members, collect health information or use personal data for marketing.
Related documents:
Rare Disease Watch maintains a directory of organisations relevant to rare diseases.
Organisations may be required to register before submitting a listing.
Information supplied for directory administration is not automatically made public.
Approved listings may contain organisational names, descriptions, websites, public contact details and other relevant information.
Where a listing contains identifiable personal information, publication must have an appropriate legal basis.
Organisations submitting information should ensure that they have the necessary authority to provide it.
Related document:
Directory Listing & Verification Policy
Where comments are enabled, we collect the information entered into the comment form.
We may also collect the visitor's IP address and browser user agent information to support security and spam detection.
An anonymised string derived from an email address, sometimes called a hash, may be provided to the Gravatar service where that feature is enabled.
The Gravatar privacy information is available at:
If a comment is approved, the associated profile image may be displayed publicly where the relevant feature is enabled.
Comments may be reviewed or moderated before publication.
Visitors should avoid including sensitive personal or medical information in public comments.
Members, contributors or authorised users may be permitted to upload images or other media.
Uploaded files should not contain unnecessary personal information.
Images may include embedded metadata, such as geographical location information.
Where files are publicly accessible, other users may be able to download them and examine embedded metadata.
Individuals uploading media should remove unnecessary location or identifying information and ensure that they have appropriate permission to publish the material.
Images identifying patients or other individuals require particular care.
Rare Disease Watch uses cookies and similar technologies to support website functionality, member authentication, account administration and other permitted services.
Strictly necessary cookies support essential website functions, including login, security and session management.
Other technologies, including non-essential analytics, functional cookies or third-party tracking, may require consent.
Where consent is legally required, non-essential technologies must not be activated before consent has been obtained.
Visitors should be able to manage their preferences through the website's applicable cookie controls.
The cookies used may depend on the configuration of WordPress, membership services, WooCommerce and other active website functions.
For information about cookie categories, their purposes, retention and how to manage your choices, please see our dedicated:
Articles and pages may include embedded content from third-party websites, such as videos, images or other media.
Embedded content may behave as though the visitor has accessed the external website directly.
The third-party provider may collect information, use cookies or monitor interactions with the embedded content.
Where visitors are logged into an account with that provider, additional tracking may occur.
Rare Disease Watch does not control the privacy practices of independent third-party websites.
Users should consult the relevant provider's privacy information.
Where non-essential third-party technologies require consent, appropriate consent arrangements should apply.
Rare Disease Watch may send service-related communications necessary to administer accounts, memberships or agreed activities.
We may also send newsletters, event information or other communications where permitted by applicable law.
Marketing communications should be distinguishable from essential service messages.
Where consent is required, individuals should be able to choose whether to receive such communications.
Marketing emails should provide an appropriate method of unsubscribing.
Unsubscribing from marketing does not necessarily prevent essential communications relating to an active membership or contractual arrangement.
Rare Disease Watch provides free community membership for eligible patients, carers, researchers, charities and patient organisations.
Paid membership arrangements apply only to sponsors and partners.
Payments for these arrangements may be processed through WooCommerce and authorised payment service providers.
We may process information necessary to:
Payment card information should be handled through appropriate payment systems rather than unnecessarily stored within the Rare Disease Watch membership database.
Payment service providers may act as independent data controllers or processors, depending on their services and contractual arrangements.
Their own privacy information may also apply.
Rare Disease Watch does not provide unrestricted member contact lists to commercial partners.
Personal information may be shared where necessary and lawful with:
The extent of sharing depends on the relevant activity.
Where third parties process personal information on behalf of Rare Disease Watch, appropriate contractual and security arrangements must be established where required.
Some third parties may act as independent data controllers rather than processors.
Where applicable, their separate responsibilities and privacy information should be identified.
Where a member requests a password reset, WordPress or the relevant account service may process information necessary to verify and complete the request.
Depending on the configuration, password reset communications may include technical information such as an IP address.
Rare Disease Watch may process login records and other security information to help prevent unauthorised access, fraud and misuse.
Members are responsible for maintaining the confidentiality of their login credentials.
Suspected account security incidents should be reported promptly.
Rare Disease Watch operates an internationally accessible website and may work with members, researchers and organisations in different countries.
Some service providers or recipients may process personal information outside the United Kingdom.
Where personal information is transferred internationally, Rare Disease Watch must comply with applicable data protection requirements.
Depending on the destination and circumstances, this may involve adequacy regulations, approved contractual safeguards or another lawful transfer mechanism.
The applicable arrangements should be identified for the relevant processing activities.
International accessibility of the website does not, by itself, authorise unrestricted transfer of personal or health information.
Rare Disease Watch retains personal information only for as long as reasonably necessary for the purposes for which it was collected, including applicable legal, regulatory, accounting and security requirements.
