Data Protection and Privacy.

1. About BASRaT and this policy

The British Association of Sport Rehabilitators and Athletic Therapy Ltd, known as BASRaT, is responsible for deciding how and why the personal information described in this policy is used. For these purposes, BASRaT is the data controller.

We process personal information to maintain our Accredited Register, protect the public, administer membership, provide education and professional development activities, and operate our organisation.

This policy explains what information we collect, how we use it, who we share it with, how long we keep it and your rights. It applies to information held electronically, on paper and by service providers acting on our behalf.

We comply with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other applicable data protection and electronic communications legislation, as amended.

Contact details

BASRaT
c/o Merseyway Innovation Centre
21–23 Merseyway
Stockport
Greater Manchester
SK1 1PN

Telephone: 0330 133 2123
General enquiries: administration@basrat.org

For questions about this policy, requests concerning your information or data protection complaints, contact:

Oliver Coburn, Data Protection Officer
Email: registrar@basrat.org
Post: At the address above, marked for the attention of the Data Protection Officer.

2. Our approach to personal information

We take reasonable steps to ensure that personal information is:

• used lawfully, fairly and transparently;

• collected for clear purposes and used consistently with those purposes;

• limited to what is necessary;

• accurate and kept up to date where needed;

• retained only for as long as necessary; and

• protected against unauthorised access, disclosure, loss or damage.

We are accountable for how we use personal information and consider privacy when developing or changing our services, systems and processes.

3. Whose information we collect and what it includes

We process information about applicants, current and former registrants and members, people raising concerns, witnesses, patients and others involved in regulatory matters, event participants, subscribers, professional contacts, job applicants, employees and people working with us.

Depending on your relationship with BASRaT, this may include:

• Identity and contact information: your name, contact details, date of birth, location and information needed to verify your identity.

• Registration and membership information: registration number, membership category, status and history, qualifications, references, employment information, declarations and professional development records.

• Financial information: fees, payments, invoices, payment references and information needed to administer payment arrangements.

• Regulatory and complaints information: concerns, correspondence, statements, evidence, investigation records, decisions, sanctions and appeals.

• Education and event information: bookings, attendance, participation, feedback, certificates and communications preferences.

• Meeting and webinar information: participant details, attendance records, contributions, messages and, where applicable, recordings or transcripts.

• Employment and governance information: applications, references, contractual information and records relating to work undertaken for BASRaT.

• Website and technical information: information submitted through online forms, IP addresses, device or browser information and information collected through cookies or similar technologies.

Some information requires additional protection. This includes health information and other special category data, and information about criminal allegations, convictions or offences. We collect and use this information only where it is relevant and legally permitted.

4. Where information comes from

We usually receive information directly from you, including through applications, renewals, correspondence, online forms, event bookings and participation in our activities.

We may also receive relevant information from education providers, referees, employers, other regulators or professional bodies, complainants, witnesses, healthcare providers, insurers, public authorities and publicly available sources.

For example, we may verify a qualification with an education provider or obtain evidence from another organisation when considering a fitness to practise concern.

Where information comes from another source, we provide the privacy information required by law, unless a lawful exception applies.

5. Why we use information and our lawful bases

We identify the lawful basis appropriate to each purpose. The same information may be needed for more than one purpose.

Public task

We rely on Article 6(1)(e) of the UK GDPR where processing is necessary to carry out our public protection functions as an Accredited Register.

These functions include assessing eligibility for registration, maintaining an accurate register, monitoring compliance with professional standards, investigating fitness to practise concerns, making regulatory decisions and publishing proportionate information to protect the public.

Our reliance on public task reflects our recognised role within the Professional Standards Authority’s statutory Accredited Registers framework and the legal advice obtained by BASRaT. It does not mean that BASRaT is a statutory regulator.

Consent is not the basis for this necessary regulatory processing.

Contract

We rely on Article 6(1)(b) where processing is necessary to enter into or perform a contract with you. This may include administering membership services, paid bookings, purchases or employment arrangements.

Legal obligation

We rely on Article 6(1)(c) where processing is necessary to comply with a legal obligation, including relevant employment, taxation, accounting and data protection requirements.

Legitimate interests

We rely on Article 6(1)(f) for appropriate organisational activities, such as handling routine enquiries, maintaining professional relationships, managing suppliers, protecting our systems and establishing or defending legal claims.

We consider whether the processing is necessary and balance our interests against your rights and reasonable expectations. We do not use this basis for processing undertaken in the performance of our public tasks.

Consent

We rely on Article 6(1)(a) where you have a genuine choice about the use of your information. This includes subscriptions to optional external email communications about education, CPD and webinars, and consent-based participation in optional online activities.

Consent is specific to the purpose explained when it is requested. You may withdraw it at any time. Withdrawal does not affect the lawfulness of processing before withdrawal.

Special category and criminal offence information

In addition to an Article 6 lawful basis, we identify the additional legal condition required for special category or criminal offence information.

For regulatory work, this may include processing necessary for reasons of substantial public interest under Article 9(2)(g), together with the relevant condition in Schedule 1 of the Data Protection Act 2018, including protecting the public against dishonesty, malpractice, unfitness or incompetence.

