We'd love to keep you up to date on the real difference Reach are making to those who are impacted by brain injuries
This notice provides an overview of the personal data that Reach collects and processes, how we do it and our purposes for doing so. We also provide information about third parties with whom we may share your data and why we may need to do this, explain how you may gain access to the data we hold about you and your rights in relation to your personal data. The terms personal data and personal information are interchangeable for the purpose of this document.
We often act on behalf of organisations to provide individuals with rehabilitation programmes. When we act on behalf of a third party, we receive your information indirectly and the provider is primarily responsible for the purpose that it should be used for. In these circumstances, we are the data processor.
When working directly with you, or when undertaking activities that may shape your rehabilitation programme, we may collect your personal data and make decisions that influence the purposes for which your data is being processed. In these circumstances, we are the data controller, or the joint data controller.
As part of our Human Resources activities, we may collect your data in relation to current, past and prospective employment, through recruitment and contracting processes, in addition to financial and tax information to process your employee payroll and benefits. We are wholly responsible for the proper use and handling of this data and, as such, are the data controller.
We may collect your contact information if you have an ongoing relationship with Reach, and if you are an employee or contractors we may collect and process your financial information, as necessary to administer our payroll and benefit obligations.
In addition to these basic categories of personal information, we may need to collect sensitive data as part of the process of carrying out our occupational health work and delivering our rehabilitation programmes. This information may fall into special categories of data that we must take additional steps to look after. These categories are for data relating to:
Through this notice, and explicit consent forms where appropriate, we will ensure that you are informed that your data is being collected.
Our main purpose for processing your personal data is to help us pursue our legitimate interest in rehabilitating people with brain injury, or purposes that directly support this work. We may also process your data to comply with legal obligations, to fulfil a contract we may have entered into with you or, in exceptional cases, in your vital interests or those of another person. These purposes may include:
Sometimes we may need to share your personal information with external clinicians to help us with our rehabilitation work. We will only do this where we have a legitimate interest to do so and your data will be held in strict confidence. You should be aware that some clinical professionals have an obligation to retain a record of their treatment or recommendations indefinitely, so it may not always be possible for you to exercise your right to be forgotten.
We may also share your data with third parties, such as providers to dispense with our finance, payroll and pension administration, or with relevant regulatory bodies acting in their official capacity.
We will always take steps to ensure that any third parties with whom we share your personal information have measures in place to adequately protect it and we will provide you with the details of these third parties upon request.
On occasion, we may be required to share your personal information by law, such as in the case where a court order has been issued or, to prevent harm to you or other people.
You may contact us to request a copy of your data at any time. You will need to satisfy Reach that the personal information that you are requesting belongs to you, or that you are the legal guardian of that person.
We are obliged to satisfy all such requests within 1 month of receiving the request or, up to 3 months if we consider the request to be justifiably complex. We will notify you within the first month if we not be able to provide you with your personal data within this time, providing you with our justification for the delay.
We will not keep your data for any longer than is strictly necessary, our Data Retention policy covers specific information, though as a general rule we dispose of data 7 years after a rehabilitation programme and 10 years for financial records. Where we have extended liability, or there is ongoing legal proceedings, we may keep data for longer.
Further details of our retention schedules may be found at:
You have certain legal rights when it comes to your personal information, which are:
We have procedures in place to assist you, should you wish to exercise these rights, except in the case where it directly conflicts with the rights of others or our legal obligations. If you wish to speak with us about how your data is handled, please use the following contact:
Email: firstname.lastname@example.org. Telephone us on 01423 326 000
Or write to us at:
Reach Personal Injury Services Limited 14 The Stables
You also have the right to appeal to the Information Commissioner if you are unhappy with the way that we have handled your data. You may contact the Information Commissioners Office on 0303 123 1113, or access further information on their website at: https://ico.org.uk/concerns/