Menu Home Search

Privacy policy

We understand how important it is to keep your personal data safe and secure and we take this very seriously. We have taken steps to make sure your personal data is looked after in the best possible way and we review this regularly.


Please read this Privacy Notice (‘Privacy Notice’) carefully, as it contains important information about who we are and how we collect, store, use and share your personal data.  This Privacy Notice also explains your rights in respect of your personal data.

 

ABOUT US
We are YOR Local Medical Committee Limited (YORLMC) and our registered address is 1st Floor, 87-89 Leeds Road, Harrogate, HG2 8BE.  We are a company registered in England and Wales, registered number. 6349731

 

We are the Data Controller of your personal data. This means we are responsible for collecting, storing and handling your personal data.

 

[There may be times where we also process your personal data. That means we use it for a particular purpose and, therefore, on those occasions we may also be Data Processors. The purposes for which we process or use your personal data are set out in this Privacy Notice]

 

SOME KEY TERMS USED IN THIS PRIVACY NOTICE:

 

We, Us, Our means YORLMC

 

Personal data means any information that relates to an identified or identifiable individual

 

WHY WE ARE PROVIDING THIS NOTICE

 

We are required to provide you with this Privacy Notice by law. As part of our representative function as a Local Medical Committee and a trade association, we collect and handle personal data about you and this Privacy Notice explains how we use the personal data we collect, store and hold about you.

 

This privacy notice explains how YORLMC Ltd (ICO registration number Z1044267) processes your data and for what reasons.  The notice is divided into various areas of stakeholder engagement so readers can refer directly to their relevant section.

Constituents

Constituents are all practising GPs represented by the following Local Medical Committees (LMCs):  Bradford, Airedale, Wharfedale and Craven; North Yorkshire and York.

 

A GP is represented by the LMC, if they are registered on the National Performers List, working in the LMC area, and paying a statutory/administrative levy. Constituents also include sessional and locum GPs and as the levy is paid per practice, constituents also include the practice staff employed by the practice.

 

Purpose: We process constituents’ personal data in order to provide the services and work of YORLMC, which includes the following purposes:

  • Administer lists of Representative GPs (as required under the LMC constitution) and practices and their practice staff.
  • To administer the LMC elections.
  • To consider and specifically deal with matters arising under section 97 of the NHS Act.
  • To negotiate with or between and to CCGs and other bodies
  • To encourage and assist in the development of services, activities and amenities to constituents.
  • Provide advice, support and training.
  • Seek and represent your views.
  • Keep you informed about LMC activities, provide key information and guidance across YORLMC’s geographic footprint, locally and nationally through our monthly newsletters, bulletins and email updates.
  • Keep you informed on news relating to YORLMC’s Buying Group.
  • Send out invites for attending events run by YORLMC Ltd. 

Lawful basis for the processing:

The majority of our processing is carried out under General Data Protection Regulation (GDPR) Article 6.1(e) ‘Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority invested in the controller’.

 

Or under GDPR Article 6.1 (f) ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.’

  

Personal data:

Full name

Contact postal address.

Contact email address(es)

Contact telephone number, including mobile.

Practice name/organisation

Job role and title

 

Who provides the personal data:

Data subject: Constituents directly.

Practice Managers and other practice staff on behalf of the practice.

We receive a minimum data set from NHS England with the details of GPs joining or leaving the performers list, which includes name, contact address, contact email address (if provided), Date of birth (if provided) and practice where they are working (if provided).

 

 Who we share your personal data with:

  • General Practioner Committee (GPC)We also provide the names and contact email addresses with the General Practitioners Committee (GPC) for administering their regional elections. 
  • NHS England: We provide, on request, the names of practices and the names of principal GPs for those practices to NHS England to confirm levy mandates and payments.
  • Fourteen Fish: We use Fourteen Fish acting as a data processor, to maintain our constituent database, public website, and other emails. It may be necessary during the course of these activities that Fourteen Fish will require access to the personal data of YORLMC constituents. However no changes to the data will be made without the specific approval of a YORLMC employee.

