The Society for Mucopolysaccharide Diseases retains personal data in accordance with statutory requirements or for a longer period of time should we need to under legitimate interests (exemptions). The periods relating to different personal data categories are appropriate and not longer than necessary in this respect.

Record of Data Retention Periods Relevant to the Business of the MPS Society and its wholly own subsidiary Rare Disease Research Partners - Statutory Requirements are followed where required.

Patient Services

Members

All members’ personal data that is relevant under legitimate interests will be retained for 6 years upon which this will be reviewed.

Advocacy

As part of the Society for Mucopolysaccharide Diseases commitment to our patient community consent must be obtained before services can be provided. In this instance we retain data as follows:

Type of Data and Retention Period

• General case notes - 6 years after the file is no longer active.

• Records relating to children - Until person turns 25 years old – then review.

• Members - 6 years then reviewed.

• Child safeguarding information - Until person turns 25 years old.

• Adult safeguarding information - 6 years after closure of file.

• Anonymised data - Indefinitely.

• Deceased data - Indefinitely.

There may be occasions where for research purposes we may retain some individual’s information beyond this timeframe under legitimate interests, in this instance data should be anonymised.

The Society for Mucopolysaccharide Diseases recognises that there are circumstances when it may not be possible to gain consent eg: when safeguarding principles apply or when there is an emergency intervention. In this case records will be retained for a period of one month and where retained will be anonymised.

Projects & Events

The Society for Mucopolysaccharide Diseases holds both virtual and face-to-face activities and events in order to support MPS members and their families. Except in the event of any investigations being held, all personal data held in relation to such activities and events will be retained for 3 years.

Records may be kept for longer than this period for special events where there is a need to identify who attended. By special events, this refers to those events which are often oversubscribed and where we have limited spaces. The longer data retention period is to ensure fairness in the allocation of places. We may not be able to give everyone the opportunity to attend every time the event is offered but by keeping a list of attendees over a longer time period, we can be fair in the allocation of places. In this instance records will be kept for 6 years.

Fundraising

Donors

All donors’ records will be retained for 6 years after their last contact with the Society for Mucopolysaccharide Diseases.

Fundraising events

All financial records and personal data relating to fundraising events will be retained for 6 years.

Trusts & Grants

All personal data held in relation to trusts and grant applications will be retained for 6 years. This includes information provided by individuals in support of such applications.

Communications

Photographs and Filming

We will store and use photographs and videos in accordance with our policy 4E Photography and Filming Policy. Under legitimate interests we will retain all photographs and videos indefinitely and will always seek consent before using any such image or video in the future.

RDRP

Clinical trial participants

All records of personal data relating to clinical trial participants will be retained for 3 years after the end of the trial, or as specified by the clinical trial sponsor.

Research, survey and study participants

All records of personal data relating to participants in research, surveys and studies will be retained in line with the specification of the project contract. If no retention detail mentioned in the contract personal data will be kept for 3 years after the end of the project.

CSAC

Unsuccessful applications will be kept for 6 months after the rejection letter has been sent.

Successful applications will be archived at the end of the project and kept for 6 years in-line with financial requirements.

Employment

Type of Data and Retention Period

• Main employment record - 6 years following termination of employment.

• Income tax, National Insurance records and correspondence with Inland Revenue - We retain for 6 years however HMRC will retain permanently.

• Records relating to events notifiable under the Retirement Benefits Schemes (Information Powers) Regulations 1995, and records concerning decisions to allow retirement due to incapacity, pension accounts and associated documents - 6 years from the end of the scheme year in which the event took place, or the date upon which the accounts/reports were signed/completed.

• Statutory Maternity Pay records, calculations, certificates (Mat B1s) or other medical evidence - 6 years following termination of employment.

• Statutory Sick Pay records, calculations, certificates, self-certificates - 6 years.

• Wage/salary records (also overtime, bonuses, expenses) - 6 years.

• Records relating to DBS certificate - 6 years following termination of employment.

• Records relating to Life Assurance Policy - At termination of employment.

Medical

Accident books, accident records/reports: minimum of 3 years after the date of the last entry.

Accounting

Accounting records: 6 years

Credit card account numbers must be destroyed in a manner that will render them unreadable after their useful life of 6 years has expired.

CCTV

CCTV images will not be retained for longer than necessary, taking into account the purposes for which they are being processed. Data storage is automatically managed with historical data being overwritten in chronological order to produce a 30-day rotation in data retention.

All retained CCTV images will be stored securely. If there is a legitimate reason for retaining the CCTV images (for example an accident investigation and/or legal proceedings), the footage or still frames can be isolated and saved outside the hard-drive to a separate password protected encrypted zip file on the MPS server. Any saved images or footage will be deleted once they are no longer needed for the purpose for which they were saved.

Trustees/Directors

All personal data relating to previous Trustees/Directors will be retained for 7 years following termination of their agreement with the Organisation.

Board minute meeting records will be retained for 10 years.

Disposal of personal and sensitive data

The Society for Mucopolysaccharide Diseases has a responsibility to dispose of personal and sensitive data which has passed its retention date carefully and securely. The following processes must be followed:

• Manual records must be shredded and disposed of as ‘confidential waste’

• Any removable or portable computer media such as hard drives and USB sticks must be destroyed under the guidance of IT Mighty.

Document owner

The data controller is the owner of this policy document and must ensure that it is periodically reviewed according to the review requirements contained herein.

The latest version of this policy document dated 06.10.2023 is available to all employees of the Society for Mucopolysaccharide Diseases on the corporate intranet.

This policy document was approved under the Society’s policy approval process on a version-controlled basis.

Name of GCEO: Bob Stevens Date: 06.10.2023

View the PDF of the Data Retention and Disposal Policy (English only)