Privacy notice

Privacy notice

We can only achieve our vision of a world free from the pain, fatigue and isolation of arthritis with your help. Your ongoing support is invaluable to us and to the millions of people across the UK living with arthritis. That's why taking good care of your personal information and treating it with respect is so important.

Personal data helps us to better understand our donors, beneficiaries and supporters. This in turn allows us to make our decisions, services, fundraising and information the best they can be and to do more to help people with arthritis to live full and active lives.

Being open and transparent about how and why we do things is central to our values as a charity. So, we've produced this privacy notice to explain how, why and when we collect and use your personal information and how we keep it safe and secure.

Before we move on to the detail below, here is our promise to you.

  • We will respect your personal details and keep them safe and secure.
  • We will never sell or exchange your information with another organisation for their own use.
  • We will not send you information you have not asked for or agreed to receive.
  • We will respond quickly if you ask us to change your details, stop using your information or if you no longer want to hear from us.
  • We will be clear about how and why we will use your personal information when we collect your details.

Who we are

In this privacy notice, “we” means Versus Arthritis and Versus Arthritis Trading Limited (formally Arthritis Research UK Trading Limited). On 1 November 2017, Arthritis Research UK and Arthritis Care joined together to help more people with arthritis to live full and active lives, and Versus Arthritis was born on 19 September 2018. This means all data collected by or passed to Arthritis Research UK or Arthritis Care before and after these dates will be managed by Versus Arthritis as set out in this notice.

Versus Arthritis is a charity registered in England and Wales (number 207711) and in Scotland (SC041156), and a company incorporated in England and Wales (number 490500). Our registered address is Copeman House, St. Mary's Court, St Mary's Gate, Chesterfield, Derbyshire, S41 7TD.

Versus Arthritis Trading Limited is a company incorporated in England and Wales (number 891517). Its registered address is Copeman House, St. Mary's Court, St Mary's Gate, Chesterfield, Derbyshire, S41 7TD. It is a wholly owned subsidiary of Versus Arthritis, trading on behalf of Versus Arthritis, to raise funds for the charity’s work.

The Data Protection Officer for both Versus Arthritis and Versus Arthritis Trading is Amanda Neylon, Director of Digital, Technology and Data. You can email Amanda with concerns about data protection at

Changes to this privacy notice

We will regularly review this privacy notice. Any significant changes will be clearly described on our websites or we may contact you where we already hold your data and where the change affects you directly.

Your rights

At Versus Arthritis we take your rights very seriously. You can ask us to delete copies of your personal data, stop particular activities, withdraw a consent you have given previously or challenge the results of any decisions or profiling. We will fulfil all requests, providing there are no legal and accounting requirements that stop us from doing so. If you are sure you don’t want to hear from us, either now or in the future, you can ask us to hold a record which will prevent us from contacting you. This may be more effective than completely removing your data. Please contact us at or call 0300 790 0400 to discuss any concerns. Alternatively you can email our data protection officer at

You have a right to ask for a copy of the information we hold about you. This can be provided in a machine-readable format for transfer elsewhere. To access your information, please send a description of the information you want to see and proof of your identity by post to Versus Arthritis, Copeman House, St Mary's Court, St Mary's Gate, Chesterfield, Derbyshire, S41 7TD. We cannot accept these requests by email as we want to guarantee that we only provide personal data to the right person.

If you discover that we are holding incorrect information about you, please let us know and we will correct this.

If you are not happy about how your data is managed, and wish to make a complaint, please contact us at or call 0300 790 0400. If you are unhappy with how a complaint is handled, you are entitled to contact the Information Commissioner’s Office (ICO). You may also contact the ICO about a data protection issue without first making a complaint to us. You can find more information about the ICO and your rights on their website.

How we keep your data safe

We use appropriate technical controls to protect your personal details. For example, our online forms are always encrypted and our network is protected and routinely monitored.

If you use a debit or credit card to make a donation or buy online or over the phone, we or our contracted suppliers will manage the transaction securely in line with the PCI DSS standards. All credit and debit card details are securely destroyed once the payment or donation has been processed.

Regular reviews ensure your personal information is only accessible by appropriately trained staff, volunteers and contractors.

We regularly perform administrative functions our systems and IT services and have a legitimate interest to do so. These include updating systems, moving data between systems, and data verification and management. We also run administrative data processing activities to ensure data is correct and accurate. We use specialist ICT service providers for this and some data may be stored in the cloud.

We sometimes use external companies to collect or process personal data on our behalf. We do comprehensive checks on these companies before we work with them and put a contract in place that sets out our expectations and requirements, especially regarding how they manage the personal data they have collected or have access to.

