Privacy Notice
January 2026
This Privacy Notice contains important information about the types of personal information we collect and process; what we do with it; who we may share it with and why; and your rights when it comes to the personal information that you provide us with.
We may need to make changes to our Privacy Notice in line with regulatory requirements, so please check our website for updates from time to time. If there are significant changes, we will contact you to let you know.
1. Who we are
We are the Global Alliance for Patient Access (GAfPA).
GAfPA is a U.S. based non-profit corporation with registered address of 2020 K Street, NW, Suite 505, Washington, D.C. 20006.
Phone: (202) 951-1139
Email: info@gafpa.org
Contact person: Brian Kennedy
GAfPA functions as the secretariat for the Global Remission Coalition.
2. The data that we process and our legal bases:
On our ‘Subscribe to the GRC Newsletter’ form, we ask for your:
| Why we need it | Why we need it | Our legal basis for process |
| Name and your email address | We ask for these so that we may send you the newsletter and updates that you have requested | Consent – you provide us with the personal data that we need in order to send you information. |
| Country | We ask for your country in order to put you in touch with the organisation in your country. | Legitimate interest – we have partner organisations in different countries and we would like to share your data with that organisation so they may also contact you. Please let us know if you would prefer that we don’t share your data like this. |
Campaign participants referred by partner organizations
When you take part in one of our campaigns (for example, a video recording), your information may be shared with us by a partner organization, such as a patient advocacy group, rather than collected directly from you.
| What we receive | Why we need it | Our legal basis for processing |
|---|---|---|
| Name and email address | Our partner organization identifies individuals who are eligible and interested in taking part in a specific campaign, and shares their name and email with us so we can contact them about participating, coordinate their involvement, and report on the campaign. | Legitimate interest – we have a legitimate interest in contacting individuals identified by our trusted partners as eligible and interested participants. Our partner is responsible for any eligibility screening, including where this relates to health information; GRC does not receive, record, or store diagnosis or other special category data as part of this process. |
| Country | Participants are based in the country where our partner organization operates (for example, the United Kingdom). We note this because it affects how we handle international data transfers and which safeguards apply. | Legitimate interest – knowing a participant’s country helps us apply the correct data protection safeguards, given GRC is based in and stores data in the United States. |
Special category data
The UK and the EU GDPR defines special category data as:
- personal data revealing racial or ethnic origin;
- personal data revealing political opinions;
- personal data revealing religious or philosophical beliefs;
- personal data revealing trade union membership;
- genetic data;
- biometric data (where used for identification purposes);
- data concerning health;
- data concerning a person’s sex life; and
- data concerning a person’s sexual orientation.
We don’t process any special category data ourselves. However, some of our campaigns are focused on a particular health condition. In these cases, our partner organizations handle any eligibility screening involving health information on our behalf; GRC itself does not collect, receive, or store diagnosis or other special category data about campaign participants.
3. Statutory or contractual requirements or an obligation to provide your data
You do not have any obligations at all to provide us with your data. Any data that you provide to us is with your consent and that consent can be revoked at any time.
Please note that if you provide inaccurate personal data, we won’t be able to send you the information that you have requested.
4. Automated decision making
5. Who we share your data with
| Entity | Legal basis for sharing |
|---|---|
| Our member organisations in different countries and our secretariat. | Legitimate interest – we would like to put you in touch with our partner organisations in your country and our secretariat: Global Alliance for Patient Access. Please let us know if you don’t want your data shared this way. |
| Third parties to whom we outsource certain services such as IT systems or software providers, IT support service providers, PR and marketing companies who manage our newsletters. | Legitimate interest – we have a legitimate interest in using third party providers to help us. |
Whenever we share your personal information, we will do so in line with our obligations to keep your information safe and secure.
We conduct an appropriate level of due diligence and put in place contractual documentation in relation to any sub-contractor to ensure that they process personal data appropriately and according to our legal and regulatory obligations.
