Privacy Notice and Use of Cookies

We can only achieve our vision of a world free from the pain, fatigue and isolation of arthritis with your help. Your ongoing support is invaluable to us and to the millions of people across the UK living with arthritis. That’s why taking good care of your personal information and treating it with respect is so important.

Personal data helps us to better understand our donors, beneficiaries and supporters. This in turn allows us to make our decisions, services, fundraising and information the best they can be and to do more to help people with arthritis to live full and active lives.

Being open and transparent about how and why we do things is central to our values as a charity. So, we’ve produced this privacy notice to explain how, why and when we collect and use your personal information and how we keep it safe and secure.

Before we move on to the detail below, here is our promise to you.

  • We will respect your personal details and keep them safe and secure.
  • We will never sell or exchange your information with another organisation for their own use.
  • We will not send you information you have not asked for or agreed to receive.
  • We will respond quickly if you ask us to change your details, stop using your information or if you no longer want to hear from us.
  • We will be clear about how and why we will use your personal information when we collect your details.

Asking for your consent

Sometimes we will ask for your consent directly, for example when we are processing a donation or when you sign up for a service or event.  At other times your consent may be clear from the nature of your contact with us, for example if you email us with a question you are giving consent for us to reply.

We will be happy to answer any questions you have about how Arthritis Research UK and its trading company store and use your personal information. Just get in touch by calling 0300 790 0400 or email us at We can also change your details or deal with requests for us to stop using data or sending marketing communications.

Who We Are

In this privacy notice, “we” means Arthritis Research UK and Arthritis Research UK Trading Limited.  On 1 November 2017, Arthritis Research UK and Arthritis Care joined together to help more people with arthritis to live full and active lives. This means all data collected by or passed to Arthritis Care before and after that date will be managed by Arthritis Research UK as set out in this document.

Arthritis Research UK is a charity registered in England and Wales (number 207711) and in Scotland (SC041156), and a company incorporated in England and Wales (number 490500). Its registered address is Copeman House, St. Marys Court, Chesterfield, Derbyshire, S41 7TD.

Arthritis Research UK Trading Limited is a company incorporated in England and Wales (number 891517). Its registered address is Copeman House, St. Marys Court, Chesterfield, Derbyshire, S41 7TD. It is a wholly owned subsidiary of Arthritis Research UK, trading on behalf of Arthritis Research UK, to raise funds for the charity’s work.

Changes to this privacy notice

We will regularly review this privacy notice. Any significant changes will be published on our websites or we will contact you directly.

Your Rights

At Arthritis Research UK we take your rights very seriously.  You can ask us to delete copies of your personal data, stop particular activities, withdraw a consent you have given previously or challenge the results of any decisions or profiling.  We will fulfil all requests, providing there are no legal and accounting requirements that stop us from doing so.  If you are sure you don’t want to hear from us, either now or in the future, you can ask us to hold a record which will prevent us from contacting you.   This may be more effective than completely removing your data.  Please contact us at or call 0300 790 0400 to discuss any concerns.

You have a right to ask for a copy of the information we hold about you.  This can be provided in a machine-readable format for transfer elsewhere. To access your information, please send a description of the information you want to see and proof of your identity by post to Arthritis Research UK, Copeman House, St Marys Court, Chesterfield, Derbyshire, S41 7TD. We cannot accept these requests by email as we want to guarantee that we only provide personal data to the right person.

If you discover that we are holding incorrect information about you, please let us know and we will correct this.

If you are not happy about how your data is managed, and wish to make a complaint, please contact us at or call 0300 790 0400. If you are unhappy with how a complaint is handled, contact the Information Commissioner’s Office (ICO). You may contact the ICO without first making a complaint to us. You can find more information about the ICO and your rights on their website.

How we keep your data safe

We use appropriate technical controls to protect your personal details. For example, our online forms are always encrypted and our network is protected and routinely monitored.

If you use a debit or credit card to make a donation or buy online or over the phone, we or our contracted suppliers will manage the transaction securely in line with the PCI DSS standards. All credit and debit card details are securely destroyed once the payment or donation has been processed.

Regular reviews ensure your personal information is only accessible by appropriately trained staff, volunteers and contractors.