 

Personal data transfers outside of the EEA None.

 

  How long we retain your personal data

When you retire as a GP, or are no longer registered on the NPL (national performers list), or you no longer work as a GP in the YORLMC area , unless you request to remain as a retired member on our database, we will lapse your record on the database keeping only minimum information including name, and work history, eg relationships to practices. For practice staff, their record will be lapsed when they no longer work in the areas covered by YORLMC.

 

How we store your data

Your personal data is stored in our membership database provided to us by FourteenFish, who act as a data processor.

Committee Members

Committee members are GPs elected or co-opted by other GPs in their LMC area, onto a Local Medical Committee (LMC). Practice Managers are invited representatives on the LMCs. 

 

Purpose

In addition to the purposes outlined under Constituents, we process committee members’ personal data for the purpose of administering the committee, including the election process and payment of honoraria.

 

Lawful basis for the processing:

General Data Protection Regulation (GDPR) Article 6 (1) (e) ‘Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority invested in the controller’.

 

GDPR Article 6 (1) (b) ‘Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.

 

GDPR Article 6 (1) (c) ‘Processing is necessary for compliance with a legal obligation to which the controller is subject’.

 

Any special category data relating to access requirements and/or dietary preferences is processed under GDPR Article 9 (2) (b) ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject’.

 

Any special category data, eg BMA number is processed under GDPR Article 9 (2) (d)

‘processing is carried out in the course of its legitimate activities with appropriate safeguards by a foundation, association or any other not-for-profit body with a political, philosophical, religious or trade union aim and on condition that the processing relates solely to the members or to former members of the body or to persons who have regular contact with it in connection with its purposes and that the personal data are not disclosed outside that body without the consent of the data subjects’.

 

Personal data:

 

In addition to the personal data described under constituents, we may process:

  • National insurance number, date of birth and financial details (including bank account and sort code) for processing and payment of honoraria payroll.
  • Dietary preferences/access requirements. 

  

Who provides the personal data:

Directly from the data subject: Committee members and invited representatives.

 

Who we share your personal data with the payroll database:

We hold name, contact details, national insurance number, date of birth and financial details to, in order to process and pay honoraria. 

 

We provide details of the names of committee members to all constituents when we declare results of the LMC elections and the names of committee members are displayed on YORLMC’s website (www.yorlmcltd.co.uk) .  

 

We provide details to HMRC for tax purposes. 

 

Personal data transfers outside of the EEA None 

 

How long we retain your personal data

When a committee member finishes their term of office or resigns from the committee, their personal information is retained on the payroll system until the completion of the next quarterly honoraria payment and in order to issue a P45. 

 

We need to keep the details of financial transactions for seven years after the end of the financial year in which they were processed, in the event of the tax, payroll or accounting enquiry.

 

How we store your data

Your personal data, including your BMA number (if applicable) is stored in our membership database provided to us by FourteenFish who act as a data processor. In addition, your name, contact details, national insurance number, date of birth and financial details are stored in the payroll database. 

 

Event Attendees 

 

Event attendees may be constituents but can also be non-constituents. They are anyone who attends an event run by YORLMC Ltd.  

  

Purpose

We process the personal data in order to run and manage the event the event attendee is attending. We may take photos or video footage of some events and this will be made clear to all delegates prior to the day and at the start of the day, in our event communications

 

Lawful basis for the processing:

General Data Protection Regulation (GDPR) Article 6 (1) (b) ‘Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.

 

Or under GDPR Article 6.1 (f) ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.’

 

Any special category data relating to access requirements and/or dietary preferences is processed under GDPR Article 9 (2) (b) ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject’.

  

Personal data:

Name

Contact postal address

Contact email address

Contact telephone number

Practice name(s) 

Dietary preferences

Access requirements

Photos/Video footage taken at an event. 

 

Who provides the personal data:

Directly from the data subject: event attendee or from the person booking the event on their behalf, eg a Practice Manager for a GP.  

