Report and Support Privacy Notice 
 
Our contact details 

Name: Medical Research Council/Uganda Virus Research Institute & London School of Hygiene and Tropical Medicine (MRC/UVRI&LSHTM)

Address: Plot 51-59 Nakiwogo Road Entebbe, P. O. Box 49, Entebbe, Uganda 

LSHTM website: www.mrcuganda.org 

Report and Support website: www.reportandsupport.mruganda

Email address for any concerns related to this Privacy Notice: dpo@lshtm.ac.uk 

Date Privacy Notice completed: 12/08/22 
 

The type of personal information we collect 

We currently collect and process the following information:

If you choose to report with contact details:
  • Your name
  • Your email address
  • Gender
  • Age
  • Special category personal data if you choose to disclose it (e.g. ethnicity, health and disability data)
  • Details related to the incident being reported 

 If you choose to submit an anonymous report:
  • Any personal data disclosed within the report- you can find a list of what constitutes personal data on the Information Commissioner’s Office website.
  • Gender
  • Age
  • Special category personal data if you choose to disclose it (e.g. ethnicity, health and disability data)
  • Details related to the incident being reported 

Please note; Any disclosures related to an individual’s criminal or past convictions will be removed before the report is processed.
 
 
How we get the personal information and why we have it
  
Most of the personal information we process is provided to us directly by you for one of the following reasons:
  • You have completed a report with contact details, which has included personal information
  • You have completed an anonymous report and have disclosed personal information in the free text box when disclosing your report

We also receive personal information indirectly, from the following sources in the following scenarios:
  • If you have been named in a report, we may capture personal information related to you, even though you did not disclose it to us directly

We use the information that you have given us in order to:
  • Act on reports if follow up action has been requested (e.g. formal disciplinary procedures)
  • If requested, connect the responding party with support resources, which may include internal resources, such as counselling services, Anti-Bullying and Harassment Advisors, Mental Health First Aiders or HR
  • Monitor the frequency of different types of incidents and develop appropriate policies and interventions to minimise these types of incidents occurring in the future
  • Engage emergency procedures, as per Safeguarding Policy, if a safeguarding risk has been disclosed- including if anyone appears to be in imminent danger.

 
Report and Support System Administrators (from the EDI Team, within MRCUganda) may share this information with:
  • A member of MRCUganda staff assigned as an ‘Advisor’ if a case is assigned to them
  • The relevant departments involved in the administration of formal or informal HR processes under existing MRCG at LSHTM policies and procedures (for example and not exclusive to: bullying and harassment or grievance procedures)
  • The reported party, and any other witnesses named (if applicable), if non-conflict based resolution or disciplinary action arises as a result of a report
  • Law enforcement if a safeguarding risk or imminent danger to the reporting party, reported party or any other individual has been disclosed
 
Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:
  • Your consent - This is given when you submit a report. You can remove your consent at any time. You can do this by contacting reportandsupport@mrc.ug or dpo@lshtm.ac.uk
  • We have a legitimate interest - Details disclosed in your report may be used to understand trends of behaviours or incidents. This data may be used to develop policies, procedures or interventions.
 
How we store your personal information
 
Your information is securely stored in Culture Shift’s servers while in the Report and Support system. Any data that is downloaded is then stored securely within the EDI Team and can only be viewed by members of the EDI Team. However, if formal or informal HR processes are started as a result of a report submitted through Report and Support, staff from those teams will gain access to the details of the report on a need-to-know basis.
 
We keep active reports within Report and Support for a maximum of one year after the report is closed before downloading into the EDI Team’s local drive for another two years, in case a case needs to be revisited or reopened. After this point, reports will be anonymised and aggregated with all personal data permanently deleted.
 
 
 
Your data protection rights
  
Under data protection law, you have rights including:
  • Your right of access - You have the right to ask us for copies of your personal information. 
  • Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. 
  • Your right to erasure - You have the right to ask us to erase your personal information if you withdraw your report and so there is no need to continue processing your data or if you have objected to your data being processed through legitimate interests and there are no overriding legitimate interests to continue processing your data.
  • Your right to restriction of processing - You have the right to ask us to restrict the processing if you are considering withdrawing your report or want to check the accuracy of your data before your report can continue. 
  • Your right to object to processing - You have the right to object to the processing of your personal information if your personal data is being processed through legitimate interests.
You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
 
Please contact us at reportandsupport@mrc.ug or DPO if you wish to make a request.
 
 
How to complain
  
If you have any concerns about our use of your personal information, you can make a complaint to us at dpo@lshtm.ac.uk
  
You can also complain to the ICO if you are unhappy with how we have used your data. In communications with the ICO, you can refer to LSHTM’s Data Controller ID: Z7513362 
 
The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
  
Helpline number: 0303 123 1113
  
ICO website: https://www.ico.org.uk 

There are two ways you can tell us what happened

Report anonymously or Report with contact details