6. Where your information is processed
We are a US based organisation and your data is held in the USA. The USA is a ‘non-adequate’ country as determined by the EU Commission and the UK government.
7. How we protect your information
We are a US based organisation and your data is held in the USA. The USA is a ‘non-adequate’ country as determined by the EU Commission and the UK government. We take information and system security very seriously and we strive to comply with our obligations at all times. Any personal data which is collected, recorded, or processed in any way, whether on paper, online or any other media, will have appropriate safeguards applied in line with our data protection responsibilities.
Your data is protected by controls designed to minimise loss or damage through accident, negligence, or deliberate actions. Our employees are trained to protect sensitive or confidential information when storing or transmitting data in any medium including electronically and must undertake annual refresher exercises on this.
8. How long we keep your information for
| Organisation | Retention period |
| GRC newsletter | We will keep your data for as long as you are happy to receive our newsletters and updates. We review our subscribers list every three months and inactive users are archived. |
| Campaigns | If you wish to participate of a campaign, we will keep your data for 2 years after the launch of the campaign. Upon campaign launch, we will formally ask you if you’d like to subscribe to our newsletter. After 2 years, if you have not consented to being added to our newsletter list, we will erase your contact from our database. This excludes the final campaign product, which GRC is allowed to share with our network. |
| Unsubscribes | We will keep your data for as long as you are happy to receive our newsletters and updates. We review our subscribers list every three months and inactive users are archived. You can unsubscribe at any time by using the link at the bottom of every email GloPAKH sends or by emailing info@gafpa.org. If you unsubscribe to the GAfPA newsletter, we will hold your data in a suppression list for five years so that we don’t contact you again by mistake. You can unsubscribe at any time by using the link at the bottom of every email GAfPA sends or by emailing info@gafpa.org. |
9. How to access your information and your other rights
You have the following rights in relation to the personal data we hold about you:
- Your right of access
If you ask us, we’ll confirm whether we’re processing your personal data and, if necessary, provide you with a copy of that personal data (along with certain other details). If you require additional copies, we may need to charge a reasonable fee. - Your right to rectification
If the personal data we hold about you is inaccurate or incomplete, you are entitled to request to have it rectified. If you are entitled to rectification and if we’ve shared your personal data with others, we’ll let them know about the rectification where possible. If you ask us, where possible and lawful to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly. - Your right to erasure
You can ask us to delete or remove your personal data in some circumstances such as where we no longer need it or if you withdraw your consent (where applicable). If you are entitled to erasure and if we’ve shared your personal data with others, we’ll let them know about the erasure where possible. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly. - Your right to restrict processing
You can ask us to ‘block’ or suppress the processing of your personal data in certain circumstances, such as where you contest the accuracy of that personal data or you object to us. If you are entitled to restriction and if we’ve shared your personal data with others, we’ll let them know about the restriction where it is possible for us to do so. If you ask us, where it is possible and lawful for us to do so, we’ll also tell you who we’ve shared your personal data with so that you can contact them directly. - Your right to data portability
You have the right, in certain circumstances, to obtain personal data you’ve provided us with (in a structured, commonly used and machine-readable format) and to reuse it elsewhere or to ask us to transfer this to a third party of your choice. - Your right to object
You can ask us to stop processing your personal data, and we will do so, if we are:- relying on our own or someone else’s legitimate interests to process your personal data, except if we can demonstrate compelling legal grounds for the processing; or
- processing your personal data for direct marketing purposes.
- Your right to withdraw consen
If we rely on your consent (or explicit consent) as our legal basis for processing your personal data, you have the right to withdraw that consent at any time. - Your right to lodge a complaint with a Supervisory Authority in your country
If you have a concern about any aspect of our privacy practices, including the way we’ve handled your personal data, you can report it to the Supervisory Authority in your country. We would, however, appreciate the chance to deal with your concerns before you approach the Supervisory Authority so please contact us in the first instance.