 

Who we share your personal data with:

We may share your name with the speakers, trainers or sponsors of an event for administrative purposes.  We may share names with the venue hosting the event if necessary for access purposes.

 

Personal data transfers outside of the EEA None 

 

How long we retain your personal data

We need to keep the details of financial transactions for six years after the end of the financial year in which they were processed, in the event of an accounting enquiry.

 

How we store your data

Your personal data is stored in our membership database provided to us by Fourteen Fish, who act as a data processor. 

 

We don’t store any payment card details, these are processed through Fourteen Fish

 

Event Exhibitors, Event Sponsors, Event Speakers

 

Event exhibitors, sponsors and speakers are normally non-constituents but may also be constituents.  They are anyone who exhibits, sponsor or speaks at an event run by YORLMC Ltd

 

Purpose

We process the personal data in order to run and manage the event and/or run the training programme. We may take photos or video footage of some events this will be made clear to all delegates prior to the day and at the start of the day.

 

Lawful basis for the processing:

General Data Protection Regulation (GDPR) Article 6 (1) (b) ‘Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.

 

Or under GDPR Article 6.1 (f) ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.’

 

Any special category data relating to access requirements and/or dietary preferences is processed under GDPR Article 9 (2) (b) ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject’.

 

Personal data:

Name 

Contact postal address.

Contact email address.

Contact telephone number.

Dietary preferences

Access requirements

Photos/Video footage at an event/training day CVs for trainers and mentors. 

 

Who provides the personal data:

Directly from the data subject: event exhibitor contact, sponsor contact, speaker contact, trainer or mentor.  

 

Who we share your personal data with:

We may share your name with the speakers or sponsors of an event and if this is the case, you will be informed.  

 

Personal data transfers outside of the EEA None 

 

How long we retain your personal data

We need to keep the details of financial transactions for six years after the end of the financial year in which they were processed, in the event of an accounting enquiry.

 

How we store your data

Your personal data is stored in our membership database provided to us by FourteenFish, who act as a data processor. 

Employees/Workers

All staff who have a contract of employment or a service agreement with YORLMC Ltd

 

Purpose

We process the personal data in order to fulfil obligations of an employment contract, provide a safe working environment, and meet legal obligations.

 

Lawful basis for the processing:

General Data Protection Regulation (GDPR) Article 6 (1) (b) ‘Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.

 

GDPR Article 6 (1) (c) ‘Processing is necessary for compliance with a legal obligation to which the controller is subject’.

 

Or under GDPR Article 6.1 (f) ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.’

 

Any special category data is normally processed under GDPR Article 9 (2) (b) ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject’.

 

Personal data:

Name 

Contact details

Date of Birth

Gender

National insurance number/Passport/ID number

Work Permit/Visa details (for non-EU nationals)

Emergency contact details

Dietary requirements

Access requirements.

  

Who provides the personal data: Employee/Worker

 

Who we share your personal data with:

HM Revenue & Customs, regulators (such as the ICO) and other authorities if required under law.

Pension providers for management of auto enrolment compliance.

Data processors, who assist in the operation of our organisation, including for the purpose of payroll

Pension providers.

 

Personal data transfers outside of the EEA None 

 

How long we retain your personal data

We need to keep the details of financial transactions for six years after the end of the financial year in which they were processed, in the event of an accounting enquiry.

 

How we store your data

In paper and electronic HR files, Payroll and leave system hosted by, Moneysoft who act as a data processor, Pension providers systems and FourteenFish.

Job Applicants

Any individual who applies for a position at YORLMC Ltd

 

Purpose

We process the personal data in order to fulfil obligations of making pre-contract checks, providing a safe working environment, and meeting legal obligations.

 

Lawful basis for the processing:

General Data Protection Regulation (GDPR) Article 6 (1) (b) ‘Processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’.

 

GDPR Article 6 (1) (c) ‘Processing is necessary for compliance with a legal obligation to which the controller is subject.’

