Privacy policy
1. Introduction
Medicinal Cannabis UK CIC (MCUK) is committed to protecting and respecting your privacy. This policy explains how we collect, use, store, and protect personal data in line with UK data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We recognise that much of the information we handle may be sensitive, particularly given our work supporting patients. We therefore take our responsibilities seriously and aim to handle all personal data lawfully, fairly, and transparently.
2. Purpose
The purpose of this policy is to:
- Explain what personal data we collect and why
- Set out how we use and protect personal data
- Ensure compliance with legal and regulatory requirements
- Provide transparency to our service users, volunteers, and stakeholders
3. Scope
This policy applies to service users and community members, website visitors and digital platform users, volunteers, staff, and directors, and partners, supporters, and stakeholders. It covers all personal data processed by MCUK, whether collected online, in person, or through third parties.
4. Data Protection Principles
MCUK will ensure that personal data is:
- Processed lawfully, fairly, and transparently
- Collected for specified, explicit, and legitimate purposes
- Adequate, relevant, and limited to what is necessary
- Accurate and kept up to date
- Retained only for as long as necessary
- Kept secure using appropriate technical and organisational measures
5. What Data We Collect
We may collect and process the following types of personal data:
- Identity data (e.g. name, username)
- Contact data (e.g. email address, phone number)
- Technical data (e.g. IP address, browser type, website usage)
- Communication data (e.g. messages, enquiries, feedback)
- Volunteer or staff data (e.g. role information, availability)
As an organisation supporting medicinal cannabis patients, individuals may choose to share information relating to their health or medical circumstances. This is known as special category personal data. Where we process this information, we will do so only where permitted by law and with appropriate safeguards, such as explicit consent or another lawful condition under UK GDPR.
6. How We Use Personal Data
We use personal data to provide support, information, and services; respond to enquiries and communicate with individuals; manage volunteers and organisational operations; improve our services and digital platforms; and comply with legal and regulatory obligations.
We will only process personal data where we have a lawful basis to do so, including consent, legitimate interests, legal obligation, or performance of a contract.
7. Sharing Personal Data
MCUK does not sell personal data. We may share data where necessary with service providers (e.g. IT, hosting, or communication platforms), professional advisers (e.g. legal or financial), and regulators or authorities where required by law.
MCUK may use carefully selected third-party service providers to deliver its services. These organisations are only given access to personal data where necessary and are required to protect it appropriately and process it in accordance with data protection law.
8. Data Security
MCUK takes appropriate measures to protect personal data, including secure systems and access controls, limiting access to authorised individuals only, use of secure platforms and encryption where appropriate, and regular review of data handling practices.
Everyone working on behalf of MCUK is expected to maintain the confidentiality of personal information and only access data where necessary for their role.
9. Data Retention
We will only retain personal data for as long as necessary to fulfil the purposes for which it was collected, including legal, accounting, or reporting requirements. Retention periods will vary depending on the type of data and its purpose. Once personal data is no longer required, it will be securely deleted or anonymised.
10. Your Rights
Under UK data protection law, individuals have the right to access their personal data; request correction of inaccurate data; request deletion of their data (where applicable); restrict or object to processing; request transfer of their data (data portability); and withdraw consent at any time (where consent is relied upon).
Requests can be made by contacting us using the details below. We will normally respond to requests relating to personal data within one month, in accordance with UK data protection legislation.
11. Cookies and Website Data
Our website may use cookies or similar technologies to improve user experience and understand how our services are used. Where required, users will be given clear information and choices about cookie usage. For full details, see our cookie policy.
12. Breaches
In the event of a personal data breach, MCUK will assess the risk to individuals, take appropriate steps to contain and resolve the issue, notify the Information Commissioner's Office (ICO) where required, and inform affected individuals where there is a high risk to their rights and freedoms.
13. Responsibility
The Board of Directors has overall responsibility for ensuring that MCUK complies with data protection legislation. Day-to-day responsibility for implementing this policy rests with those handling personal data as part of their role. All staff and volunteers are responsible for handling personal data in line with this policy and reporting any concerns or breaches promptly.
14. Review
This policy will be reviewed at least annually, or sooner following significant organisational changes, legislative changes, or a data protection incident.
15. Contact
If you have any questions about this policy or how your data is handled, please contact Medicinal Cannabis UK CIC at hello@mcukcic.co.uk.
If you are dissatisfied with how we have handled your personal data, you have the right to lodge a complaint with the Information Commissioner's Office (ICO). We encourage you to contact us first so that we have the opportunity to resolve your concerns.