Last Updated: May 12, 2025

The Ehlers-Danlos Society
Privacy Policy

Introduction 

We are The Ehlers-Danlos Society (“Ehlers Danlos”, “us”, “we”, “our”, “The Society”). We are an international nonprofit organization, dedicated to patient support, scientific research, advocacy, and increasing awareness for the Ehlers–Danlos syndromes and hypermobility spectrum disorder. We are registered in England and Wales under registration number 10722868, and we have our registered office at Wayman House 141 Wickham Road, Shirley, Croydon, Surrey, England, CR0 8TE. We are registered with the UK supervisory authority, Information Commissioner’s Office (“ICO”) in relation to our processing of Personal Data under registration number ZB343307.

Unless we notify you otherwise, we are the controller of the Personal Data we process about you. This means that we decide what Personal Data to collect and how to process it.

We provide our support and services to individuals located in countries all over the world, and we are therefore committed to ensuring we meet our legal obligations when processing personal data under the data protection laws of these countries, which include but are not limited to:

  • the UK General Data Protection Regulation and the EU General Data Protection Regulation 2016/679 (together referred to herein as the “GDPR”);
  • the UK Data Protection Act 2018 (“DPA 2018”)
  • the California Consumer Privacy Act (“CCPA”);
  • the Canadian Personal Information Protection and Electronic Documents Act (“PIPEDA”);
  • the Colorado Privacy Act (“CPA”);
  • the Connecticut Data Privacy Act (“CTDPA”);
  • the Utah Consumer Privacy Act (“UCPA”);
  • the Virginia Consumer Data Protection Act (“VCDPA”).

The purpose of this privacy notice is to explain what Personal Data we collect about you and how we process it. This privacy notice also explains your rights, so please read it carefully. If you have any questions, you can contact us using the information provided below under the ‘How to Contact Us’ section.

Who This Privacy Notice Applies To 

This privacy notice applies to you if:

  • You visit our website;
  • You register an online account;
  • You buy goods via our online shop;
  • You download or use our mobile application;
  • You join our global registry and repository;
  • You join our global biobank (as either a participant or researcher);
  • You join our online marketplace;
  • You register to participate in one of our research programs;
  • You undergo assessment to determine suitability for future fund-raising opportunities;
  • You make a donation to The Ehlers-Danlos Society;
  • You engage in fundraising for The Ehlers-Danlos Society;
  • You become an advocate of The Ehlers-Danlos Society;
  • You sign up to receive newsletters and/or other communications from us.

What Is Personal Data 

‘Personal Data’ means any information from which someone can be identified either directly or indirectly. For example, you can be identified by your name or an online identifier.

‘Special Category Personal Data’ is more sensitive Personal Data and includes information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic data, biometric data for the purposes of uniquely identifying someone, data concerning physical or mental health or data concerning someone’s sex life or sexual orientation.

If you are in the U.S, ‘Personal Information’ means information that identifies, relates to, describes, is reasonably capable of being associated with, or could reasonably be linked, directly or indirectly, with a particular consumer or household. Personal Information does not include information that is publicly available, deidentified, or aggregated.

‘Sensitive personal information’ is a specific subset of personal information that includes certain government identifiers (such as social security numbers); an account log-in, financial account, debit card, or credit card number with any required security code, password, or credentials allowing access to an account; precise geolocation; contents of mail, email, and text messages; genetic data; biometric information processed to identify a consumer; information concerning a consumer’s health, sex life, or sexual orientation; or information about racial or ethnic origin, religious or philosophical beliefs, or union membership.

How We Collect Your Information 

We collect most of the Personal Data directly from you in person, by telephone, text or email and/or via our website.

However, where applicable, we may also collect your Personal Data from third parties such as:

  • others to whom you have provided consent;
  • publicly available sources such as social media and/or prospect research platforms.

Personal Data We Collect 

The type of Personal Data we collect about you will depend on our relationship with you. For the type of Personal Data we collect, see the table below in the section entitled ‘Purposes and Lawful Basis’.

