Data Privacy Notice
1. WHAT IS IN THIS NOTICE?
This Privacy Notice sets out:
what information we might collect about you
how we might use that information
what information we might share with others, this means directly or indirectly identifiable information
your rights about the personal information we process
This policy is in accordance with The Data Protection, Privacy and Electronic Communications Regulation 2019 (UK GDPR), The Data Protection Act 2018 (DPA 2018) and The General Data Protection Regulation 2018 (EU GDPR).
If you have any questions regarding Best Beginnings' ("we") Privacy Notice or The Baby App ("The App") or you would like to exercise any of your rights, please get in touch via the following information:
Email us: firstname.lastname@example.org
Our Data Protection Officer can be contacted at: email@example.com
Telephone us: 020 7443 7895
Write to us: Data Protection Officer, 36 Great Russell Street, Bloomsbury, London, WC1B 3QB
If you are unhappy with the way Best Beginnings processes your data, you can make a complaint to the Information Commissioner's Office (ICO) which regulates the use of information in the UK. They can be contacted by:
Telephone: 0303 123 1113
OR by going online to: ico.org.uk/make-a-complaint
If the organisation is based outside of the UK, the complaint should be directed to the relevant Data Protection Supervisory Authority in that Country.
2. WHO ARE WE?
Best Beginnings is a charity dedicated to ending child health inequalities in the UK. The Baby Buddy App (the “App”) is operated by Best Beginnings (“Best Beginnings” or “we”). We are registered in England and Wales under company number 5866886 and charity number 1120054 and have our registered office at 36 Great Russell Street, London, England, WC1B 3QB. We are the "controller" of certain personal data for the purposes of UK data protection legislation.
This Privacy Notice (together with our App Terms) will inform you as to how we may collect and use the information you provide through the App and tell you about your privacy rights.
Please read the following carefully to understand how we will treat your personal data.
3. THIRD-PARTY LINKS
The App may, from time to time, contain links to and from websites of third parties.
This Privacy Notice does not apply to the practices of any third parties that we do not own or control, such as third-party websites that you choose to access through the App, for example, Facebook. While we attempt to provide access only to third-party services that share our respect for privacy, we cannot take responsibility for such third parties. We advise you check their privacy policies before providing your information to them.
4. NHS LOGIN
Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS Digital. NHS Digital is the controller for any personal information you provided to NHS Digital to get an NHS login account and verify your identity and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS Digital (as the “controller”) when verifying your identity. To see NHS Digital’s Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.
5. INFORMATION WE MAY COLLECT FROM YOU
‘Personal data’, or ‘personal information’, means any information relating to an identifiable individual. It does not include data where the identity of to whom it belongs is not known (anonymous data).
We may collect, use, store and transfer different kinds of personal data which we have grouped together as follows:
Child Profile Data includes information about babies, such as their name, gender and due date and images. Where you upload such information, you confirm that you are consenting on the baby’s behalf to such sharing, as their parent or legal guardian.
Contact Data includes email address.
Development Data includes measurements on the growth of the child, recording of vaccinations and developmental milestones.
Identity Data includes first name, maiden name, last name, username or similar identifier, marital status, date of birth and gender.
Image data in the form of photographs that you upload to the App.
Location Data includes information about your location, which may include general location information (e.g. your postcode) and more specific information based on the specific location of your device (e.g. GPS-based functionality).
Marketing and Communications Data includes your preferences in receiving marketing from us and our selected third parties and your communication preferences.
NHS Data includes data obtained from NHS login permissions, and child health data obtained through the NHS National Events Management Service.
Profile Data includes your username and password, feedback and survey responses, information about the pregnancy, such as the type of user you are (e.g. mum, dad, midwife, grandparent, other contact), the due date, whether there will be a multiple birth (e.g. twins), your relationship status (e.g. with partner, single), whether this is a first baby, whether the baby is being breastfed, your goals (e.g. to stop smoking, stop drinking alcohol, eat healthier, exercise more).
Search Data comprises information requested in in-App searches.
Sensitive Data includes physical or mental health or condition, for example about the pregnancy.
Survey Data includes information which you provide to us by completing surveys or polls.
Technical Data includes internet protocol (IP) address, your login data and operating system.
Transactional Data includes details of transactions you have carried out through the App and the completion of your orders and, where you accessed chargeable services, your billing information and credit card or other financial information;
Usage Data includes information about how you use our App. This is statistical data so that we can look at how you use the App and how we can make it better, and which allows us to carry out statistical research to analyse information to identify trends or patterns to help us improve services for mothers and babies.
