Migraine Association of Ireland is responsible for your personal information. The purpose of this privacy notice is to outline how the Migraine Association of Ireland deals with the data you provide to us while using our services or browsing https://migraine.ie/ (our Website). Naturally, if you are not satisfied with this privacy notice you should not use our services.

Migraine Association of Ireland (collectively referred to as “MAI”, “we”, “us”) takes its data protection and privacy responsibilities seriously. This privacy notice explains how we collect, use and share personal information in the course of our activities, including:

• What personal information we collect and when and why we use it;
• How we share personal information within MAI and with our service providers, regulators and other third parties;
• How we protect and store personal information;
• Legal rights available to help manage your privacy; and
• How you can contact us for more support.

By using our Website and services and participating in our projects, you are accepting this privacy notice. From time to time, we may also provide links to other helplines or websites for further information; MAI is not responsible for the content or the privacy policies of these other resources.
We may amend this notice from time to time to keep it up to date with legal requirements and the way we operate our business. If we make significant changes to this privacy notice, we will seek to inform you by notice on our Website or email.

This privacy notice explains how MAI collects, protects, uses, discloses and otherwise processes personal information about:

• Individuals who visit our Website;
• Service users of MAI and individuals who use our services or engage with us in relation to our services;
• Individuals who donate to the service on a subscription basis or on a once-off basis; and
• Individuals who sign up to our newsletter / Ezine service.

( “you” or “your” ) as well as the rights that you have with regards to such Personal Data.
This privacy notice does not apply to the personal information that MAI collects and processes related to our employees, job applicants and job candidates or to any information that is exempt under applicable privacy and data protection laws. MAI services are not designed for, or directed at, children under the age of 16 and we do not knowingly collect personal data from individuals in this age group. If you believe we have inadvertently collected personal data about a child, please contact us and we will take steps to delete this data.

What personal information we collect and when and why we use it

In this section you can find out more about

• the types of personal information we collect;
• when we collect personal information;
• how we use personal information; and
• the legal basis for using personal information.

When we collect information and what do we collect?

We collect information about you in the following instances: where you access our Website and use any of the contact forms; where you are referred to our services (whether through self-referral or otherwise); where you interact with our social media channels; where you make a telephone/mobile call to a member of our team; where you contact MAI with a headache related query; where you register for our newsletter/ Ezine; where you have a membership / sponsorship of the service; where you make a donation to the service (whether on a subscription basis or a once-off basis); where you send an email to any of our employees; and when you visit one of our team members to discuss taking part in our programs or projects via our Website (including Infoline, Afternoon Tea and Self-Management Course, and other Migraine Ireland projects) or through doing business with the MAI. To the extent permitted by applicable local laws, we may collect and process particular types of personal data, sometimes called “sensitive personal data”.
The information we collect from you will depend on our relationship with you and may include, but is not limited to:

• Your name, address, email address and telephone number;
• Details of your health provider;
• Health related information about your migraine or other headache disorder related inquiry which has been provided via email or communicated to a member of staff, including but not limited to, information about diagnoses, treatment details, social histories and health history;
• Information for processing of donations to our services and monthly billing for subscription-based donations such as details of credit card information, bank details, billing address, purchase history and payment ID number;
• Technical information about your visit when you browse our Website and use our services such as IP address, browser type, operating system, and any other type of unique numbers assigned to your devices;
• Information required in accordance with our obligations under Code of Professional Conduct and Ethics for Registered Nurses and Registered Midwives, National and Midwifery Board of Ireland 2021; and
• Information that is provided when you contact us, respond to surveys, sign up to newsletters/ our Ezine, fill in forms, or use other features of the services. MAI may keep a record of that information and/or correspondence.

Website Visitors

When you navigate through and interact with our Website, we and our third-party providers may, with your consent where appropriate, automatically collect and record information about your browsing activities using cookies, pixel tags, log files and other similar technologies. We use Google Analytics to help analyse how users use the site. The tool uses cookies to collect standard Internet log information and visitor behaviour information in an anonymous form. A cookie is a very small text document, which often includes an anonymous unique identifier. When you visit a Website, that site’s computer asks your computer for permission to store this file in a part of your hard drive specifically designated for cookies. Our Website uses cookies for session management only and are removed as soon as the user’s session ends. For more information on this please refer to out Cookies Policy.
The legal basis for using your personal information MAI will only collect, use and share your Personal Data where we have an appropriate legal basis to do this. This may be because:

• you have provided your consent to us using the personal information;
• our use of your personal information is in our legitimate interest as a commercial organisation. In these cases, we will look after your information at all times in a way that is proportionate and respects your privacy rights and you have a right to object to processing as explained below;
• our use of your personal information is necessary to perform a contract or take steps to enter into a contract with you; and
• our use of your personal information is necessary to comply with a relevant legal or regulatory obligation that we have.

