At Long Covid Doctors for Action (“we”, “us”, “our”) we want you to feel comfortable on our website and not have to worry about the security of your data. That is why data protection is an important part of our philosophy.
The Data Controller
Responsible for the collection and processing of your personal data is
Long Covid Doctors for Action
The Supervisory Authority
The competent data protection authority in the UK is:
The Information Commissioner`s Office (ICO)
Wycliffe House, Water Ln,
Wilmslow SK9 5AF, UK
What is personal data?
According to the UK`s Data Protection Act (DPA) and the EU`s General Data Protection Regulation (GDPR), personal data are "any information relating to an identified or identifiable natural person.
This is, for example, name or address data, telephone number, mobile number, bank details or insurance number.
General information on data processing
All personal data that we obtain from you via the website will be processed for the purposes described in more detail below. This is done within the framework of the DPA and GDPR or with your consent. And of course, only when data processing is permitted and if:
you have given your consent,
the data is necessary for the fulfilment of a contract / pre-contractual measures,
the data is necessary for the fulfilment of a legal obligation or
the data is necessary to protect the legitimate interests of our company, provided that your interests are not overridden.
We process and store your personal data only for the period of time required to achieve the respective processing purpose or for as long as a legal retention period (in particular commercial and tax law) exists. Once the purpose has been achieved or the retention period has expired, the corresponding data is routinely deleted.
What data does Long Covid Doctors for Action process?
Long Covid Doctors for Action offers you a wide range of services and in the process, various data are always collected. Most of the data we process is provided by you when you use our services or contact us.
Further, we also automatically collect technical device and access data that occur during your interaction with our website. And we collect further data through website analyses in order, for example, to optimise our offers for you personally (e.g., to optimise our offers for you).
a) Log files, Cookies and Analytical data
Even if you do not log in or register on our website, but simply browse our website, data is collected and stored and processed by us. Specifically, this requires the IP address of your computer, Date and time of access, Name and URL of the accessed file, Browser used, number of bytes transferred, Status of the page retrieval, Session ID, Referrer URL.
The legal bases for processing are contract and our legitimate interest. The collection and processing of this data is necessary from a technical point of view so that you can use our website.
b) Contacting us
You can easily contact us via our e-mail (as listed above). In this case, we store and process the following data from you: Name, e-mail address, telephone number as well as other personal data that you provide when contacting us.
This data is collected and processed exclusively for the purpose of contacting you and processing your request and then deleted, provided there is no legal obligation to retain it. The legal bases for processing are contract and our legitimate interest.
c) Processing of Personal Data when using our services
Personal Data will be collected, processed, or used in connection with the services offered. This is always done in compliance with the provisions of the DPA and GDPR. Insofar as we use your Personal Data for a purpose that requires your consent according to the legal provisions, we will always ask for your express consent.
Some of the data you choose to provide may be considered non-personal data and/or “sensitive” data, for example health and COVID related data. By choosing to provide this data, you consent to our processing of that data. We ask you not to provide us with any such information from the outset.
As a rule, we do not require any special categories of personal data within the meaning of Art. 9 GDPR. If such information is relevant to the application process, we process it together with your other data.
Where any Personal Data relates to a third party, you represent and warrant that the Personal Data is up-to-date, complete, and accurate and that you have obtained the third party’s prior consent for our collection, use and disclosure of their Personal Data for the Purposes. You agree that you shall promptly provide us with written evidence of such consent upon demand by us.
d) Administration, office organisation, contact management
We process data in the context of administrative tasks as well as organisation of our operations, accounting, and compliance with legal obligations, such as archiving. In this regard, we process the same data that we process in the course of providing our contractual services (see sections b, and c above).
The processing bases are contract and our legitimate interest and in individual cases your consent. The purpose and our interest in the processing lies in the administration, financial accounting, office organisation, archiving of data, i.e., tasks that serve the maintenance of our business activities, performance of our tasks and provision of our services. The deletion of data with regard to contractual services and contractual communication corresponds to the data mentioned in these processing activities mentioned above. In this context, we disclose or transfer data to other members in our global offices if so required, the tax authorities, consultants, such as tax advisors or auditors, as well as other fee offices and payment service providers.
