top of page

privacy policy

Clinically Vulnerable Families CIC ("CVF", "we", "us", "our") is committed to protecting your privacy. This policy explains what personal data we collect, why, how we use it, and your rights.

Clinically Vulnerable Families CIC is a Community Interest Company registered in England and Wales, company number 16022972.


CVF is registered with the Information Commissioner's Office, registration reference ZB887575.

Last updated: 3/7/2026


1. Who we are and how to contact us

If you have any questions about this policy or how we handle your data, you can contact us at [email address]. We do not currently have a formal Data Protection Officer given our size, but [name/role] is our contact point for data protection matters.
 

2. What personal data we collect

Depending on how you interact with us, we may collect:

  • Contact details — name, email address, and any information you provide via our contact or sign-up forms.

  • Membership and community data — Our primary community is hosted via a Facebook support group. If you join that group, the information you provide is submitted to and stored by Facebook/Meta, and is governed by Facebook's own privacy policy and terms — not this one. We do not control, and are not responsible for, how Facebook processes that data. Where you separately register interest in CVF's work directly with us (for example, via a form on this Site), that information is handled by us as described in this policy.

  • Survey and questionnaire responses — including information about your own or a household member's clinical vulnerability, health condition, or disability, where you choose to share this with us (see Section 4 on special category data below).

  • Evidence and testimony — accounts, experiences, or statements you provide for use in our advocacy work or submissions to the UK Covid-19 Inquiry, where you have agreed to share these.

  • Technical data — standard website usage data collected automatically when you visit our site (see Section 7, Cookies).

  • Donation and payment data — if you donate to CVF, limited payment-related data processed via our payment provider (we do not store full card details ourselves).

We do not knowingly collect data from children under 16 without appropriate parental involvement. If our forms ask about a household, a parent or guardian should complete this on behalf of any child members.
 

3. How we use your data, and our legal basis

​​


















 

4. Special category data (health information)

Because CVF's purpose relates to clinical vulnerability, some of the information people share with us — about their own or a household member's health condition, disability, or immunocompromised status — is "special category data" under UK GDPR, which receives extra legal protection.
 

We only collect this information where you have chosen to provide it (for example, via a survey, questionnaire, or in evidence submitted for our advocacy or Inquiry work), and we rely on:

  • Your explicit consent, given at the point of providing the information; and/or

  • Substantial public interest, under the safeguarding and equality conditions in the Data Protection Act 2018, given CVF's role in representing Clinically Vulnerable people in matters of public policy and the UK Covid-19 Inquiry.


Where we publish quotes, statistics, or testimony drawn from this data — including in Inquiry submissions, reports, or public campaigning — we anonymise it unless you have specifically agreed to be identified.


5. Who we share data with

We may share data with:

  • Our legal representatives (including counsel instructed in connection with the UK Covid-19 Inquiry), where necessary for CVF's Core Participant work.

  • Service providers who process data on our behalf, such as our website host, email platform, and (if used) survey tools. [List actual providers — likely includes Wix, and any of: Mailchimp, Google Forms, Google Analytics, Facebook/Meta.]

  • The UK Covid-19 Inquiry, where evidence has been submitted for that purpose.

  • Regulators or authorities, where we are legally required to do so.
     

We do not share your personal data with third parties for their own marketing purposes.


6. International transfers

Some of the service providers we use (for example, our website host and email or analytics tools) may store or process data outside the UK, including in the United States. Where this happens, we rely on the provider's own compliance with UK-approved safeguards (such as the UK Extension to the EU-US Data Privacy Framework or Standard Contractual Clauses). You can ask us for more detail about any specific transfer.


7. Cookies

Our website may use cookies to help it function and to understand how visitors use it. Where cookies are not strictly necessary for the site to work, we will ask for your consent via a cookie banner before they are set. You can manage or withdraw cookie consent at any time via your browser settings or our cookie preference tool [confirm this exists on the Wix site — if not, one should be added].
 

8. How long we keep your data

  • Contact form enquiries: retained for [X months/years], then deleted.

  • Newsletter subscriber data: retained until you unsubscribe.

  • Survey and evidence data used in advocacy or Inquiry submissions: retained for as long as relevant to CVF's ongoing advocacy work and the Inquiry process, after which it will be reviewed and deleted or fully anonymised.

  • Donation records: retained as required for financial and accounting compliance (typically 6 years).

[These are suggested defaults — please confirm actual retention practice so the figures are accurate.]
 

9. Your rights

Under UK GDPR, you have the right to:

  • access the personal data we hold about you;

  • have inaccurate data corrected;

  • ask us to delete your data, in certain circumstances;

  • object to or restrict our processing of your data;

  • withdraw consent at any time, where we rely on consent;

  • data portability, where relevant.
     

To exercise any of these rights, contact us at [email address]. We will respond within one month, as required by law.


If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113.


10. Changes to this policy

We may update this policy from time to time. The date at the top shows when it was last revised. We encourage you to check back periodically.
 

Clinically Vulnerable Families CIC, company number 16022972. Registered office: 49 Park Farm Avenue, Fareham, England, PO15 6LH.

bottom of page