Clinically Vulnerable Families CIC (“CVF”, “we”, “us”, “our”) is committed to protecting your privacy. This policy explains what personal data we collect, why, how we use it, and your rights.
Clinically Vulnerable Families CIC is a Community Interest Company registered in England and Wales, company number 16022972.
CVF is registered with the Information Commissioner’s Office, registration reference ZB887575.
Last updated: 12th October 2026
1. Who we are and how to contact us
If you have any questions about this policy or how we handle your data, you can contact us using our contact form. We do not currently have a formal Data Protection Officer given our size; our Directors are the contact point for data protection matters.
2. What personal data we collect
Depending on how you interact with us, we may collect:
- Contact details — name, email address, and any information you provide via our contact or sign-up forms.
- Membership and community data — Our primary community is hosted via a Facebook support group. If you join that group, the information you provide is submitted to and stored by Facebook/Meta, and is governed by Facebook’s own privacy policy and terms — not this one. We do not control, and are not responsible for, how Facebook processes that data. Where you separately register interest in CVF’s work directly with us (for example, via a form on this Site), that information is handled by us as described in this policy.
- Survey and questionnaire responses — including information about your own or a household member’s clinical vulnerability, health condition, or disability, where you choose to share this with us (see Section 4 on special category data below).
- Evidence and testimony — accounts, experiences, or statements you provide for use in our advocacy work or submissions to the UK Covid-19 Inquiry, where you have agreed to share these.
- Journalist access requests — if you ask for access to our media area, your name, work email address, outlet, role and any link you give us.
- Technical data — standard website usage data collected automatically when you visit our site, and anonymous visit statistics that do not identify you (see Section 7, Cookies and website statistics).
- Donation and payment data — if you donate to CVF, limited payment-related data processed via our payment provider (we do not store full card details ourselves).
We do not knowingly collect data from children under 16 without appropriate parental involvement. If our forms ask about a household, a parent or guardian should complete this on behalf of any child members.
3. How we use your data, and our legal basis
| Purpose | What data | Legal basis |
|---|---|---|
| Responding to enquiries | Contact details, message content | Legitimate interests |
| Sending our newsletter | Name, email address, and when and how you signed up and confirmed (including the IP address used) | Consent (withdrawable at any time) |
| Running surveys and gathering evidence for advocacy and research | Survey responses, including health-related information you choose to share | Explicit consent, and substantial public interest |
| Preparing submissions to the UK Covid-19 Inquiry | Anonymised or, where agreed, attributed testimony | Substantial public interest / legal obligation as a Core Participant |
| Processing donations, sending receipts and managing monthly gifts | Payment and contact details | Contract / legitimate interests |
| Keeping donation records for our accounts | Name, email, billing address, amount, date and type of donation | Legal obligation (company and tax record-keeping) |
| Managing journalist access to our media area | Name, work email, outlet, role | Legitimate interests |
| Understanding how our website is used, so we can improve it | Anonymous visit statistics: pages viewed, time on page, the website that referred the visit, device and browser type, approximate country, search words and actions such as downloads (no names, internet addresses or cookies) | Legitimate interests |
| Keeping our website secure and working | Technical data, such as server logs | Legitimate interests |
4. Special category data (health information)
Because CVF’s purpose relates to clinical vulnerability, some of the information people share with us — about their own or a household member’s health condition, disability, or immunocompromised status — is “special category data” under UK GDPR, which receives extra legal protection.
We only collect this information where you have chosen to provide it (for example, via a survey, questionnaire, or in evidence submitted for our advocacy or Inquiry work), and we rely on:
- Your explicit consent, given at the point of providing the information; and/or
- Substantial public interest, under the safeguarding and equality conditions in the Data Protection Act 2018, given CVF’s role in representing Clinically Vulnerable people in matters of public policy and the UK Covid-19 Inquiry.
Where we publish quotes, statistics, or testimony drawn from this data — including in Inquiry submissions, reports, or public advocacy — we anonymise it unless you have specifically agreed to be identified.
5. Who we share data with
We may share data with:
- Our legal representatives (including counsel instructed in connection with the UK Covid-19 Inquiry), where necessary for CVF’s Core Participant work.
- Service providers who process data on our behalf: our website host; Zoho (email); Stripe (donations: card, Apple Pay and Google Pay payments, receipts, and letting monthly donors manage their gift); Cloudflare Turnstile (a privacy-friendly check on the donate page that the visitor is a person, not a bot; it does not use advertising cookies or track you across sites); Google Forms (surveys); and MailPoet (our newsletter software, which keeps subscriber details on our own website and delivers our emails through its sending service).