Other relevant conditions may apply to employment obligations or legal claims. Criminal offence information is processed only where authorised under Article 10 and applicable UK law.

We apply the additional safeguards required for the relevant condition, including an Appropriate Policy Document where required.

6. Registration, membership and public information

We use registration and membership information to assess applications, verify eligibility, administer renewals and services, monitor standards, maintain accurate records and communicate with you.

Where information is necessary for registration, membership or a service, we explain this when collecting it. If you do not provide necessary information, we may be unable to assess an application, maintain your registration or provide the requested service.

Public Register Check

Our public Register Check allows people to verify professional registration. It displays relevant information, including a registrant’s name, registration number, registration status, town or city, and applicable published fitness to practise information.

Where registration has lapsed or a person has withdrawn at their own request, their previous registration status remains visible for two years. After this period, they no longer appear in a standard public Register Check search.

Removal from public search results does not mean that BASRaT deletes the underlying registration history. We may retain information needed to verify previous registration, assess future applications, address regulatory concerns or meet other justified requirements.

Suspensions, removals and fitness to practise information are subject to the applicable regulatory and publication policies. The two-year rule for lapsed and voluntarily withdrawn registrations does not determine how long disciplinary information is published.

Optional clinic listings

Where you provide professional or business details for an optional public clinic listing, we use those details to operate the listing and make clear which information will be publicly visible.

You can contact us to update or remove an optional listing. This is separate from the publication of information necessary for our public protection functions.

7. Concerns, complaints and fitness to practise

We use information to assess and investigate concerns, obtain evidence, communicate with those involved, make decisions, manage hearings and appeals, and take appropriate action to protect the public.

Information may be shared with the registrant concerned, witnesses, investigators, panel members, advisers or other relevant organisations where necessary.

If you raise a concern, we will normally need to disclose its substance and may need to disclose your identity to enable a fair investigation. We consider requests for confidentiality, but cannot promise that information will remain anonymous or confidential in every circumstance.

We publish information about proceedings and outcomes in accordance with the applicable publication policy, considering public protection, fairness and privacy.

8. Education, webinars, meetings and email communications

We use information to organise education and CPD activities, manage participation, send joining instructions, record attendance, provide certificates and respond to enquiries.

Optional email subscriptions

External subscriptions to our education, CPD and webinar email communications are based on consent. You can unsubscribe using the link in our emails or by contacting us.

Unsubscribing from optional communications does not prevent us from sending necessary messages about an existing booking, registration, membership or regulatory matter where another lawful basis applies.

We may retain a minimal suppression record to ensure that we respect your preference not to receive further marketing.

Online participation and recordings

We use online platforms to deliver webinars and hold meetings. Depending on the activity and features used, information may include your name, email address, attendance, messages, questions and contributions.

For optional activities where we rely on consent, we explain the proposed use of your information when you register or participate. Necessary administration of a paid booking or records of regulatory or organisational meetings may rely on another lawful basis described in section 5.

Where a session will be recorded or transcribed, we explain this beforehand, including the intended purpose and audience, and obtain consent where required. Consent to receive emails does not automatically constitute consent to appear in a recording or to its wider publication.

Email engagement information

Where email engagement tracking is used, we explain the information collected and its purpose and obtain consent where required. This may include information about email delivery, opening messages and following links.

9. Sharing information with other organisations

We share personal information only where there is a lawful and necessary reason.

Depending on the circumstances, recipients may include:

• education providers, referees and employers involved in verifying information;

• other regulators, professional bodies and public authorities;

• investigators, panel members, legal advisers and other professionals supporting regulatory work;

• the Professional Standards Authority in connection with accreditation and oversight;

• insurers, insurance administrators and payment providers;

• organisations supporting our employment, accounting, governance or operational functions; and

• courts, tribunals, police or other bodies where disclosure is required or otherwise legally justified.

We limit disclosures to relevant information and use appropriate security, confidentiality and contractual arrangements. Where another organisation determines its own purposes for processing, it is responsible for that processing under its own privacy information.

We do not provide your personal information to other organisations for their own unrelated marketing.

Public disclosures through the register, clinic listings and regulatory publications are explained separately in this policy.

10. Technology and service providers

We use external providers to support our work. These include providers of:

• registration, membership and database systems;

• website hosting, online forms and website functionality;

• email, document storage and office collaboration;

• email distribution and subscription management;

• online meetings, webinars and event administration;

• payment processing, IT support, security and backup services.

Examples include Fortesium’s Regulator Smart, which supports our registration and membership systems and public register; Squarespace, which hosts our website; Google Workspace, used for email and collaboration; Zoom, used for webinars and meetings; and Mailchimp, used for subscribed email communications, particularly education, CPD and webinar updates.

These examples are not an exhaustive supplier list. We may change providers while continuing to use information for the purposes described in this policy.

Where a provider acts as our data processor, it must process information under our instructions and an appropriate data processing agreement. We assess relevant security, confidentiality, deletion and international transfer arrangements.

Some providers also process limited information for their own purposes, such as account administration, security or compliance with legal obligations. Their privacy information explains those activities. This does not replace BASRaT’s responsibility for its own use of your information.