Your personal information may be transferred to, and stored at, a destination outside the European Economic Area (EEA) and may be processed by staff operating outside the EEA who work for us or for our suppliers. We will ensure that your information is held in compliance with the European data protection regulations.

We will only share your details in exceptional circumstances. This could be if we are under a duty to disclose your personal information to comply with any legal obligation (for example to government bodies and law enforcement agencies), where we have good reason to believe that a person’s vital interests are at stake (for example where a child reports abuse or someone reports serious self-harm or intends to harm someone else) or to enforce or apply our rights or to protect the organisation.

We will only ever share your data in other circumstances if we have your informed consent.

We keep records for as long as legal requirements and tax and accounting rules demand. We retain contact details for both marketing and suppression purposes until a request is made to remove information. We may also keep internal records of any contact with you indefinitely. Where your information is no longer required, we will ensure it is disposed of in a secure manner.

Children's data

Any information collected from or about children will be managed in a way appropriate to the age of the child. This information is usually collected when children attend our events or fundraise for us, but it can also be sensitive personal data about children who are receiving support from our Young People and Families service.

Wherever possible and appropriate we will seek consent from a parent or guardian before collecting information about children and we will make sure advertising for events is age appropriate.

How we collect information about you

  • When you give it to us DIRECTLY

You may give us your details when you fundraise for us or generously donate, receive support from our services including a helpline, volunteer with us, join one of our networks, enter our raffle or lottery, order an information booklet, tell us your story, make a donation, purchase our products or communicate with us. Sometimes your information is collected by an organisation working for us, for example a professional fundraising agency, but we take responsibility for your data at all times.

We will collect and process all the information you give us, as well as responses given to you by our staff or AVA, our arthritis virtual assistant.

We may also collect and retain your information if you send feedback about our services or make a complaint.

  • When you use our websites

When you visit our websites, information about your visit is recorded and stored on your own computer, using cookies. Cookies are text files which identify your computer to our server. Cookies in themselves do not identify the individual user, just the computer used. You can find more information on how we use cookies below. Beyond this you will remain anonymous unless you log in.

When you log in and browse Versus Arthritis site, including our online shop, you will remain logged in for 20 minutes after you last access a page or until you log out. You can ask us to keep a record of your favourite content or for our online shop to keep information on recent transactions so we can deal with future queries.

  • When you give it to us indirectly

Your information may be shared with us by independent event organisers, for example the London Marathon or fundraising sites like Just Giving or Virgin Money Giving. These independent third parties will only do so with your consent. Please check the privacy notice of these organisations when you provide your information to understand fully how they will process your data.

Your personal details may also be collected if they are included in other information that is sent to us. For example, if you are named as a third party in an email we receive or you are a co-beneficiary of a legacy request. In these cases, we will not add your details to our direct records but may keep copies of the information for up to 10 years. From time to time it may be necessary for us to apply to the probate registry to receive a copy of a supporter’s Will to evidence their generosity to our auditors and comply requirements placed upon us by the Charity Commission. To help preserve charitable resources, we may receive a copy Will, or share a copy Will with charitable co beneficiaries who have also been fondly remembered by the same supporter.

  • When you give permission to other organisations to share your details

Information we get from other organisations may depend on your privacy settings or the responses you give, so please check them regularly. This information comes from the following sources:

Referral by a healthcare professional – many of our services for people with arthritis are accessed following a referral or recommendation by a healthcare professional. Consent to be referred will have been obtained by the healthcare professional. In these cases, your personal information will be used to identify suitable services, but your consent will be requested before enrolment.

Third party organisations – you may have provided permission for an organisation to share your data with third parties, including charities. For example, when you buy a product or service, register for an online competition or sign up with a comparison site.

  • When you use social media

Depending on your settings or the privacy policies for social media and messaging services like Facebook, WhatsApp, LinkedIn, Instagram or Twitter, you might give us permission to access information from those accounts or services, either directly or indirectly. Where you follow us via social media we will not automatically add you to our own records. However, if we receive a direct request from you (for example to make a donation, use one of our services or request a booklet) we will treat your details as having been received directly.

  • Public information

We may also obtain and store information about you that is available publicly from third party sources, such as from Companies House or details published in the media.

Your supporter record

If you support us, for example sign up to receive regular news and updates, make a donation, volunteer, register to fundraise, sign up for a workshop or an event, lobby or campaign for us or buy something from us, we keep a record of your support.

The law may require us to store information for up to seven years. Though we know some people will not want us to keep hold of their data indefinitely, keeping a record of past support does help us to maintain and build good relationships with people with an interest in our work.

If you choose to leave us a legacy in your Will we will keep a record of you and your pledge indefinitely. This will help us to manage your wishes when the time comes and ensure the process runs smoothly for your family.

