Who we are
“We” and “us” means Avma (Action against Medical Accidents). We are a charity with registered charity no. 299123 and a registered company with company No. 02239250. We support people who suffer avoidable medical harm and help them get the outcomes they need.
Your privacy matters
At Avma, we are committed to keeping your personal data safe and secure.
This notice sets out in detail the purposes for which we process information about you, who we share it with, what rights you have in relation to that information, and everything else we think it’s important for you to know.
If you have any questions about the processing of your personal data, or you would like to exercise any of your rights, please reach out to us by emailing office@avma.org.uk.
How we process your information
To understand how we process your personal data and to understand your rights, please visit the relevant section below:
- People supported by Avma
- Lawyers (solicitors, barristers and panel members)
- Medical experts
- Human resources (e.g. job applicants, employees)
- Events, donations, fundraising and marketing
- General information (complaints procedure, your rights)
Changes to this privacy notice
This privacy notice is kept under regular review and we aim to keep it regularly updated. If we make any significant changes to the way in which we process your information, we will let you know by either reaching out to you and/or posting a banner on our website.
This privacy notice was last updated in March 2025.
People supported by Avma
How and when do we collect information about you?
We collect your personal data directly from you when you engage with us to use or enquire about our services for yourself, or if someone makes an enquiry on your behalf.
We collect this through different channels such as our helpline, email correspondence, and our online new client form. This includes information such as your name, contact details, address, relationship with the affected individual, date and account of the incident, health information of the affected individual, hospital and doctors involved, outcome expectations, complaints made to authorities, inquests, and legal action details.
For equal opportunities monitoring, we may ask for the following information on the affected individual: gender, age, disability, and ethnicity.
We may collect several pieces of information in this process through case studies and process any safeguarding information we record.
How is the information used?
We use this information to:
- offer practical advice with respect to a medical injury or inquest,
- assist you in finding legal support from our accredited specialist clinical negligence solicitors,
- facilitate your enquiries and help you use services, and/or
- address any safeguarding concerns.
What is our lawful basis for processing this information?
- To process your information when you enquire about or use our services, we rely on legitimate interest, along with legal claims.
- To process equality, diversity and inclusion (EDI) information, we rely on legitimate interest read with substantial public interest and conditions from the Data Protection Act 2018 (DPA).
- For any safeguarding information we record, we rely on legitimate or vital interest, read with substantial public interest and conditions from the DPA.
- For any case studies, we rely on consent.
Who do we share your information with?
- We may use consent to share your personal data with lawyers or legal professionals.
- To comply with our duty of care and safeguarding, we may need to pass some information raising a safeguarding concern with the authorities. In such circumstances, we apply vital interest and legitimate interest as our lawful basis. Data subjects’ rights and other UK GDPR provisions may be restricted when concerning personal data processed in these circumstances. Exceptions and exemptions are applied on a case-by-case basis.
How do we store your information, and for how long?
We retain the personal data of all data subjects for a period in line with our retention periods. If you would like to know more about this, please contact us at the email address above.
Lawyers
How and when do we collect information about you?
We process your personal data when you register for a membership with Avma’s Lawyers Service as a barrister or claimant solicitor, or when you sign up to volunteer with Avma. This would include your name, professional contact details, and firm or chamber details.
If you apply to join the Avma Specialist Clinical Negligence Panel, we process information such as name, name of firm/chambers and professional contact details, address, professional and employment details, and details of your work in clinical negligence.
How is the information used?
For solicitors and barristers joining the Avma Lawyers Service, we use this information to:
- include you in our expert database of clinical negligence litigation,
- provide you with Lawyers Service group meeting dates and updates,
- provide access to Avma webinars,
- give access to training, conferences and publications, and/or
- provide access to display the Avma Lawyers Service membership logo on your website.
For lawyers applying for accreditation or are a part of the Avma’s Specialist Clinical Negligence Panel, we use this information to assess your application and approve your accreditation with our panel.
What is our lawful basis for processing this information?
To process your information for the provision of our Lawyers Service or your application to be accredited with our Specialist Clinical Negligence Panel, we rely on contractual obligation.
Who do we share your information with?
We share your data with people who require support from Avma.
How do we store your information, and for how long?
We retain the personal data of all data subjects for a period in line with our retention periods. If you would like to know more about this, please contact us at the email address above.
Medical experts
How and when do we collect information about you?
We collect personal data on you directly from you when you apply to be an expert registered with Avma through our New Expert Application Form, which includes name, qualifications, contact address, contact details, CV, professional details and history, etc.
How is the information used?
We process this information to include you in our database of medical experts and recommend your names to solicitors who are members of Avma’s Lawyers Service.
What is our lawful basis for processing this information?
We process this information on the basis of legitimate interest.
Who do we share your information with?
We only share your details with the solicitors who are registered with Avma.
How do we store your information, and for how long?
We retain the personal data of all data subjects for a period in line with our retention periods. If you would like to know more about this, please contact us at the email address above.
Human resources
How and when do we collect information about you?
You provide several pieces of information to us directly during the recruitment period and subsequently upon the start of your employment or engagement. In some cases, we will collect information about you from third parties, such as employment agencies or former employers when gathering references.
What types of information are collected?
We keep several categories of personal data to carry out effective and efficient processes. Specifically, depending on your type of engagement with us, we may process the following types of data:
- personal details such as name, address, phone numbers and marital status,
- name and contact details of your next of kin,
- footage of our events in which you may appear,
- information of any disability or other medical information you have disclosed,
- right to work documentation, National Insurance number and bank account details,
- information gathered via the recruitment process, such as that included in a CV, cover letter or application form, references, details on your education and employment history,
- information relating to your employment with us (e.g. job title, job description, salary, terms and condition of the contract, annual leave records, appraisal and performance indication, formal and informal proceedings involving you such as letters of concern and disciplinary, disciplinary and grievance proceedings),
- dietary information, and/or
- your biography and image for use on our website.