We provide additional privacy information where a particular service or material change requires it. You can contact us for information about providers relevant to your data.

11. International transfers

Some service providers or organisations we work with may process personal information outside the UK, including through overseas hosting or support access.

Where the UK’s international transfer rules apply, we ensure that a valid transfer mechanism is in place. Depending on the circumstances, this may include UK adequacy regulations or approved contractual safeguards, such as the UK International Data Transfer Agreement or UK Addendum, supported by the required assessment.

We do not treat your agreement to use a service as a substitute for meeting international transfer requirements.

You can contact the Data Protection Officer for information about transfers affecting your information and to request a copy of relevant safeguards, subject to appropriate redaction of confidential information.

12. Security and privacy by design

We use technical and organisational measures appropriate to the nature of the information and the risks involved. These include controlling access, managing permissions, maintaining confidentiality, providing staff guidance and using appropriate security arrangements for storage and transfer.

We consider privacy when selecting systems and changing processes, and carry out data protection impact assessments where processing is likely to create a high risk to individuals.

We assess suspected personal data breaches and notify the ICO and affected individuals where the law requires us to do so.

Our Cookie Policy provides further information about cookies and similar technologies used on our website. Where consent is required, it is requested before those technologies are used.

13. Automated processing and decisions

We use systems to support administration, communications and the presentation of register information.

We do not make decisions producing legal or similarly significant effects on individuals solely through automated processing without meaningful human involvement.

If we introduce such decision-making, we will provide the required information and safeguards, including applicable rights to human intervention and to challenge a decision.

14. How long we keep information

We keep personal information only for as long as necessary for the purpose for which it is held. Different information requires different retention periods.

When deciding how long to retain information, we consider:

• whether it is needed to provide an ongoing service or maintain registration or membership;

• its relevance to public protection, regulatory decisions, future applications or subsequent concerns;

• legal, accounting, employment and insurance requirements;

• the need to deal with complaints, appeals, investigations or legal claims;

• the sensitivity of the information and the effect of continued retention on the individual; and

• whether the purpose can be met by retaining less information or anonymising it.

Registration and regulatory records: We may retain core registration history and significant regulatory decisions after registration ends or a case closes where necessary to verify previous status, assess future eligibility, understand subsequent concerns or demonstrate how a decision was reached. This does not mean that every supporting document is kept indefinitely.

Routine enquiries and administration: We retain information while dealing with the matter and for a proportionate subsequent period where needed for follow-up, accountability or potential disputes.

Education and events: Booking, attendance and certification information is retained for relevant administration, evidence of participation and any applicable financial or legal requirements. Recordings and transcripts are retained while needed for their stated purpose.

Email subscriptions: We retain active subscription information while the subscription continues. Following withdrawal, we remove it from active mailing lists, subject to retaining limited evidence of consent and suppression information where necessary.

Employment and financial records: Retention reflects the applicable legal requirements and justified employment, accounting, insurance or claims purposes.

We review continued retention and securely delete or anonymise information that is no longer needed. Relevant information may be retained for longer while a complaint, investigation, legal claim or other documented requirement remains ongoing.

Information remaining in backups after deletion from active systems is protected from routine use and removed through the applicable backup replacement or deletion cycle.

Public display is considered separately from internal retention. The register publication rules are explained in section 6.

You can contact the Data Protection Officer for the retention period or criteria applicable to a particular record.

15. Your rights

Depending on the circumstances and the lawful basis for processing, you may have the right to:

• receive information about how your personal information is used;

• access your information and receive a copy;

• have inaccurate information corrected;

• request erasure;

• request restriction of processing;

• object to processing based on public task or legitimate interests;

• receive certain information in a portable format where processing is automated and based on consent or contract; and

• withdraw consent where processing relies on it.

You have an absolute right to object to the use of your information for direct marketing.

Other rights are subject to conditions and lawful exceptions. For example, we may need to retain information for necessary regulatory work, legal obligations or legal claims. We consider requests individually and explain any applicable limitation.

You can make a request verbally or in writing. You do not need to use a particular form. Contacting the Data Protection Officer will help us direct your request.

We respond without undue delay and normally within one calendar month. Where the law permits an extension, or requires identity verification or clarification affecting the response period, we explain this. Requests are normally free; any refusal or fee must have a lawful justification.

Registrants and members can also update relevant account details through the member portal.

16. Data protection complaints

If you are concerned about how we have used your information, please contact the Data Protection Officer using the details in section 1. You can complain by email, telephone or post.

We acknowledge data protection complaints within 30 days, investigate and respond without undue delay, and keep you informed of progress where necessary.

You also have the right to complain to the Information Commissioner’s Office:

Website: ico.org.uk/make-a-complaint
Telephone: 0303 123 1113
Address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.

17. Changes and accessible information

We review this policy and update it when necessary. The latest version is published on our website with its update date.

Where a material change affects how we use your information, we provide further information and seek fresh consent where required before introducing that use.

For this policy in another format, or help understanding it, contact administration@basrat.org or telephone 0330 133 2123.