Our standard data retention policy is to keep your personal information for 10 years, from your most recent active support. After this point we will normally remove any information that may identify you personally. However, if you ask us to hold your details to block marketing communications, either directly or via the Fundraising Preference Service, then we must keep a record indefinitely.

We apply a similar 10-year rule to personal data collected as part of our work. This may include information gathered through legitimate activities via contractors, suppliers or third parties.

If you do not want us to keep a record of your personal information, or want to discuss our data management, then please contact us at or call 0300 790 0400.

How we use your information to:

Our virtual assistants

AVA, the arthritis virtual assistant, and COVA, our COVID-19 virtual assistant, are chatbots. They use a platform called Enterprise Bot Manager (EBM) to answer your questions.

EBM is owned and managed by Filament Consultancy Group. It’s hosted on the Versus Arthritis Microsoft Azure service. When you have a conversation with AVA or COVA, this conversation (data) is stored and processed in EBM. EBM connects to natural language understanding engines (Microsoft LUIS services and Azure Cognitive services), which allows the chatbots to ‘understand’ your questions in the words you use. It uses the information you share to answer your questions and to improve the answers it gives to others in the future.

Data stored in EBM is managed directly by Versus Arthritis and shared with Filament, Microsoft and Microsoft Azure under contract with appropriate data protection schedules. We share this data so that AVA and COVA can respond to questions in real time and so we can improve the chatbots. If needed, it also means we can service or fix any issues with them.


AVA doesn’t need your personal information and will only ask for your condition. Any data about health conditions is called special category data, and AVA asks for it so it can give you information that’s relevant to your condition. Without knowing about your condition, AVA can only provide very general information, and the conversation may not be as helpful.

AVA won’t treat your conversations as personal data, so you mustn’t give any information which may be used to identify you. Personal information includes your address, NHS number and bank details.

Any information you share with AVA, including any personal or sensitive information, will be transferred to and stored in EBM and any natural language understanding engines for up to 90 days. Versus Arthritis will keep your information for up to 24 months to help us to review the conversations and improve answers. The systems that we use to process and transfer data are tested regularly, so the risk of any security issues is low.

If you choose to arrange a call with our helpline through AVA, you’ll be asked for your name and phone number so our helpline can call you. You’ll be asked for your email address to confirm the time and date of the call. Your name, phone number and email address will be passed through Microsoft Bookings, which arranges timeslots, and held according to their data policies, which are compliant with data protection law. A secure link to your conversation will also be passed to the helpline to help them with your enquiry. This link will expire after 30 days.


COVA doesn’t need your personal information and because it uses a button-based interface you won’t be able to submit any personal information. Your conversation will be transferred to and stored in EBM and any natural language understanding engines for up to 90 days. Versus Arthritis will keep the conversation for up to 24 months to help us to review the conversations and improve answers.

You can read AVA and COVA privacy information in our terms and conditions.

Keep you informed about what we do

We may need to contact you by post, email, telephone or text message about a service you have signed up for or a donation or order you have made. We will never do so without good reason. We may also contact you occasionally with critical legal and technical information and updates to this privacy notice. Wherever possible, we will respect your preferences about how you want us to contact you.

We use specialist suppliers to process and manage communications.

Raise vital funds to support our work

How your personal information is used when you:

Are a healthcare professional

If you ask for information in your capacity as a healthcare professional or join one of our professional networks, we will mainly use your data to:

  • manage participation in our professional networks
  • provide you with the information, services or products you asked for
  • administer your organisation’s donation or support fundraising and participation in our activities
  • keep a record of your organisation’s relationship with us and your role in this
  • send you relevant marketing materials (see Direct marketing)
  • understand how we can improve our services, products or information
  • manage your feedback.

As well as your contact details, we will also store details about your role and who you work for. We may also ask for information about your experiences linked to arthritis.

Where one of our service customers provides us with your details as their personal GP or other clinician we have a legitimate interest to store your name on their file and to contact you with their consent.

Have your research funded by us

We store contact details and financial details of researchers and suppliers to manage and process grant applications, grants, contracts and payments. This includes details of staff and co-researchers/sponsors provided by Principal Investigators. Where partial information is provided we will complete the details using publicly-available information.

We keep a directory of researchers and suppliers so we can issue future offers. We may also contact people not in our directory where publicly-available information indicates a grant may be of interest. Grant processing and management in this way is a legitimate interest for Versus Arthritis.

If you join one of our networks, panels or committees for researchers and reviewers we will use your personal details for administration and to communicate with you.