The purposes for which MAI uses your Personal Data, and their associated legal bases, are described below:

Important Notice: Where MAI relies on a legitimate interest of MAI or a third-party recipient of the Personal Data in order to use and disclose such data you are entitled to object to such use or disclosure and if you do, MAI will stop processing your Personal Data for that purpose unless MAI can show there are compelling legitimate reasons for to continue to do so.

Whenever we process your personal data, we do so with a legal justification for that processing. Due to the nature of our services, they may require that service users to disclose sensitive and confidential information
pertaining to health and social situation. Processing special category data is always justified on the basis of an additional lawful condition.
We might collect special category health data when you use our services such as when you call Infoline, or when you participate in other MAI projects.

Health data might include: 

• Details about your migraine or other headache disorder related inquiry which has been provided via email or communicated to a member of staff, including but not limited to, information about diagnoses, treatment details, social histories and health history;
• Details about your health and medical record if you choose to disclose that when you use our services; and
• Details about your healthcare provider.

Where special category data is being processed, this will also be justified on one of the following bases:

• The processing is necessary to protect the vital interests of the data subject or of another individual when the data subject is physically or legally unable to give consent.
• The processing is carried out under the course of legitimate activities by a foundation, association or another non-profit body with a political, philosophical, religious or trade union aim and on the condition that the processing relates solely to the members of the body or to persons who have regular contact with it in connection with its purposes. Any disclosure outside of the MAI will require your consent.
• The processing relates to personal data which has manifestly been made public by you.
• The processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity.
• The processing is necessary for occupational or preventative medicine or for the provision of health or social care or treatment, which is pursuant to a contract with a health professional.
• The processing is necessary for reasons of public interest in the area of public health, to protect against serious cross-border threats to health, or to ensure high standards of quality and safety of health care and of medicinal products or medical devices.

If the processing of data is not covered by the categories above, MAI will require explicit consent from you, and such consent will be obtained from you before we collect any special category data from you.

How we share personal information within MAI and with our service providers, regulators and other third parties.

In this section you can find out more about how we share personal information:

• within MAI;
• with third parties that help us provide our products and services; and
• law enforcement agencies.

We share your information in the manner and for the purposes described below:

• within MAI, where such disclosure is necessary to provide you with support;
• with third parties who help manage our organisation. For example, when you subscribe to the MAI mailing list, your email address will be shared with third parties responsible for managing our newsletters, such as MailChimp and Enthuse. We will not disclose your personal data to third parties unless you have specifically consented to this disclosure or unless the third party is required to fulfil your request.
• with organisations that MAI collaborate with for projects, programs and partnerships including Beaumont Health and Slainte Care. In the event you choose to participate in such projects, only the data which you have chosen to supply to us in relation to the project will be shared with the organisation.
• with our data processor, Microsoft Office, who securely manage all data collected in the course of our Infoline work. Microsoft Office provides a robust privacy and security programme to meet the highest standards in the industry and to prevent any inappropriate access to your data.
• with law enforcement agencies where we believe, in good faith, that we are required to disclose such information in order to comply with any applicable law, a summons, a search warrant, a court or regulatory order, or other statutory requirement.
• with other organisations for the management of our services including use of independent consultants, banks, payment processors and financial services providers, cloud storage providers, website analytics providers, IT support service providers and services provided by affiliates and subsidiaries, joint ventures and other business arrangements where the MAI has an ongoing relationship.

Transferring personal information outside of Europe

All personal information collected is stored on a secure SharePoint and stored within the EU. We do not transfer your personal information to countries outside the EU. In the unlikely event that we need to, MAI will take appropriate steps ensure that transfers of personal information are in accordance with applicable law and carefully managed to protect your privacy rights and interests and transfers are limited to countries which are recognized as providing an adequate level of legal protection or where we can be satisfied that alternative arrangement are in place to protect your privacy rights. To this end:

• where we transfer your personal information outside MAI or to third parties who help provide our products and services, we obtain contractual commitments from them to protect your personal information; or
• where we receive requests for information from law enforcement or regulators, we carefully validate these requests before any personal information are disclosed.