 

Or under GDPR Article 6.1 (f) ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.’

 

Any special category data is normally processed under GDPR Article 9 (2) (b) ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and the interests of the data subject’.

 

Personal data:

Name 

Contact details

Right to work (is checked at interview but is not stored for applicants)

Ethnicity, gender, age, access requirements (captured on a separate form and are held in a non-identifiable form for equality monitoring) 

Declaration of unspent convictions under the Rehabilitation of Offenders Act 1974 (the declaration forms are kept separately from the application forms or CVs).  

 

Who provides the personal data:

Job applicant or Agency

 

Who we share your personal data with:

Interview panel.

  

Personal data transfers outside of the EEA None 

 

How long we retain your personal data

We keep identifiable details for a period of 6 months after the interviews are concluded.

 

How we store your data

In paper and electronic HR files. 

Suppliers & Contractors

All suppliers and contractors who provide services to YORLMC Ltd

 

Purpose

We process the personal data in order to manage the contract and the services.

 

Lawful basis for the processing:

General Data Protection Regulation (GDPR) Article 6.1 (f) ‘processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.’

 

Personal data:

Name 

Contact details

 

Who provides the personal data:

Data Subject directly or from the supplier company they work for.

 

Who we share your personal data with:

YORLMC does not share without their permission the contact details of its suppliers outside of the organisation.

Personal data transfers outside of the EEA None 

 

How long we retain your personal data

Personal identifiable data will be held for as long as the contract is in place.  We need to keep the details of financial transactions for six years after the end of the financial year in which they were processed, in the event of an accounting enquiry.

 

How we store your data

In paper and electronic files. 

 

Visitors to our website and our use of Cookies

Our website uses cookies to enable certain core functionality such as allowing you to log in to your account and make bookings on events. These cookies do not contain any sensitive or personal information, and only act as a mechanism for our server to identify your user account as you move around the website.

When you visit our website, you are also prompted to allow us to collect additional information about how you use the website. This data is anonymised and is used to allow us to identify trends on our website and make improvements. For example, this anonymised data allows us to see how many people have visited a certain page on our website in a given month. Unless you click the "Allow cookies" option, we do not collect this data or store the Google Analytics tracking cookie that enables this functionality on your device.

 

For more information on the legislation regarding cookies, see the Information Commissioner’s Office guidelines.

Sharing your information

 

We will not share your information with any third parties for the purposes of direct marketing. We use data processors who are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct. In the individual sections, we have detailed any specific instances of sharing with data processors.  

 

In some circumstances we are legally obliged to share information. For example, under a court order, where sharing is required we will satisfy ourselves that we have a lawful basis on which to share the information and document our decision making.

Your rights

As an individual whose data is processed by YORLMC Ltd, you have the following rights: 

 

The right to be informed  – which is what this privacy notice is for

 

The right to access the data we hold about you This is commonly known as a ‘subject access request’

 

The right to object to processing carried out in the public interest, please contact us on info@yorlmcltd.co.uk

 

The right to object to direct marketing – either use the unsubscribe button in an

email or contact us on info@yorlmcltd.co.uk

  

The right to erasure (right to be forgotten)(in some circumstances)

 

The right to data portability (in some circumstances)

 

The right to have your data rectified if it is inaccurate

 

The right to have your data restricted or blocked from processing  

 

To exercise any of these rights, please contact us on info@yorlmcltd.co.uk  

You also have the right to lodge a complaint with the supervisory authority, which is the UK Information Commissioner, who you can contact via their helpline or as directed on their website www.ico.org.uk.

 

How to contact us and exercise your rights

 

YORLMC Ltd is not required to have a Data Protection Officer. However, if you have a data protection query, please contact us via info@yorlmcltd.co.uk .

 

Any future changes to this policy will published on the website (www.yorlmcltd.co.uk

The voice for NHS GPs and Practice Teams across North Yorkshire, the City of York, Bradford, Airedale, Wharfedale & Craven districts.