We regularly update our systems and IT services and have a legitimate interest to do so. We move data between systems and use data for verification and management.  We also run administrative data processing activities to ensure data is correct and accurate.  We use specialist ICT service providers for this and some data may be stored in the cloud.

We sometimes use external companies to collect or process personal data on our behalf. We do comprehensive checks on these companies before we work with them and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they have collected or have access to.

Your personal information may be transferred to, and stored at, a destination outside the European Economic Area (EEA) and may be processed by staff operating outside the EEA who work for us or for our suppliers. We will ensure that your information is held in compliance with the European data protection regulations.

We will only share your details in exceptional circumstances. This could be if we are under a duty to disclose your personal information to comply with any legal obligation (for example to government bodies and law enforcement agencies), where we have good reason to believe that a person’s vital interests are at stake (for example where a child reports abuse or someone reports serious self-harm or intends to harm someone else) or to enforce or apply our rights or to protect the organisation.

We will only ever share your data in other circumstances if we have your informed consent.

We keep records for as long as legal requirements and tax and accounting rules demand. We retain contact details for both marketing and suppression purposes until a request is made to remove information. We may also keep internal records of any contact with you indefinitely. Where your information is no longer required, we will ensure it is disposed of in a secure manner.

Children’s data

Any information collected from or about children will be managed in a way appropriate to the age of the child. This information is usually collected when children attend our events or fundraise for us, but it can also be sensitive personal data about children who are receiving support from our Young People and Families service.

Wherever possible and appropriate we will seek consent from a parent or guardian before collecting information about children and we will make sure advertising for events is age appropriate.

How we collect information about you

  • When you give it to us directly

You may give us your details when you fundraise for us or generously donate, receive support from our services including helplines, volunteer with us, join one of our networks, enter our raffle or lottery, order an information booklet, tell us your story, make a donation, purchase our products or communicate with us. Sometimes your information is collected by an organisation working for us, for example a professional fundraising agency, but we take responsibility for your data at all times.

We will collect and process all the information you give us, as well as responses given to you by our staff or the Arthritis Virtual Assistant. This may include sensitive personal data where you volunteer this information.

We may also collect and retain your information if you send feedback about our services or make a complaint.

  • When you use our websites

When you visit our websites, information about your visit is recorded and stored on your own computer, using cookies. Cookies are text files which identify your computer to our server. Cookies in themselves do not identify the individual user, just the computer used. You can find more information on how we use cookies below. Beyond this you will remain anonymous unless you log in.

When you log in and browse Arthritis Research UK’s site, including our online shop, you will remain logged in for 20 minutes after you last access a page or until you log out. You can ask us to keep a record of your favourite content or for our online shop to keep information on recent transactions so we can deal with future queries.

  • When you give it to us indirectly

Your information may be shared with us by independent event organisers, for example the London Marathon or fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so with your consent. Please check the privacy policy of these organisations when you provide your information to understand fully how they will process your data.

Your personal details may also be collected if they are included in other information that is sent to us. For example, if you are named as a third party in an email we receive or you are a co-beneficiary of a legacy request.  In these cases, we will not add your details to our direct records but may keep copies of the information for up to 10 years.

o   When you give permission to other organisations to share your details

Information we get from other organisations may depend on your privacy settings or the responses you give, so please check them regularly. This information comes from the following sources:

Referral by a healthcare professional - many of our services for people with arthritis are accessed following a referral or recommendation by a healthcare professional. Consent to be referred will have been obtained by the healthcare professional.  In these cases, your personal information will be used to identify suitable services, but your consent will be requested before enrolment.

Third party organisations - you may have provided permission for an organisation to share your data with third parties, including charities. For example, when you buy a product or service, register for an online competition or sign up with a comparison site.

  • When you use social media

Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp, LinkedIn, Instagram or Twitter, you might give us permission to access information from those accounts or services.  Where you follow us via social media we will not automatically add you to our own records.  However, if we receive a direct request from you (for example to make a donation, use one of our services or request a booklet) we will treat your details as having been received directly.

We may also obtain and store information about you that is available publicly from third party sources, such as from Companies House or details published in the media.