Purposes and Lawful Basis 

We will only use your Personal Data when the law allows. Most commonly, we will use your Personal Data in the following circumstances:

Purpose of Processing What information may we process Lawful Basis
Responding to correspondence from you Your name (first & last name), address, email address, phone number 1. It is in our legitimate interest to respond to enquiries made via our website, telephone, by email, through our social channels or any other means.
Process Donations Your name (first & last name), address, email address, phone number, reason for giving 1. Performance of Contract

2. Legitimate Interest to use money received to support The Ehlers-Danlos Society’s strategic goals
Merchandise Orders Your name (first & last name), address, email address, phone number, transaction data 1. Performance of Contract
Process Registrations for Research Groups or Programs Your name (first & last name), email address 1. Performance of Contract
Process Registrations for our online Marketplace Your name (first & last name), email address, transaction data, organization details 1. Performance of Contract
*Assessment/Screening for Future Donations/Fundraising Opportunities Your name (first & last name), address, email address, phone number, wealth markers, philanthropic indicators 1. Consent

2. Performance of Contract

To Send Newsletters and Other Promotional Material Your name (first & last name), email address 1. Consent
Event Registration Your name (first & last name), address, email address, phone number 1. Performance of Contract

2. Consent
Virtual Support Group Registration Your name (first & last name), email address 1. Performance of Contract

2. Consent
Helpline Your name (first & last name), address, email address, phone number, special category data 1. Consent

2. Legitimate Interest to offer support to individuals that contact The Ehlers-Danlos Society via the helpline
Global Registry Your name (first & last name), address, email address, phone number, special category data 1. Consent

2. Legitimate Interest in managing the registry database

Global Biobank

(Participants)

 Your name, address, email address, phone number, date of birth, biological sex, demographic data, anthropometric data medical history, prescribed medication, therapies, EDS clinical data 1. Consent

2. Legitimate Interest in managing the biobank database
Global Biobank

(Researchers)

 Your name, institution, address, email address, phone number, ethics approval reference, proposed research details, study purpose, data/samples required, planned outcomes 1. Consent

2. Legitimate Interest in managing the biobank database
Application Processing Your name (first & last name), address, organization (if applicable) email address, phone number 1. Legitimate Interest to process applications for various positions, coalitions, educational programs, grant funding
Healthcare Professionals Directory Your name (first & last name), address, organization (if applicable) email address, phone number Legitimate Interest to manage the healthcare professionals’ directory
EDS ECHO Program Registration Your name (first & last name), address, organization (if applicable) email address, phone number, occupation, professional credentials, medical speciality, patient numbers 1. Performance of Contract
EDS ECHO Program Database Your name (first & last name), address, organization (if applicable) email address, phone number, occupation, participation data Legitimate Interest to manage the program participant database
EDS ECHO Logo Applications Your name (first & last name), address, organization (if applicable) email address, phone number, participation data Legitimate Interest to verify applications for an EDS logo, using program participation data
Prize Draws Your name (first & last name), email address Consent
Social Media Your name (first & last name), email address, online identifiers 1. Consent

2. Legitimate Interest in promoting The Ehlers-Danlos Society and it’s aims
Business Management, Forecasting and Statistical Purposes Your name (first & last name), address, organization (if applicable) email address, phone number It is our Legitimate Interest to identify areas for managing current relationships, develop new products and services, and for managing and accessing our business
Improving Our Website and Overall Website Visitor and User Experience Technical data,

Usage Information

 It is our legitimate interest to allow analytics and search engine providers to help improve and optimize our websites
Improving Our App/Website and Overall Website Visitor and User Experience IP address, Location data, Device ID, Model and device type, Name and version of the operating system, Settings and language of the device, Usage information We use cookies on our websites with your consent
We deploy analytics within our Mobile App with your consent
To Administer and Protect Our Business and This Website (including troubleshooting, data analysis, testing, system maintenance, support, reporting and hosting of data). Technical data,

Usage Information

 It is our legitimate interest to run our business which includes the provision of administration and IT services, network security, and fraud prevention.

* Where we use publicly available information to assess your inclination to provide financial support, and any areas of philanthropic interest, this research may include financial information (including assessment of income and whether particular donations or funding appeals may be of interest), philanthropy and other giving (including donations to other organizations), other support (for example, details of volunteering roles), career highlights and other life achievements, and information about areas of interest and extra-curricular activities.

Sharing Your Personal Data 

We may also disclose your information to third parties in connection with other purposes set out in this policy. These third parties may include:

  • business partners, suppliers and sub-contractors who may process information on our behalf;
  • external researchers when explicit consent is given by the participant (regarding the Global Registry);
  • researchers, any joint funders of research, host institutions, and external members of our committee;
  • advertisers, social media platforms, and advertising networks;
  • analytics and search engine providers;
  • IT service providers.