Retention periods may differ according to the information and the relevant activity.
Account information may be retained while membership remains active and for an appropriate period afterwards where necessary for legitimate administration or legal obligations.
Where comments are enabled, published comments and associated metadata may be retained to support moderation and discussion continuity.
They should not automatically be treated as requiring indefinite retention.
Financial and transaction records may be retained for the periods required by applicable accounting and tax law.
Correspondence may be retained for an appropriate period according to its purpose, sensitivity and any applicable obligations.
Records relating to complaints, incidents or safeguarding concerns may require separate retention arrangements reflecting their sensitivity and legal significance.
Retention responsibilities should be established according to the role of Rare Disease Watch and any external organisation responsible for the activity.
Specific retention periods and deletion procedures should be documented in the organisation's internal data retention arrangements.
Rare Disease Watch aims to protect personal information through appropriate organisational and technical measures.
These may include:
The measures required should reflect the nature and sensitivity of the information being processed.
No internet-based system can guarantee absolute security.
Rare Disease Watch should assess and respond to identified risks and incidents in accordance with applicable legal obligations.
Employees, volunteers, contributors and other authorised individuals may process personal information where necessary for their agreed responsibilities.
Access should be limited to information needed for the relevant activity.
Individuals must not use membership or patient information for unauthorised purposes.
Personal data must not be copied into unapproved systems, shared through unauthorised channels or used for independent outreach.
Confidentiality obligations continue after an individual's involvement with Rare Disease Watch ends, where applicable.
Individuals may have the following rights under UK data protection law, subject to applicable conditions and exemptions.
Right to Be Informed
To receive information about how their personal data is processed.
Right of Access
To request access to personal information held about them.
Right to Rectification
To request correction of inaccurate or incomplete information.
Right to Erasure
To request deletion of personal information in circumstances where the law provides that right.
Right to Restrict Processing
To request that certain processing be limited.
Right to Data Portability
To receive certain personal information in a structured, commonly used and machine-readable format, where the legal requirements apply.
Right to Object
To object to certain processing, including processing based on legitimate interests.
Rights Relating to Automated Decision-Making
To receive relevant protections where qualifying solely automated decisions are made.
Right to Withdraw Consent
Where processing relies on consent, individuals may withdraw it at any time.
Withdrawal does not affect the lawfulness of processing undertaken before consent was withdrawn.
These rights are not absolute and may depend on the circumstances and applicable legislation.
Individuals wishing to exercise their data protection rights may contact:
Rare Disease Watch may need to verify the identity of the person making a request before disclosing or changing personal information.
Requests should be handled within the time limits required by applicable law.
Under the UK GDPR, the standard period for responding to a qualifying rights request is one month, subject to the applicable rules on extensions and other circumstances.
Individuals will not normally be charged for exercising their rights, although the law permits fees or refusal in certain circumstances.
Individuals who are concerned about how Rare Disease Watch handles their personal information are encouraged to contact us.
Email: support@rarediseasewatch.com
Individuals also have the right to complain to the relevant data protection supervisory authority.
In the United Kingdom, this is the Information Commissioner's Office.
Website: https://ico.org.uk/
Individuals outside the United Kingdom may have additional rights or complaint routes under applicable local law.
Rare Disease Watch membership is restricted to individuals aged 18 and over.
Children cannot register for membership in their own right.
Parents, carers and other adults may use Rare Disease Watch to obtain information relevant to children affected by rare diseases.
Where information about an identifiable child is provided, it must be handled with appropriate care and in accordance with applicable data protection requirements.
Members should not publish unnecessary personal or medical information about children in public profiles, comments or other publicly accessible content.
Rare Disease Watch may take appropriate steps to restrict or remove accounts that do not meet its minimum age requirement.
Where activities involve information about children, additional safeguards may be required.
Rare Disease Watch may use automated website functions to administer memberships, apply access permissions or support profile discovery.
Such functions do not automatically constitute solely automated decision-making with legal or similarly significant effects.
Where qualifying automated decision-making is undertaken, the organisation must provide the information and safeguards required by applicable law.
Rare Disease Watch should not introduce automated processing of sensitive patient information without assessing the relevant privacy and data protection implications.
Rare Disease Watch may link to external organisations, research institutions, healthcare services and other websites.
These organisations operate independently and may have their own privacy practices.
A link or directory listing does not mean that Rare Disease Watch controls how the external organisation collects or processes personal information.
Users should review the relevant privacy information before submitting sensitive details to external services.
This policy may be updated to reflect changes in Rare Disease Watch's activities, website functionality, legal requirements or data protection arrangements.
Where changes materially affect how personal information is processed, appropriate additional information or notice should be provided.
The current version should be available through the Rare Disease Watch website.
Governance and Accountability
Privacy and Information
Membership and Participation
Partnerships and Organisations
Conduct and Accountability