- The UK Covid-19 Inquiry, where evidence has been submitted for that purpose.
- Regulators or authorities, where we are legally required to do so.
We do not share your personal data with third parties for their own marketing purposes.
6. International transfers
Some of the service providers we use (for example, our email or analytics tools) may store or process data outside the UK, including in the United States. Where this happens, we rely on the provider’s own compliance with UK-approved safeguards (such as the UK Extension to the EU-US Data Privacy Framework or Standard Contractual Clauses). You can ask us for more detail about any specific transfer.
7. Cookies and website statistics
We only use cookies that are strictly necessary. Our website does not use analytics, advertising or social media tracking cookies, so we do not ask you to accept cookies.
When you donate, our payment provider Stripe sets cookies on the donation page to process your payment securely and prevent fraud. If you log in to our media area, a cookie keeps you logged in. These cookies are strictly necessary for the service you have asked for.
Website statistics. We count visits to our website with our own privacy-friendly statistics, kept on our own server. They use no cookies and store nothing on your device, and we do not record your name, your internet (IP) address or anything else that identifies you. Each visitor is counted using a code that changes every day, so we cannot follow anyone from one day to the next. Alongside that, we record which pages are viewed and for roughly how long, which website referred the visit, the type of device and browser, an approximate country worked out from your device’s time zone, the words typed into our search boxes, and actions such as downloading a report or drafting a letter with one of our tools. The text of any letter you draft stays on your device and is never sent to us. If your browser sends a “Do Not Track” signal, we do not count your visit. Statistics are deleted after 13 months.
Our newsletter. We do not track whether you open our emails or which links you click. Links in each newsletter carry the name of that issue, which is the same for everyone who receives it, so our website statistics can count how many visits each newsletter brings without knowing who made them. At the end of each story there is a “This helped me” button. Pressing it adds one to an anonymous count for that story, which only we can see; we do not record who pressed it, and nothing is stored on your device.
Videos. Some of our stories include YouTube videos. We use YouTube’s privacy-enhanced mode, so YouTube does not store information on your device unless you play a video. If you do, YouTube’s own privacy policy applies.
Press coverage pictures. The pictures shown with press coverage on our News page are copies kept on our own server and credited to the outlet, so your browser does not contact the outlet’s website unless you choose to read the article there.
If we ever add cookies that are not strictly necessary, we will ask for your consent before they are set. You can delete cookies at any time in your browser settings.
8. How long we keep your data
- Contact form enquiries: kept only as long as needed to respond to you and keep a record of our correspondence, then deleted. A copy of each message is also kept on our website, where it is deleted automatically six months after it arrives.
- Website statistics: anonymous, and deleted after 13 months.
- Newsletter: until you unsubscribe, which you can do at any time using the link in every email. Every two years we ask you to confirm that you still want to hear from us; if you do not reply within 30 days, we remove you and delete your details. We keep a dated record of your consent, with your email address stored only in a coded (one-way) form, so that we can show we had your permission.
- Journalist access details: retained while your access is active, and deleted or anonymised when you ask us or when we stop using the media area.
- Survey and evidence data used in advocacy or Inquiry submissions: retained for as long as relevant to CVF’s ongoing advocacy work and the Inquiry process, after which it will be reviewed and deleted or fully anonymised.
- Donation records: kept for 6 years after the end of the financial year the donation was made in, as UK company and tax law requires, then deleted. We use them only for our accounts, not for marketing.
9. Your rights
Under UK GDPR, you have the right to:
- access the personal data we hold about you;
- have inaccurate data corrected;
- ask us to delete your data, in certain circumstances;
- object to or restrict our processing of your data;
- withdraw consent at any time, where we rely on consent;
- data portability, where relevant.
To exercise any of these rights, use our contact form. We will respond within one month, as required by law.
If you are unhappy with how we have handled your data, you have the right to complain to the Information Commissioner’s Office (ICO) at ico.org.uk or by calling 0303 123 1113.
10. Changes to this policy
We may update this policy from time to time. The date at the top shows when it was last revised. We encourage you to check back periodically.
Clinically Vulnerable Families CIC, company number 16022972. Registered office: 49 Park Farm Avenue, Fareham, England, PO15 6LH.