Where we are under a legal or regulatory duty to do so, we may disclose your details to the police, regulatory bodies or legal advisors, and/or, where we consider necessary to protect the rights, property or safety of The Ehlers-Danlos Society, its personnel, users or others.

We do not sell or share personal information to another business or third party for monetary or other valuable consideration.

International Transfers 

Your Personal Data may be processed outside of the European Economic Area (EEA) as the organizations we use to provide our service to you may be based outside the EU or UK.

We have taken appropriate steps to ensure that the Personal Data processed outside the EEA has an essentially equivalent level of protection to that guaranteed in the EU or UK. We do this by ensuring that:

  • Your Personal Data is only processed in a country which the Secretary of State has confirmed has an adequate level of protection (an adequacy regulation);
  • We enter into Standard Contractual Clauses (“SCCs”) with the receiving organizations and adopt supplementary measures, where necessary. (A copy of the SCCs can be found here Standard Contractual Clauses (SCCs)).

If you are in the U.S or Canada, we may disclose your personal information to third-party service providers and/or business partners located outside these regions for the purposes indicated in this privacy notice. Some of these third-party service providers may include cloud-based storage providers who may store and process personal information in the cloud.

Where we make such disclosures, we have taken reasonable steps to ensure that overseas recipients do not breach the relevant privacy legislation in relation to any personal information. We have carried out a thorough due diligence process and have imposed relevant contractual obligations on any offshore recipient to ensure compliance.

How Long We Keep Your Data 

We will retain your personal data for as long as is necessary to provide you with our services and for a reasonable period thereafter to enable us to meet our contractual and legal obligations and to deal with complaints and claims.

At the end of the retention period, your personal data will be securely deleted or anonymized, for example by aggregation with other data, so that it can be used in a non-identifiable way for statistical analysis and business planning.

We Respect Your Confidentiality 

The Ehlers-Danlos Society requires that your personal information be held in strict confidence. We use your information only for its intended Society purposes. We do not sell or trade your information to other organizations or individuals.

We Protect Your Information 

The Ehlers-Danlos Society takes every possible measure to ensure that your information is not compromised in any way. We implement appropriate technical and organizational measures to protect data that we process from unauthorized disclosure, use, alteration or destruction.  Our privacy promise is in place in respect of our website only. Other online services will be serviced by their own privacy policies.

Some of the controls we have in place are:

  • We ensure active SSL certification on all of our websites (using https:// rather than http://);
  • We use technology controls for our information systems, such as firewalls, user verification, data encryption, and separation of roles, systems & data management;
  • We use password encryption and password management tools;
  • We enforce a “need to know” policy, for access to any data or systems.

In addition to the technical and organizational measures we have put in place, there are a number of simple things you can do to further protect your personal information;

  1. Never share a One Time Passcode (OTP).
  2. Never enter your details after clicking on a link in an email or text message.
  3. Always send confidential information by encrypted email where possible this reduces the risk of interception.
  4. If you are logged into any online service do not leave your computer unattended.
  5. Close your internet browser once you have logged off.
  6. Never download software or let anyone log on to your computer or devices remotely, during or after a cold call.

Secure Online Services 

You can easily identify secure websites by looking at the address in the top of your browser which will begin https:// rather than http://.

What Are Your Data Protection Rights?  

The Ehlers-Danlos Society would like to make sure you are fully aware of your rights. We will always ensure, no matter where you are located in the world, that we adhere to and fully respect your data protection rights. If you wish to exercise your data protection rights, please email [email protected].

If you are located in the EU or UK, you have the following rights:

  • The right to access You have the right to request from The Ehlers-Danlos Society copies of your personal data and information about our processing of it.
  • The right to rectification You have the right to request that The Ehlers-Danlos Society correct any information you believe to be inaccurate. You also have the right to request The Society to complete information you believe is incomplete.
  • The right to withdraw You have the right to withdraw your consent at any time when The Ehlers-Danlos Society are relying on consent as the lawful basis for processing your personal data.
  • The right to erasure You have the right to request that The Ehlers-Danlos Society erase your personal data, under certain conditions. Some data that is being used under certain conditions may not be able to be deleted, such as research data, however in these instances we will ensure all data being used is de-identified and cannot be linked with you.
  • The right to restrict processing You have the right to request that The Ehlers-Danlos Society restrict the processing of your personal data, under certain conditions.
  • The right to object to processing You have the right to object to The Ehlers-Danlos Society processing of your personal data, under certain conditions.  If you object to us using your Personal Data for marketing purposes, we will stop sending you marketing material.
  • The right to data portability You have the right to request that The Ehlers-Danlos Society transfer the data that we have collected to another organization, or directly to you, under certain conditions. If you make a request, we have one month to respond to you. If you would like to exercise any of these rights, please contact us.