If you register for our newsletter, we will regularly send you information about our services. The only data required or sending the newsletter is your e-mail address. We use the so-called double opt-in procedure for sending the newsletter. This means that we will only send you an e-mail newsletter once you have expressly confirmed that you consent to receiving newsletters. By activating the confirmation link, you give us your consent. Our Newsletter is sent using the services of Wix.com Inc.
You can unsubscribe from the newsletter at any time via the link provided for this purpose in the newsletter or by sending a corresponding message to the responsible person named at the beginning. After unsubscribing, your e-mail address will be deleted from our newsletter distribution list immediately. The legal basis for the data processing is your consent and our legitimate interest.
Integration of third-party services and content
We use content or service offers of third-party providers on the basis of our legitimate interests in order to integrate their content and services (hereinafter uniformly referred to as "content").
This always requires that the third-party providers of this content are aware of the IP address of the user, as without the IP address they would not be able to send the content to their browser. The IP address is therefore necessary for the display of this content.
Third-party providers may also use so-called pixel tags (invisible graphics, also known as "web beacons") for statistical or marketing purposes. The "pixel tags" can be used to evaluate information such as visitor traffic on the pages of our website. The pseudonymous information may also be stored in cookies on the user's device and may contain, among other things, technical information about the browser and operating system, referring websites, time of visit and other information about the use of our website, as well as being linked to such information from other sources.
The following provides an overview of third-party providers and their content, together with links to their privacy policies, which contain further information on the processing of data and so-called opt-out measures, if any:
Web Hosting Provider, Content Delivery Network, Content Management System: Wix.com Inc
Fonts: Google Font API by Google LLC
The legal basis for the data processing is your consent and our legitimate interest.
Transfer of Personal data
We will not disclose or otherwise distribute your Personal data to third parties unless this is necessary for the performance of our services, you have consented to the disclosure, or the disclosure of data is permitted by relevant legal provisions.
However, we are entitled to outsource the processing of your Personal data in whole or in part to external service providers acting as processors for us within the framework of the DPA and the GDPR. External service providers support us, for example, in the technical operation and support of the website, data management, the provision and performance of services as indicated above, as well as the implementation and fulfilment of reporting obligations.
The service providers commissioned by us process your data exclusively in accordance with our instructions. We remain responsible for the protection of your data, which is ensured by strict contractual regulations, technical and organisational measures, and additional controls by us.
Personal data may also be disclosed to third parties if we are legally obliged to do so e.g., by court order or if this is necessary to support criminal or legal investigations or other legal investigations or proceedings at home or abroad or to fulfil our legitimate interests.
How is my data protected?
We want you to feel and be safe on our website. Therefore, we take various measures to meet both the legal requirements and our own very high standards of data protection and data security.
Long Covid Doctors for Action takes the protection of your personal data seriously. All data is handled and processed in accordance with the DPA and GDPR, which ensures the highest standards of data protection.
Our data processing is subject to the principle that we only process the personal data that is necessary for the sensible and economic use of our offer. In doing so, we take great care to ensure that your privacy and the confidentiality of all personal data are always guaranteed.
All transmitted data is protected by TLS encryption. Transport Layer Security (TLS) is a protocol used to ensure secure data transmission on the Internet. The public-private key procedure is used here. This means that data encrypted with a publicly accessible key can only be decrypted again with a separate private key.
Long Covid Doctors for Action uses technical and organisational security measures (TOMs) throughout the company to protect the data we manage from you against accidental or intentional manipulation, loss, destruction or against access by unauthorised persons. For example, we regularly train all employees on current IT security topics.
Duration of data storage
We store personal data on our secure server and only for as long as it is necessary for the purposes for which it is processed or for as long as any consent you have given us has been revoked by you. Insofar as statutory retention obligations must be observed, the storage period for certain data may be up to 6 years, irrespective of the processing purposes.