Your Supporter Record

If you support us, for example sign up to receive regular news and updates, make a donation, volunteer, register to fundraise, sign up for a workshop or an event, lobby or campaign for us or buy something from us, we keep a record of your support.

The law may require us to store information for up to seven years.  Though we know some people will not want us to keep hold of their data indefinitely, keeping a record of past support does help us to maintain and build good relationships with people with an interest in our work.

If you choose to leave us a legacy in your will we will keep a record of you and your pledge indefinitely.  This will help us to manage your wishes when the time comes and ensure the process runs smoothly for your family.

Our standard data retention policy is to keep your personal information for 10 years, from your most recent active support. After this point we will normally remove any information that may identify you personally. However, if you ask us to hold your details to block marketing communications, either directly or via the Fundraising Preference Service, then we must keep a record indefinitely.

We apply a similar 10-year rule to personal data collected as part of our work.  This may include information gathered through legitimate activities via contractors, suppliers or third parties.

If you do not want us to keep a record of your personal information, or want to discuss our data management, then please contact us at or call 0300 790 0400.

How We Use Your Information To:

Run our services

We run services to provide support to people living with arthritis and their families. We collect personal data to provide those services, which include our helplines, online community, information provision and local support sessions.

We will always obtain your consent before sharing information with your GP, orthopaedic surgeon, or other healthcare professional. 


Our helplines collect sensitive personal data about your health when you speak, email or send an instant message to them. We will use this information to answer your questions and give guidance and support. We will also use it for training, quality monitoring or evaluating the services we provide. Your data is kept for a maximum of six months.

The helpline team may pass your information to BUPA so their specialist clinicians can help us assess and answer your query. We will inform you before we consult with BUPA clinicians. Where information, including sensitive data, is passed to BUPA they will store it for a period of 7 years, with access limited to clinicians and appropriate persons. BUPA’s privacy policy can be found here.

Arthritis Virtual Assistant

The Arthritis Virtual Assistant on Arthritis Research UK's website is our interactive advisor which uses the IBM Watson Cognitive Computing platform to answer your questions. It uses the information you share to answer your questions and to improve the answers it gives to others in the future. This is in line with the IBM privacy policy.

The Arthritis Virtual Assistant does not need your personal information and will only ask for your first name. It will not treat your conversations as personal data and you must not provide it with any other personal information which may be used to identify you, for example your address, NHS number and bank details.

Any information you share with the Arthritis Virtual Assistant, including any personal or sensitive information will be transferred to and stored on the IBM Watson platform for up to 90 days.  Arthritis Research UK will retain your information for up to 12 months to help us to analyse the conversations and improve answers.

Volunteer-delivered services

Arthritis Research UK provides a range of services for people with arthritis and their families, many of which are run by volunteers, including:

  • Joint Understanding Peer Support Pilot
  • Living Well with Arthritis
  • Young People and Families Service
  • Staying Connected
  • Working Well with Arthritis.

When you agree to attend an event or workshop or sign up to take part in one of our services we take this as consent for us to manage and retain the personal information we need to deliver the service or event.  For example, we might need to keep and use your personal data to:

  • Keep you informed about the events or services you have signed up to and other similar events and services you might be interested in.
  • Review and evaluate the service to make sure it is relevant and effective
  • Share with our volunteers or with venues we use for our events to ensure everyone can access them and the event happens safely.
  • Maintain waiting lists for over-subscribed services.

We may collect data from people throughout the time they are using our services to help us evaluate if the service is effective and meeting the needs of people with arthritis.

If you use our services, we may contact you for feedback, including asking you to take part in our annual survey. We also monitor our services to ensure they offer equal opportunities.  We will always ask your consent to use special category data, for example information about your health, racial or ethnic origin, political opinions, Trade union membership, religious or philosophical beliefs, sex life or sexual orientation, genetic or biometric data.

If you give us consent, we may share data with an external evaluation company.  We may also share information with co-funders of services where required.

Branches (formerly run by Arthritis Care)

If you join one of our branches we will keep a record of this.  Branches keep their own records and if consent is given will keep members updated about local events and opportunities.