No Cookies, please!
The provision of personal data to us is not a statutory or contractual requirement, or a requirement necessary to enter into a contract with us. You are not obliged to provide personal data to us, however, if you use the App, certain personal data as described above will be collected and without it may hinder our ability to provide services to you.
6. WHAT WE MIGHT DO WITH THAT INFORMATION
We process personal information for the following purposes:
To enable Best Beginnings to broadly meet its Data Protection obligations in relation to how personal information is managed;
To demonstrate that we are accountable for such processing in accordance with Article 5(2) of the GDPR;
To support our charitable aims and objectives and our legitimate interests;
To safeguard members, members families and any other individuals should we judge they may be at risk;
To set appropriate systems and control according to our technical and organisational standards;
To ensure data protection is built into the design of new projects which include the processing of data, so that data privacy is evidenced by default;
To safeguard personnel and stakeholder interests.
7. WHERE WE STORE YOUR INFORMATION
All personal information is stored within the United Kingdom.
8. FOR HOW LONG DO WE KEEP YOUR INFORMATION?
We may keep information for different time periods depending upon the purposes for which it was collected. This may be determined by legal and operational considerations. For example, we are legally required to hold certain types of information to fulfil our statutory and regulatory obligations which may include but are not limited to Health and Safety Regulations, tax and for accounting purposes.
We review our retention periods on a regular basis and update our Record of Processing Activities (RoPAs) accordingly.
If you would like to know more about how long we hold your personal information for please email firstname.lastname@example.org.
9. DISCLOSURE OF YOUR INFORMATION
We will need to share your personal information with others from time to time, including:
healthcare professionals to commission data reporting to health care systems. Data is shared for research purposes and is always anonymised;
our professional advisers, such as our accounting and legal advisers where they require information in order to provide advice to us;
if another entity acquires us or our assets, your information may be disclosed to that entity as part of the due diligence process and, if the acquisition goes ahead, your information will be transferred to that entity;
our service providers who operate the App, or provide and support our management and data storage systems; and;
where you have consented to having your information shared or synced with another person’s account.
We will also disclose your personal information if we are required to do so by law, a regulator a law enforcement agency, or in order to enforce or apply our App Terms and other agreements.
10. PERSONAL INFORMATION RELATING TO CHILDREN AND MINORS
App users who are aged under 16 are required to obtain consent from a parent or legal guardian. By agreeing to these conditions, you are acknowledging that you have obtained required consent if you are aged 16 years or younger.
11. YOUR RIGHTS
Data Protection law give you certain rights in respect of your personal information. You have the following rights:
Right to be informed
Right of access
Right to rectification
You are entitled to have your information corrected if it is inaccurate or incomplete.
Right to erasure
This is also known as ‘the right to be forgotten’ and, in simple terms, enables you to request the deletion or removal of your information where there is no compelling reason for us to keep using it. This is not a general right to erasure; there are exceptions.
Right to restrict processing
You have rights to ‘block’ or suppress further use of your information. When processing is restricted, we can still store your information, but may not use it further. We keep lists of people who have asked for further use of their information to be ‘blocked’ to make sure the restriction is respected in future.
Right to data portability
You have the right to obtain and reuse your personal data in a structured, commonly used and machine-readable format in certain circumstances. In addition, where certain conditions apply, you have the right to have such information transferred directly to a third party.
Right to withdraw consent
If you have given your consent to anything we do with your personal data, you have the right to withdraw your consent at any time (although if you do so, it does not mean that anything we have done with your personal data with your consent up to that point is unlawful).
Right not to be subject to automated individual decision-making
Subject to some limited exceptions, you have the right not to be subjected to a decision based solely on automated processing, including profiling, which significantly affects you or produces legal effects.
We confirm that the information you provide to us is not used for any automated decision-making.
Right to object to processing: In addition to the above rights, you also have the right to object to certain types of processing, in certain circumstances. In particular, the right to object to the processing of your personal data based on our legitimate interests grounds (including processing for direct marketing).
If you do not want to receive tailored marketing communications from Best Beginnings, please deselect this option in the relevant page of the App. You can also opt-out of receiving further marketing communications from us at any time by following the directions contained in email or text marketing to unsubscribe, or by contacting us at email@example.com.
12. VULNERABLE CIRCUMSTANCES
We are committed to protecting vulnerable individuals who use our services and any other individuals we hold particularly sensitive data of and appreciate care is needed when we use their personal information. In recognition of this, we observe exceptionally good practise guidelines in our interactions with vulnerable people.