Insofar as you have also given us your separate consent to process your data for marketing and advertising purposes, we are entitled to contact you for these purposes via the communication channels you have given your consent to.
You may give us your consent in a number of ways including by selecting a box on a form where we seek your permission to send you marketing information, or sometimes your consent is implied from your interactions or contractual relationship with us. Where your consent is implied, it is on the basis that you would have a reasonable expectation of receiving a marketing communication based on your interactions or contractual relationship with us.
Direct Marketing generally takes the form of e-mail but may also include other less traditional or emerging channels. These forms of contact will be managed by us, or by our contracted service providers. Every directly addressed marketing sent or made by us or on our behalf will include a means by which you may unsubscribe or opt out.
Your data subject rights
These rights are standardised in the DPA and GDPR. These include:
the right to information,
the right to rectification,
the right to erasure,
the right to restriction of data processing,
the right to data portability,
the right to object to data processing,
the right to revoke any consent you have given, and
the right to lodge a complaint with the competent supervisory authority.
Please contact us at any time with questions and suggestions regarding data protection and to enforce your rights as a data subject.
We encourage you to contact us if you have any information requests, requests for information or objections about data processing or concerns. However, you also have the right to file a complaint with your local supervisory authority. However, we would appreciate it if you would contact us with your concern before turning to a supervisory authority.
Updating your information
If you believe that the information, we hold about you is inaccurate or that we are no longer entitled to use it and want to request its rectification, deletion, or object to its processing, please do so by contacting us. For your protection and the protection of all of our users, we may ask you to provide proof of identity before we can answer the above requests.
Keep in mind, we may reject requests for certain reasons, including if the request is unlawful or if it may infringe on trade secrets or intellectual property or the privacy of another user. Also, we may not be able to accommodate certain requests to object to the processing of Personal Data, notably where such requests would not allow us to provide our service to you anymore.
Withdraw your consent
You may withdraw your consent and request us to stop using and/or disclosing your Personal Data for any or all of the Purposes by submitting your request to us. Should you withdraw your consent to the collection, use or disclosure of your Personal Data, it may impact our ability to proceed with your transactions, agreements, or interactions with us. Prior to you exercising your choice to withdraw your consent, we will inform you of the consequences of the withdrawal of your consent. Please note that your withdrawal of consent will not prevent us from exercising our legal rights (including any remedies) or undertaking any steps as we may be entitled to at law.
We are present on Facebook, Twitter, Instagram, on the basis of our legitimate interest. If you contact us via those social media platforms, you should note that the chat history can neither be deleted by us nor by you. And that, in accordance with the DPA and the GDPR, the relevant social media platform and we are jointly responsible for the processing of your data and enter into a so-called joint controller agreement. A Joint Controller Agreement itself if very legalistic and lengthy, but in a nutshell, it clarifies how the jointly responsible parties will fulfil the obligations arising from data protection laws that are applicable to them.
Further, your use of the relevant social media platform and its functions is your own responsibility, this applies in particular to the use of the interactive functions (e.g., commenting, sharing, rating). In addition, the relevant social media platform may use your data for market research, advertising purposes and to create profiles about your usage behaviour and your interests. This allows, for example, advertisements to be placed within and outside the platforms that presumably correspond to your interests. we, as the provider of this policy, do not collect and process any data from your use of the relevant social media platform beyond the point of responding to your requests and if so intended, entering into a contract with you. For further information about the relevant social media platforms use of your Personal data, please refer to the above linked Privacy Policies.
The legal basis for the use of the relevant social media platform is our legitimate interest, your consent or, in the case of a (pre) contractual relationship with us, the initiation of a contractual service.
Personal Data and children
Our services are aimed at people aged 18 and over. We will not knowingly collect, use or disclose Personal Data from minors under the age of 18 without first obtaining consent from a legal guardian through direct offline contact.
Do you have any questions?
Please contact us if you have any comments or questions about this policy and/or our use of your Personal Data.