We do not make significant decisions based solely on automated processing, nor do we use or disclose sensitive personal information for purposes which would require us to offer you the right to limit our use of your information.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

If you wish to exercise your rights, please contact us at [email protected].

You can also lodge a complaint with your relevant data protection supervisory authority.

Although The Ehlers-Danlos Society is not currently subject to any US state privacy laws, we will always ensure that no matter where you are located, we adhere to and fully respect your data protection rights.

Privacy Policies of Other Websites  

The Ehlers-Danlos Society website contains links to other websites. Our privacy policy applies only to our website, so if you click on a link to another website, you should read their privacy policy.

Children’s Privacy 

The Ehlers-Danlos Society is committed to complying with the ICO’s Children’s Code (UK), the Children’s Online Privacy Protection Act (COPPA) and to protecting the online privacy of children under the age of 13. In certain circumstances, we may offer our products and services to children under the age of 13, however we do not knowingly collect Personal Data of children without parental consent, unless permitted by law. If you are a child under the age of 13, you must have your parents’ permission to use our services. If you learn that a child has provided us with their Personal Data without parental consent, you may contact us, as described below, and if appropriate, we will securely and permanently delete it, in accordance with applicable law.

Mobile Application

Once downloaded, our mobile application will process any personal data you choose to enter (name, email address, health data etc), however all information entered is stored locally within encrypted files on your own device. This means that there is no data transmitted from your device to The Society or any other third party. The personal data you input will only be used locally for the purposes chosen by you as the user, and we do not collect any additional data from you (device information, usage, location data) whilst you use our app. We can also confirm that there are no tracking and/or analytical tools within our mobile application.

By entering your personal data into our app, you understand that it will be processed in the way described above, and any personal data entered will be retained locally within the app until deleted by you as the user. You also understand that when our app is un-installed/deleted from your device, all personal data that was previously inputted will be removed.

In addition to the above, you will also have the option to either allow or deny analytics when using our app. We use analytics to better understand how you use our app, to improve your experience and app performance, and to fix bugs. Should you choose to allow our analytics, we will collect and use the following data points:

  • Screen view (which includes duration)
  • Approximate location and device information
  • User type choice (I’m an individual / I’m a healthcare professional)
  • Log Symptom (only the action with no specific information)
  • Add Medication (only the action with no specific information)
  • Print Summary (action to produce a PDF)
  • Dark / Light mode toggle

Please note that changes to your preferences can be made at any time from within the app settings.

The Mobile App Privacy notice is available to view online at https://www.ehlers-danlos.com/our-policies/.

 

How to Contact Us and Our Data Protection Officer 

If you have any questions about The Ehlers-Danlos Society Privacy Policy, the data we hold about you, or you would like to exercise one of your data protection rights, please do not hesitate to contact us.

Email us at: [email protected]

Call us: +1 410-670-7577 or +44 (0) 203 887 6132.

Or write to us at: The Ehlers-Danlos Society Headquarters, 447 Broadway, 2nd FL #670, New York, NY 10013, USA or The Ehlers-Danlos Society Europe Office, Office 7, 35-37 Ludgate Hill, London, EC4M 7JN, United Kingdom.

We have also appointed a Data protection Officer (“DPO”). Our DPO is Evalian Limited and can be contacted by using the above Society email or postal addresses. Please send your communication clearly indicating ‘FAO the ‘Data Protection Officer’, and your message will be passed directly to Evalian Limited for attention.

Our EU Representative  

We are based outside the EU and under the EU GDPR, we are required to appoint an EU representative.  The purpose of an EU representative is to make it easy for people in the EU to contact us should they wish to exercise their rights or make a complaint or enquiry in relation to how we are processing their Personal Data. It is also a contact point for the supervisory authorities located in the EU.

Our EU representative is DataRep who can be contacted as follows:

  • Sending an email to DataRep at [email protected] quoting ‘The Ehlers-Danlos Society’ in the subject line
  • Sending an online webform at www.datarep.com/data-request
  • Mailing your inquiry to DataRep at the most convenient of the addresses in the table below. Please note when mailing inquiries, it is ESSENTIAL that you mark your letters for ‘DataRep’ and not The Ehlers-Danlos Society or your inquiry may not reach its destination.

