Privacy Notice for Manchester Movement Unit

This privacy notice explains who we are, how and why we collect and use personal information about you, what personal data is collected and held about you at the Manchester Movement Unit, our purposes and lawful bases for processing, who we share your personal data with, relevant retention periods, and how you can exercise your privacy rights.

This notice provides information that is in addition to information contained in the University’s Privacy Notice for the Counselling, Health and Wellbeing Service. Please do read this notice to understand our practices and if you have any questions please contact us using the contact details provided below.

Who we are

Throughout this notice, “Unit”, “we”, “our” and “us” refer to the Manchester Movement Unit, Manchester Metropolitan University, an exempt charity under Schedule 2 to the Charities Act 1993 (amended by the Charities Act 2011). The University is the Data Controller in respect of the personal data you provide as part of using the services offered by Manchester Movement Unit.

The University is registered as a Controller with the Information Commissioner’s Office (ICO). We manage personal data in accordance with the General Data Protection Regulation (GDPR) and the University’s Data Protection Policy.

The personal data we process

We collect and process certain data about you, including information of a sensitive nature. This includes :

Any information you provide when you made first contact with us (whether in person, by telephone, email or any other form of communication).
Any information you provide when you complete the Service Registration Form (including your name, date of birth, address, phone number, your GP, next of kin, medical history and ArthritisUK Healthcare Questionnaire if appropriate).
A record of each contact we have had with you for a scheduled appointment, phone messages or emails for clinicians, including short notes about each contact.
Payment details, including credit/debit card details, insurance policy and claim numbers
To ensure that our Service is accessible to all of our student population, our Service Registration Form may also give you the option to provide information to support equality and diversity monitoring (such as your age, ethnicity, gender identity, religion, sex, sexual orientation and whether you have a disability). It is up to you whether you provide this information.

It is your responsibility to keep us up-to-date with changes to your personal data. Please ensure you notify us of any changes of address and contact details, or medical conditions that are relevant to the service that we provide.

The purposes of the processing

Your information will enable us to:

Use of personal data	Lawful basis
Confirm that you are eligible for treatment Register you as a client of the Manchester Movement Unit Carry out an ‘open door’, initial assessment or other scheduled appointment with you by any of the Movement Unit Clinical Team Make a record of each contact we have with you (whether in person, telephone, email or other means). Carry out any administration relating to your contact with the Manchester Movement Unit. Write any letters or emails to third parties on your behalf and with your prior agreement. Make any telephone calls to third parties on your behalf and with your prior agreement. Deal with your enquiries and to make contact with you when you request an appointment or other service with the Manchester Movement Unit.	Performance of a contract: we need to collect and process certain information from you in order to effectively deliver our services to you in accordance with the contract we have with you.
Handle any complaints you may have so we can improve our business	Legitimate interests: we process personal data for these purposes in ways which you would reasonably expect and which we believe have minimal privacy impact. We need to collect and retain certain information from you in order to ensure your safety and wellbeing, and to comply with any legal obligations.
Write to GPs to request referrals to orthopaedics. We need to divulge personal identifiers and some treatment/diagnosis history to support these requests. Invite you to provide feedback on our service and participate in surveys, including the ArthritisUK Healthcare Questionnaire.	Consent: we offer you a real choice and control whether you wish to participate in these activities. We ask for your consent when you complete the Service registration form.
Determine whether any adjustments need to be made for you if you have declared a disability. Take account of, and provide additional support for, any disabilities, health issues or conditions.	Legal obligation: under the Equality Act 2010 we are obliged to consider reasonable adjustments and offer support on the grounds on health and disability. Any information you provide is done so voluntarily, so it is up to you how much information you would like to give to us. We rely on explicit consent to process this ‘special category’ information.
Undertake equality and diversity monitoring of users of our services to seek to ensure they are accessible to all our service users.	Data Protection Act 2018 Schedule 1, Part 2 – s8 – necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment. The lawful basis for this is that processing is necessary for compliance with a legal obligation (the Equality Act 2010), and for reasons of substantial public interest.
Protect the vital interests, or your or another party, in an emergency situation.	Article 6(1)d and Article9(2)c – Processing is necessary to protect the vital interests of the data subject or another natural person. In the event of significant concerns for the immediate wellbeing of an individual is at risk, we may contact others who may be in a position to support them, typically their GP or other medical professionals. Manchester Movement Unit would always seek to discuss this course of action with the data subject but if our concerns are for their immediate safety, we may do so without your consent.

If you contact us, we may also keep a record of that correspondence.

The recipients or categories of recipients of the personal data

We may disclose personal data about you to the following third parties:

Your GP Practice
Other healthcare professionals in case of medical emergency
Other medical professionals that may be part of your ongoing care – this will only ever be done with your consent.
Medical professions who may be needed to protect your vital interests

The right to withdraw consent

If we have collected and process your personal information with your consent, then you can withdraw your consent at any time. Withdrawing your consent will not affect the lawfulness of any processing we conducted prior to your withdrawal, nor will it affect processing of your personal information conducted in reliance on lawful processing grounds other than consent. You can withdraw your consent by emailing movement@mmu.ac.uk stating your name, date of birth and in the e-mail subject state: Withdrawal of Consent.

Data retention

Your personal data will only be retained for as long as it is necessary in accordance with the University’s Retention and Disposal Schedule. Specifically, we will retain your Manchester Movement Unit data for 8 years after our last contact with you, after which it will be deleted unless we are required to continue to retain this information due to ongoing legal proceedings.

Your rights in respect of the processing

The GDPR provides data subjects with the following data subject rights:

The right to be informed – this privacy notice assists with fulfilling these obligations.
The right of access.
The right to rectification.
The right to erasure.
The right to restrict processing
The right to data portability
The right to object

Please note, that these rights apply in certain circumstances, for example according to the lawful basis utilised by the University. The right of access to personal information held about you exists in order to be aware of, and verify, the lawfulness of the processing. Please use the contact information below to exercise these rights.

Contacting us

For questions or concerns about this privacy notice, or our use of your personal information, please email movement@mmu.ac.uk in the first instance.

Our Data Protection Officer can also be contacted by emailing dataprotection@mmu.ac.uk, or by calling 0161 247 3884. You can also write to: Data Protection Officer, Legal Services, All Saints Building, Manchester Metropolitan University, Manchester, M15 6BH.

Right to lodge a complaint with the supervisory authority

You have the right to lodge a complaint with the Information Commissioner’s Office (ICO) as the supervisory authority in respect of the processing of your personal data. We would encourage you to expend our internal complaints procedure through our initial contact and the University Data Protection Officer, prior to contacting the ICO. Please email casework@ico.org.uk or call 0303 123 1113. Visit the ICO website for further contact information.

Updates to this privacy notice

We may update this privacy notice from time to time in response to changing legal, technical or business developments. When we update our privacy notice, we will take appropriate measures to inform you, consistent with the significance of the changes we make.