In this Privacy Notice, we describe how your Personal Data will be collected, used and shared in connection with Testing For All’s project involving the distribution of certain kits to test for SARS-CoV-2 (the “COVID-19 Project”). For clarity, in this Privacy Notice, “SARS-CoV-2” refers to the virus that causes the COVID-19 disease.
Who is responsible for the handling of my Personal Data?
Testing For All is the Controller (for the purposes of the General Data Protection Regulation (“GDPR”)) of your Personal Data. Testing For All is a company limited by guarantee registered in England and Wales under company number 12570433 with its registered address at 13 Hawley Crescent, London, England, NW1 8NP.
What types of Personal Data will be collected and processed in connection with the COVID-19 Project?
If you become part of the COVID-19 Project, Testing For All will collect and process Personal Data about you, which may include:
If you become part of a usability study or clinical trial, Testing For All may collect and process additional Personal Data about you, which may include:
We may provide additional or supplemental privacy notices to you in respect of any such studies or trials. These supplemental privacy notices will govern how we may process the information in the context of that study or trial.
For what purposes will Testing For All process my Personal Data and on what legal basis?
Testing For All will process your Personal Data for the following purposes:
The legal bases under the GDPR for Testing For All’s collection and processing of your Personal Data in connection with the Covid 19 Project is:
With whom does Testing For All share my Personal Data?
Whenever possible, when your Personal Data is shared with third parties, your identity will be protected in accordance with accepted industry standards and applicable laws. Your Personal Data will not be made publicly available. Testing For All never sells your Personal Data to third parties.
Testing For All may share your Personal Data with the following third parties:
Where will my Personal Data be maintained?
Your Personal Data will be maintained by Testing For All on the Google Cloud Platform in Europe-west1 and Europe-west2 and Amazon Web Services: Europe (London) Region.
As outlined above, we may also share your Personal Data with third parties who may be based outside the European Economic Area (“Europe”). Any processing of your Personal Data by such third parties will therefore involve a transfer of your Personal Data outside of Europe. Where this occurs, we ensure that a similar degree of protection is afforded to your Personal Data by implementing at least one of the following safeguards:
How will my Personal Data be protected?
Testing For All takes technical measures that are designed to protect your Personal Data from unauthorized access and use; for example, your Personal Data is stored in the Google Cloud Platform and Amazon Web Services and is encrypted using one or more layers of encryption. Where available Testing For All staff use multi-factor authentication provided by Google Cloud and Amazon Web Services to provide additional security to access Personal Data.
What are my rights with regards to by Personal Data?
The GDPR gives you the following rights:
Please note that some of these rights do not apply when Personal Data is being used for research purposes, but we will always try to respond to concerns or queries that you may have.
How long will my Personal Data be retained?
Your Personal Data will not be kept for longer than is necessary, as stated in this Privacy Notice, and will be retained in an anonymized format wherever possible. When your Personal Data will no longer be necessary for the purpose of responding to the COVID-19 pandemic, it will only be retained to the extent that this is required under applicable legislation and will otherwise be deleted.
How do I submit questions or concerns?
If you have questions about how your Personal Data is handled in connection with the COVID-19 Project, please refer them to Testing For All at the contact details listed below.
If your concern cannot be resolved, you may submit a complaint to the UK Information Commissioner’s Office.
Testing For All’s Data Protection Officer can be reached by sending an email to firstname.lastname@example.org.
Updated 15 July 2020