Keep you informed about what we do

We may need to contact you by post, email, telephone or text message about a service you have signed up for or a donation or order you have made.  We will never do so without good reason.  We may also contact you occasionally with critical legal and technical information and updates to this privacy notice.  Wherever possible, we will respect your preferences about how you want us to contact you.

We use specialist suppliers to process and manage communications

Direct Marketing

We want to keep our supporters updated about what we are doing to improve the lives of people with arthritis and explain how you can help. However, we understand not everyone wants to receive these updates.  We only send marketing materials to supporters who want to hear from us, in the ways they want to hear from us. Our forms have clear questions about preferences and all our messages include information on how to opt out.

We will never send a marketing email or text message or make a phone call without your direct consent.  If you have given us your postal address, we may send you direct mail unless you have told us that you don’t want to hear from us in this way.

We may send you information about a range of topics including, but not limited to, the latest news about our services, the research we fund, events you can get involved in, joining one of our branches, volunteering, leaving a legacy, entering a raffle or making a donation and how you can campaign for us.  We always try to make our messages relevant to you, by reviewing how you have supported us in the past.

If you don’t want to hear from us or only want to be kept informed about particular topics, that’s fine. Just let us know when you provide your details, click the “unsubscribe” link in any email we send or contact us at or call 0300 790 0400.  If you opt out, we will keep your details on a suppression list to ensure we don’t contact you in future, unless you tell us otherwise.

We may contact professionals, for example people working in the healthcare industry, at corporate or business addresses directly by any channel, without opt-in consent.  However, we will always offer an opportunity to opt out of receiving marketing materials.

We will send information by email or contact you by phone, for a period of up to two years after you support us with a donation or by taking part in fundraising activity or use one of our services.  We may send information by post for up to five years after an activity.  If we already have your permission to contact you, you will need to ask us to stop sending information rather than simply deciding not to opt in when asked.  At the end of these periods we may contact you to ask if you want to stay in touch.

We will never sell or share your personal details to other organisations for their own use. But we may need to share data to use analytical tools and mailing services provided by suppliers.

Direct marketing is vital to spreading our message and is in our legitimate interest.  For sending marketing by email, SMS and telephone we will obtain your consent first, unless we are clear we are contacting you only in a professional capacity.  For postal marketing we may choose to obtain your consent in place of legitimate interest where we believe it to be fairer.  We will also seek your consent before contacting you via social media.  For service and technical communications, we rely on legitimate interest, but will aim to respect your preferences as to whether we contact you by email, phone or post.

You can opt out of all future marketing communications or data processing by making a direct request or registering your preferences through the Fundraising or the Telephone Preference Service. We will then keep your details on a suppression list to ensure we don’t contact you in future, unless you tell us otherwise. 

Public figures and Arthritis Champions

We may collect and keep details about people who publicly express support for our work or an interest in arthritis-related issues. We will also store details of public figures, such as MPs, who are interested in our work.

We use this information to contact people to raise awareness of arthritis and our work, ask for involvement in our campaigns and seek changes to public policy.

Raise vital funds to support our work

Processing donations

When you make a donation or give us permission to claim gift aid, we must collect certain information about you to satisfy our legal obligations under audit and accounting rules.

If you use a debit or credit card to donate to us in person or over the phone, we will ensure this transaction is made securely in line with the PCI DSS standards by us or our contracted suppliers. All credit and debit card details are securely destroyed once the payment or donation has been processed.

Volunteering and participating in events

To meet required standards, we need to keep detailed records about people who volunteer for us or who participate in events.  We ask for your consent during the sign-up process to help us to manage our relationship with you, for example supporting you with sponsorship or managing the process if you need to drop-out for any reason.

If we run an event in partnership with another organisation we may share your details with that organisation.  This will be made clear when you register. You have the right to withdraw your consent for this if you no longer wish to volunteer or participate in the event.

Branches (formerly Arthritis Research UK)

If you join one of our branches we will keep a record of this.  Branches keep their own records of both members and supporters and, if consent is given, will keep them updated about local events and opportunities. If you sign up for training, workshops or other events you give your consent for your data to be used during the administrative process.

Building profiles of supporters

We use categorisation, profiling and screening techniques to ensure our communications to supporters are tailored, relevant and timely. This approach allows us to target our resources effectively, something which we know is important to our donors.  By understanding what engages our existing supporter base we can better target advertising to recruit new supporters.