DataRep Postal Address List: 

Country Address
Austria DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
Belgium DataRep, Place de L’Université 16, Louvain-La-Neuve, Waals Brabant, 1348, Belgium
Bulgaria DataRep, 132 Mimi Balkanska Str., Sofia, 1540, Bulgaria
Croatia DataRep, Ground & 9th Floor, Hoto Tower, Savska cesta 32, Zagreb, 10000, Croatia
Cyprus DataRep, Victory House, 205 Archbishop Makarios Avenue, Limassol, 3030, Cyprus
Czech Republic DataRep, IQ Ostrava Ground floor, 28. rijna 3346/91, Ostrava-mesto, Moravska, Ostrava, Czech Republic
Denmark DataRep, Lautruphøj 1-3, Ballerup, 2750, Denmark
Estonia DataRep, 2nd Floor, Tornimae 5, Tallinn, 10145, Estonia
Finland DataRep, Luna House, 5.krs, Mannerheimintie 12 B, Helsinki, 00100, Finland
France DataRep, 72 rue de Lessard, Rouen, 76100, France
Germany DataRep, 3rd and 4th floor, Altmarkt 10 B/D, Dresden, 01067, Germany
Greece DataRep, 24 Lagoumitzi str, Athens, 17671, Greece
Hungary DataRep, President Centre, Kálmán Imre utca 1, Budapest, 1054, Hungary
Iceland DataRep, Kalkofnsvegur 2, 101 Reykjavík, Iceland
Ireland DataRep, The Cube, Monahan Road, Cork, T12 H1XY, Republic of Ireland
Italy DataRep, Viale Giorgio Ribotta 11, Piano 1, Rome, Lazio, 00144, Italy
Latvia DataRep, 4th & 5th floors, 14 Terbatas Street, Riga, LV-1011, Latvia
Liechtenstein DataRep, City Tower, Brückenkopfgasse 1/6. Stock, Graz, 8020, Austria
Lithuania DataRep, 44A Gedimino Avenue, 01110 Vilnius, Lithuania
Luxembourg DataRep, BPM 335368, Banzelt 4 A, 6921, Roodt-sur-Syre, Luxembourg
Malta DataRep, Tower Business Centre, 2nd floor, Tower Street, Swatar, BKR4013, Malta
Netherlands DataRep, Cuserstraat 93, Floor 2 and 3, Amsterdam, 1081 CN, Netherlands
Norway DataRep, C.J. Hambros Plass 2c, Oslo, 0164, Norway
Poland DataRep, Budynek Fronton ul Kamienna 21, Krakow, 31-403, Poland
Portugal DataRep, Torre de Monsanto, Rua Afonso Praça 30, 7th floor, Algès, Lisbon, 1495-061, Portugal
Romania DataRep, 15 Piaţa Charles de Gaulle, nr. 1-T, Bucureşti, Sectorul 1, 011857,

Romania
Slovakia DataRep, Apollo Business Centre II, Block E / 9th floor, 4D Prievozska, Bratislava, 821 09, Slovakia
Slovenia DataRep, Trg. Republike 3, Floor 3, Ljubljana, 1000, Slovenia
Spain DataRep, Calle de Manzanares 4, Madrid, 28005, Spain
Sweden DataRep, S:t Johannesgatan 2, 4th floor, Malmo, SE – 211 46, Sweden

How To Complain 

You have the right to lodge a complaint with the relevant supervisory authority if you are concerned about the way in which we are handling your Personal Data. The supervisory authority in the UK is the Information Commissioner’s Office who can be contacted online at: Contact us | ICO, or by telephone on 0303 123 1113

For supervisory authorities in other countries within the EU see the link below:

https://edpb.europa.eu/about-edpb/about-edpb/members_en

If you reside in the U.S or Canada, you can make a complaint at any time to your relevant supervisory authority if you are concerned about the way in which we are handling your personal information, or if you feel that we are infringing data protection law.

Policy Review and Amendments 

We may update this notice (and any supplemental privacy notice), from time to time as shown below. We will notify you of the changes required by applicable law when required to do so.

Last Modified: May 12th, 2025

Sign up to The Ehlers-Danlos Society mailing list

Click here to sign up