We may also process special categories of data which include health information, sexual orientation, race and ethnic origin.
How is the information used?
We are required to use your personal data for various legal and practical purposes for the administration of your contract of employment or your volunteer/trustee agreement, without which we would be unable to employ you. Holding your personal data enables us to meet various administrative tasks, legal obligations and contractual/agreement obligations. We process information in relation to the DBS for our safe recruitment practices.
What is our lawful basis for processing this information?
We mainly use contractual obligation as the lawful basis for processing personal data for employees and job applicants. We mainly use legitimate interest for trustees and volunteers. We may also have legal obligations in order to process and share your data, for example we need to share salary information with HRMC or use some of your data to enrol a new employee on a pension scheme.
We may rely on our legitimate interest for processing activity such as keeping supervision and appraisal records or using your image, bio and videos/pictures of the organisations’ events where you may appear on our website or marketing/fundraising materials to promote the charity.
Some special categories of personal data, such as information about health or medical conditions, are processed in order to carry out employment law obligations and for health and social care obligations (such as those in relation to colleagues with disabilities and for health and safety purposes). We may also process other special categories of personal data, such as information about ethnic origin, sexual orientation, health and religion or belief on the basis of substantial public interest for the purposes of equal opportunities monitoring.
When processing criminal records (for example, in order to perform a DBS check), the organisation relies on the lawful basis of legitimate interest and additional conditions of the UK GDPR and DPA 2018.
Who do we share your information with?
Personal data in relation to your salary is shared with HRMC as part of our legal obligation. Personal data may be shared with third parties for the administration of payroll, pension, HR functions (for example the online holiday booking system) and administering other employee benefits (such as the Childcare Voucher Scheme).
When sharing information with third parties, we have data sharing agreements, data processing agreements or contracts in place to ensure data is not compromised. These third parties implement appropriate technical and organisational measures to ensure the security of your data.
How do we store your information, and for how long?
We only keep your data for as long as we need it for, which will be at least for the duration of your employment/engagement with us. In some cases, we will keep your data for a period of six years after your employment/engagement has ended. If you’ve applied for a vacancy but your application hasn’t been successful, we will keep your data only for 12 months.
Some data retention periods are set by the law. Retention periods can vary depending on why we need your data. Please get in touch by contacting us using the details above if you want to know more about retention periods.
Data is destroyed or deleted in a secure manner as soon as the retention date has passed.
Events, donations, fundraising and marketing
Events
We host fundraising events and your personal data is collected when you register for an event with us. We may collect basic personal information, such as your name, email and phone number. We rely on legitimate interest to administer your registration for the event. When we collect other information such as dietary information, we rely on your explicit consent.
If you have attended an event with us previously, we may reach out to you to invite you for our future events. We rely on consent to send you emails.
Donations
Your personal data is provided by you via a donation form on our website or via third party donation platforms (e.g. Raisely, Enthuse or Funraisin). The information gathered may be name, email address, Gift Aid sign up, company name if donation made by an organisation, donation details, reasons to engage, and postal address.
This information allows us to process your donation and deal with any potential enquiries. We rely on our legitimate interest to process this data. If you agree that we can claim Gift Aid on your donations, we are legally required to keep a record of the claim and your Gift Aid declaration. If you are donating using a third party, please also refer to the privacy notice published on their websites.
Fundraising and marketing
We may reach out to you for fundraising if you have previously engaged with us in an event, made a donation, or if we believe that you may be interested in engaging with our organisation. We may also send you marketing communications via email if you have signed up for marketing emails.
We rely your consent to send email communications (except where this is a business email address, whereby we rely on legitimate interest).
If you would like to change your marketing preferences, please reach out to us on the email address provided in the first section of this privacy notice, or you can simply unsubscribe with the option on the bottom of the emails.
General information
Your rights as a data subject
You have the following rights:
- Right to be informed, which means we will be completely clear and transparent about how we plan to use your personal information.
- Right of access, which means you can request details of the personal information we hold about you and how we use it. We will provide this within one month.
- Right to rectification, which means you can ask us to update or amend the personal information we hold about you, if it is incorrect.
- Right to restrict processing, which means you can ask us to change, restrict or stop the way we are using your personal information.
- Right to erasure (or ‘right to be forgotten’), which means you can ask us to remove your personal information from our records.
- Right to object, which means you can object to us using your personal information for marketing purposes.
- Right to data portability, which means you can obtain the personal information we hold about you and reuse it for your own purposes.
- Right not to be subject to automated decision making, which means if we use systems to make a decision about you, you have the right to ask for a person to intervene, which may change the outcome.
- Right to lodge a complaint with a supervisory authority, such as the Fundraising Regulator or the Information Commissioner’s Office (ICO), if you are not satisfied with our response to a request you make to us, or you feel we are not using your information correctly.
International data transfers
Where personal data is stored outside of the UK and the EEA, safeguards to protect personal data may include but are not limited to the UK Addendum used in conjunction with the EU Standard Contractual Clauses (SCCs), or UK International Data Transfer Agreement (IDTAs). Such safeguards will be subject to Transfer Risk Assessments (TRAs).
Complaints procedure
If you are unhappy with the way we process your data, please get in touch with the Data Protection Lead using the contact details mentioned above.
You can also make a complaint to the Information Commissioner’s Office (ICO), which regulates the use of information in the UK. They can be contacted at 0303 123 1113, or you can write to them at Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow SK9 5AF.