We may group supporters into categories, to better understand and identify common features.  Some categories may be chosen by the supporter, for example when you become a branch member you give consent for this information to be recorded.  We may create other groups of supporters based on their history or the nature of the relationship they have with us.

When building a supporter profile, we may analyse geographic, demographic and other information relating to you to better understand your interests and preferences. This allows us to contact you with the most relevant communications.  We may add information from third party sources or publicly-available data to your record, for example addresses, job titles, listed directorships or typical earnings in a given area.  We may also pass your information to suppliers who perform profiling and analysis on our behalf.

We believe we have a legitimate interest to do this as building a detailed profile means we can improve the way we communicate with our supporters and will help us to raise more vital funds to help people with arthritis to live full and active lives.  However, we know your privacy matters, so we only undertake profiling and screening where we are confident it would not cause you harm and we regularly review these activities to ensure we always follow best practice.  To discuss our profiling and screening activity in more detail, or to ask to be exempt from these activities, please contact us at or call 0300 790 0400.

When you share personal information about yourself, for example telling us that you have arthritis, you give us consent for profile-building.

Legacy Administration

We receive copies of every will in which we are left a gift. This often contains the personal data of other beneficiaries.  We keep copies of the will in our files in accordance with our retention policy but will not use personal data beyond what is necessary to administer the legacy.

How your personal information is used when you:

Use our website

We use information we collect about your internet browsing to identify your approximate location, to block disruptive or unauthorised use, to record or limit traffic and to improve our site to ensure content is accessible to you. If you enter your details onto an online form, but do not send or ‘submit the form, we may contact you to see if we can help with any problems you may be experiencing with the form..

We also use cookies, as set out in our cookies policy and use third party services to manage and administer our website functionality.

Online Community

The Online Community on Arthritis Care's website asks you to provide your email address when you register and may contact you about administrative issues and changes to the forum. With your consent, we may also use your email address to send you information about our work (see Direct Marketing). Posts to the forum use your chosen username which may let users stay anonymous, but posts often contain sensitive information. We advise users to be careful not to post information which would allow them to be identified. To make the Online Community and our information as helpful as possible, we sometimes use what's written to promote what we do to other people. We'll always do this anonymously, removing any names or identifiable details unless we gain your consent (see Sharing Your Story).

Online shop

When you order via our online shop we must collect certain information about you to process your order and to satisfy our legal obligations under audit and accounting rules.

If you use a debit or credit card the transaction will be processed securely in line with PCI DSS standards by us or our contracted suppliers. All credit and debit card details are securely destroyed once the payment or donation has been processed.

Share your Story

Many people choose to tell us about their experiences with arthritis to help us to raise awareness of the impact of arthritis. This may include sharing sensitive information related to their health and family life, as well as biographical and contact information.

We use some of the information provided, including gender, ethnicity or the type of arthritis people have, to publicise our services, raise the profile of arthritis in the media, fundraise or recruit volunteers and campaigners.

If we have the explicit and informed consent of the individuals, or their parent or guardian if they are under 18, this information may be made public by us at events, in materials promoting our campaigning and fundraising work or in documents such as our annual report.

We will only use photographs with the consent of the person.  We may use photographs to promote our services and activities or to encourage people to support us.

Are a healthcare professional

If you ask for information in your capacity as a healthcare professional or join one of our professional networks, we will mainly use your data to:

  • manage your participation in our professional networks
  • provide you with the information, services or products you asked for
  • administer your organisation’s donation or support fundraising and participation in our activities
  • keep a record of your organisation’s relationship with us and your role in this
  • send you relevant marketing materials (see Direct marketing)
  • understand how we can improve our services, products or information
  • manage your feedback.

As well as your contact details, we will also store details about your role and who you work for. We may also ask for information about your experiences linked to arthritis.

Where one of our service customers provides us with your details as their personal GP or other clinician we have a legitimate interest to store your name on their file and to contact you with their consent.

Have your research funded by us

We store contact details and financial details of researchers and suppliers to manage and process grant applications, grants, contracts and payments.  This includes details of staff and co-researchers/sponsors provided by Principal Investigators.  Where partial information is provided we will complete the details using publicly-available information.