We will ensure that appropriate or suitable safeguards are in place to protect your personal information and that the transfer of your personal information is in compliance with applicable data protection laws. You have a right to contact us through our contact information listed below for more information about the safeguards we have put in place (including a copy of relevant contractual commitments) to ensure the adequate protection of your personal information when this is transferred as mentioned above.

How we protect and store your information

Security 
We have put in place suitable physical, electronic, and managerial procedures to safeguard and secure the information we collect. Your personal data is protected by encryption techniques and other safeguard technologies such as firewalls and password protection. Strict physical controls in our storage solution are in place to restrict access to your personal data.

The nature of the Internet and e-mail communications is such that we cannot guarantee or warrant the security of any information you transmit to us via the Internet. No data transmission over the Internet can be guaranteed to be 100% secure. However, we will take all reasonable steps (including appropriate technical and organisational measures) to protect your personal data.

Storing your personal information 
MAI retains personal data for the purposes for which it was obtained. We delete and securely dispose of personal data when the purpose for which it was obtained ceases, and the data is no longer required. MAI retains personal data in line the guidelines provided by the National Hospitals Office (NHO) Code of Practice for Healthcare Records Management (2007).

Personal contact details which have been provided in the course of making an inquiry to MAI’s Infoline will be retained for no longer than 7 years from your last contact with us. Where contact details have been provided through registering for regularly issued newsletters, such information will be retained for as long as the MAI issues such, or until you choose to unsubscribe.
Health information provided in the course of making migraine or other headache related inquiries is retained for no longer than 7 years from your last contact with us.

In specific circumstances we may store your personal information for longer periods of time so that we have an accurate record of your dealings with us in the event of any complaints or challenges, or if we reasonably believe there is a prospect of litigation relating to your personal information or dealings.
Information relating to once-only credit / debit / charge card transactions are disposed of confidentiality once the transaction has been processed. Regular donations are set up through a Standing Order. This is between the member and their banking institution and MAI have no access to member’s financial information

Marketing Communications 
You may receive emails, newsletters, or mailings from Migraine with information on Migraines’ services or upcoming events we believe may be of interest to you, if you have opted-in to receiving these communications. We will direct these communications to you only with your consent (where such consent is required by law). You can opt-out of these communications at any time by clicking an “unsubscribe” button provided in marketing email communication sent by Migraine or, by writing to us at info@migraine.ie.

Legal rights available to help manage your privacy

Subject to certain exemptions, and in some cases dependent upon the processing activity we are undertaking, you have certain rights in relation to your personal information. Click on the links below to learn more about each right you may have:

• To access personal information;
• To rectify / erase personal information;
• To restrict the processing of your personal information;
• To transfer your personal information;
• To object to the processing of personal information;
• To object to how we use your personal information for direct marketing purposes;
• To obtain a copy of personal information safeguards used for transfers outside your jurisdiction; and
• To lodge a complaint with your local supervisory authority.

We may ask you for additional information to confirm your identity and for security purposes, before disclosing the personal information requested to you. We reserve the right to charge a fee where permitted by law, for instance if your request is manifestly unfounded or excessive.

You can exercise your rights by contacting us through our contact information below, and we will ask you to complete our Subject Access Request Form. Subject to legal and other permissible considerations, we will make every reasonable effort to honour your request promptly or inform you if we require further information in order to fulfil your request.

We may not always be able to fully address your request, for example if it would impact the duty of confidentiality we owe to others, or if we are legally entitled to deal with the request in a different way.

Right to lodge a complaint with your local supervisory authority
You have a right to lodge a complaint with the Data Protection Commission if you have concerns about how we are processing your personal information. We ask that you please attempt to resolve any issues with us first, although you have a right to contact your supervisory authority at any time.

Contact us

The primary point of contact for all issues arising from this privacy notice, is Naomi Thornton, who can be contacted by email at info@migraine.ie, by telephone at 019061012 or you can write to us at: Migraine Association of Ireland, Unit 14, Block 5, Port Tunnel Business Park, Clonshaugh, Dublin 17.

If you have any questions, concerns or complaints regarding our compliance with this notice and the data protection laws, or if you wish to exercise your rights, we encourage you to first contact us. We will investigate and attempt to resolve complaints and disputes and will make every reasonable effort to honour your wish to exercise your rights as quickly as possible and, in any event, within the timescales provided by data protection laws.