Privacy Notice

Purpose

This notice explains how the charity collects and uses personal information about applicants, children, families, donors, supporters and people who contact us.

Who is responsible

Here & Now Children's Rare Disease Support is the controller of personal information described in this notice. Contact info@hereandnowcharity.com or 13 Almondbank Drive, Livingston, EH54 5JU for questions, rights requests or complaints about how we use information.

Information we may collect

• Names and contact details of parents, guardians, donors, supporters and professional contacts.

• A child's name, age, location and information confirming a diagnosed rare disease.

• Professional evidence of the diagnosis, such as a clinic letter, diagnostic letter or confirmation from an appropriate medical professional.

• Details of the requested support, supplier quotations, invoices, receipts, decisions and payments.

• Donation and Gift Aid information, communication preferences and transaction references. We do not normally receive full payment-card details from payment providers.

• Correspondence, complaints, safeguarding concerns and records needed to protect people and the charity.

• Technical website information, subject to the Cookie Policy.

• Photographs and family stories only under a separate consent process.

Why we use information and our lawful bases

Purpose — Typical lawful basis — Notes

Assess and deliver charitable support — Article 6(1)(f) legitimate interests — Assess and deliver charitable support with a documented balancing assessment and safeguards for children.

Use health information — Article 6(1)(f) legitimate interests and Article 9(2)(a) explicit consent for routine diagnosis verification — Launch approach. Obtain valid explicit consent from the child where appropriate or a person authorised to act for them before collection. Document authority, consent and withdrawal handling. Do not start collection until approved and implemented.

Process donations and financial records — Contract; legal obligation; legitimate interests — Includes accounting, fraud prevention and Gift Aid where relevant.

Safeguarding and legal claims — Legal obligation; vital interests; legitimate interests; substantial public interest where applicable — Information may be used or shared where necessary to protect a child or another person.

Send optional updates and fundraising messages — Consent or another lawful route permitted for charitable communications — Every electronic marketing message will provide an easy opt-out.

Publish photographs or stories — Consent — Support is never conditional on publicity consent.

Sharing information

We share personal information only where necessary and with appropriate safeguards. Recipients may include suppliers paid for approved support, professional referees contacted with authority, payment and donation providers, website and IT providers, accountants, insurers, professional advisers, regulators, law-enforcement bodies and safeguarding authorities. We do not sell personal information.

Retention

• Unsuccessful applications: retain the minimum application and decision record normally for 12 months after the final decision. Apply the separate diagnosis-document deletion rule below.

• Successful applications: retain the minimum decision and accounting record normally for six years after the relevant financial year end. Keep diagnosis documents separately; deletion is within 90 days after the final decision or review unless an identified safeguarding concern, dispute or legal duty justifies longer retention. Record the reason and review date. The deletion schedule must be implemented before diagnosis evidence is collected.

• Safeguarding records: retained according to the nature of the concern and professional safeguarding guidance; they are not routinely deleted with ordinary application records.

• Marketing information: until consent is withdrawn or the information is no longer needed, with a minimal suppression record retained where necessary to honour an opt-out.

• Photographs and stories: for the period described in the separate consent, subject to withdrawal for future use.

Security and international services

We restrict access, use suitable accounts and permissions, and expect service providers to protect information. Some providers may process information outside the UK. Where this happens, we will use a lawful transfer mechanism and proportionate safeguards.

Your rights

Depending on the circumstances, you may have rights to access, correct, erase, restrict or object to our use of information, receive certain information in a portable form, and withdraw consent. Withdrawing consent does not affect earlier lawful use. Contact us to exercise a right. We may need to verify identity.

Complaints

Send a privacy complaint to the email above. We will acknowledge a complaint about our processing of personal information within 30 days and respond without undue delay. You may also complain to the Information Commissioner's Office at ico.org.uk. We encourage you to contact us first so we can try to resolve the concern.

Children

A parent or legal guardian normally makes an application for a child. We explain information use in clear language and take account of the child's age and understanding. We do not ask a child to agree to publicity as part of receiving support.