We keep a directory of researchers and suppliers so we can issue future offers.  We may also contact people not in our directory where publicly-available information indicates a grant may be of interest. Grant processing and management in this way is a legitimate interest for Arthritis Research UK.

If you join one of our networks, panels or committees for researchers and reviewers we will use your personal details for administration and to communicate with you.

Work for, or represent, a third-party organisation

If you ask for information in a professional capacity, for example as an employee of a company that supports us or supplies services or a Trustee in a registered Trust we will mainly use your data to:

  • provide you with the information, services or products you asked for
  • administer your organisation’s donation or support fundraising and participation in our activities
  • keep a record of your organisation’s relationship with us and your role in this
  • send you relevant marketing materials (see Direct marketing)
  • understand how we can improve our services, products or information
  • manage your feedback.

We store contact details and financial details of suppliers to manage and process contracts and payments.  We retain a directory of suppliers that we may want to work with in the future.

As well as your contact details and any financial information we require to process transactions, we will also store details about your role and who you work for. We may also ask for information about your experiences linked to arthritis.

Provide services to us or apply to work for us

Applying to work for us

We maintain detailed employee records to manage and make payments to our employees.

We may also store personal details provided by people who express an interest in working for us, either informally or via a formal application.

Providing Services to us

We store contact details and financial details of suppliers to manage and process contracts and payments.  We retain a directory of suppliers that we may want to work with in the future.

We also store named contacts at a particular supplier for management, audit and communication purposes

Information about our use of cookies

When you visit a website your computer or device may automatically be issued with a cookie. Many sites use cookies to track traffic flows.  A cookie is a small text file that, with your consent, we store on your browser or the hard drive of your computer. Cookies do not identify the person visiting the site, they identify your computer or device to our server.

Our websites use cookies to distinguish you from other users of our websites. This helps us to provide you with a good experience when you browse our websites and allows us to improve our sites. By continuing to browse the sites, you are agreeing to our use of cookies.

The cookies we use

  • Strictly necessary cookies are required for the operation of our websites. For example, cookies that enable you to log into secure areas of our websites, use a shopping cart or use e-billing services.
  • Analytical/performance cookies collect anonymous information, allowing us to recognise and count the number of visitors and to see how visitors move around our websites. These cookies help us to improve the way our websites work, for example, making sure users find what they are looking for easily and quickly.
  • Functionality cookies allow us to recognise you when you return to our websites. This enables us to personalise our content for you, greet you by name and remember your preferences, including your choice of language or region.
  • Targeting cookies record your visit to our websites, the pages you visited and the links you followed. We use this information to make our websites and the advertising displayed more relevant to your interests. We may also share this information with third parties for this purpose.

Please note third parties for example, advertising networks and providers of external services like web traffic analysis may also use cookies, over which we have no control. These cookies are usually analytical/performance or targeting cookies.

You can find more information about the cookies we use and why we use them in the table below:

 Cookies name


 Expiry period



 275 days


 Tracking Google analytics / Doubleclick campaign manager

 0 days


 Tracking Google analytics

 730 days


 Tracking Google analytics

 0 days


 Tracking Google analytics

 0 days


 Tracking Google analytics

 0 days


 Strictly Necessary Microsoft .NET. Used to identify logged in user

 0 days


 Performance/Tracking Sitecore web analytics. Tracks pages visited by a user in a session.

 Browser session


 Performance/Tracking Sitecore web analytics. Identify repeat visits.

 0 days

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies, including essential cookies you may not be able to access all or parts of our sites.

For more information about cookies, visit

Tracking and analysis of website traffic

We use tracking technologies and cookies to help us to give you the best possible user experience and to ensure we make the most out of our fundraising investments. These technologies record information you or your computer provide to our website. Arthritis Research UK’s site is built on a platform called Sitecore which has inbuilt tracking and analytics. The information this gathers will be used in line with our privacy policy.

Hotjar, VWO and Google Analytics are our trusted services providers who use and deploy cookies and tracking technologies.

We’re now Versus Arthritis. You’re being taken through to our new website in order to finish your donation. Thank you for your generosity.