Work for, or represent, a third-party organisation

If you ask for information in a professional capacity, for example as an employee of a company that supports us or supplies services or a Trustee in a registered Trust we will mainly use your data to:

  • provide you with the information, services or products you asked for
  • administer your organisation’s donation or support fundraising and participation in our activities
  • keep a record of your organisation’s relationship with us and your role in this
  • send you relevant marketing materials (see Direct marketing)
  • understand how we can improve our services, products or information
  • manage your feedback.

We store contact details and financial details of suppliers to manage and process contracts and payments. We retain a directory of suppliers that we may want to work with in the future.

As well as your contact details and any financial information we require to process transactions, we will also store details about your role and who you work for. We may also ask for information about your experiences linked to arthritis.

Provide services to us or apply to work for us

Information about our use of cookies

When you visit a website your computer or device may automatically be issued with a cookie. Many sites use cookies to track traffic flows. A cookie is a small text file that, with your consent, we store on your browser or the hard drive of your computer. Cookies do not identify the person visiting the site, they identify your computer or device to our server.

Our websites use cookies to distinguish you from other users of our websites. This helps us to provide you with a good experience when you browse our websites and allows us to improve our sites. By continuing to browse the sites, you are agreeing to our use of cookies.

  • Strictly necessary cookies are required for the operation of our websites. For example, cookies that enable you to log into secure areas of our websites, use a shopping cart or use e-billing services.
  • Analytical/performance cookies collect anonymous information, allowing us to recognise and count the number of visitors and to see how visitors move around our websites. These cookies help us to improve the way our websites work, for example, making sure users find what they are looking for easily and quickly.
  • Functionality cookies allow us to recognise you when you return to our websites. This enables us to personalise our content for you, greet you by name and remember your preferences, including your choice of language or region.
  • Targeting cookies record your visit to our websites, the pages you visited and the links you followed. We use this information to make our websites and the advertising displayed more relevant to your interests. We may also share this information with third parties for this purpose.

Please note third parties for example, advertising networks and providers of external services like web traffic analysis may also use cookies, over which we have no control. These cookies are usually analytical/performance or targeting cookies.

You can find more information about the cookies we use and why we use them in the table below:

Name Purpose Domain Type
AcceptedCookies Used to let us know the user has closed the cookie message, so that we don’t show them again. First party persistent
termsCookie Set upon the user acknowledging the terms and conditions in the AVA chat, so we don't show them again. First party persistent
__RequestVerificationToken Used to make sure that submitted data on certain pages comes from a form POST, as opposed to some robot spamming our site. First party session
ASP.NET_SessionId Used by our underlying framework (.NET) to differentiate users so that we can store temporary data in-session. First party session
ARRAffinity We have at least two machines at any one time which serve content. This cookie keeps the user on one machine, which allows the previous cookie to function. First party session
YSC These cookies are set via embedded youtube-videos. They register anonymous statistical data on for example how many times the video is displayed and what settings are used for playback. No sensitive data is collected unless you log in to your google account, in that case your choices are linked with your account, for example if you click “like” on a video. For more information, read the general Google Privacy policy. Third party persistent
VISITOR_INFO1_LIVE As above Third party persistent
SSID As above Third party persistent
SID As above Third party persistent
SAPISID As above Third party persistent
PREF As above Third party persistent
LOGIN_INFO As above Third party persistent
HSID As above Third party persistent
CONSENT As above Third party persistent
APISID As above Third party persistent
1P_JAR As above Third party persistent

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies, including essential cookies you may not be able to access all or parts of our sites.

For more information about cookies, visit

We use tracking technologies and cookies to help us to give you the best possible user experience and to ensure we make the most out of our fundraising investments. These technologies record information you or your computer provide to our website. Versus Arthritis site is built on a platform called Umbraco which has inbuilt tracking and analytics. The information this gathers will be used in line with our privacy notice.

Hotjar, VWO and Google Analytics are our trusted services providers who use and deploy cookies and tracking technologies.

Sharing social media content with you

Using social media is a great way for us to update you on our work, and let you know the difference your support is making.

If you use Facebook or Instagram and have opted in to receiving communications from us, we will use these platforms as part of our relationship with you. We will upload your contact details in encrypted format to enable these platforms to determine whether you are a registered account holder with them. Your data is not retained by the social media provider and is deleted if it does not match with an existing account. This allows us to show you communications which we think will be of interest to you.

We may also use your data to identify audiences with similar interests, behaviours and demographics to existing Versus Arthritis supporters. This will allow us to promote Versus Arthritis content to people who we think may be interested in finding out more about the work we do. We believe this is the most efficient way for us to reach more people, meaning we use our funds more effectively.

If you do not wish us to use your data in this way, you can either contact Versus Arthritis direct or you can do this via Facebook.