Privacy policy and cookies

Working together to handle personal data safely, respectfully and lawfully.

The Royal College of Obstetricians and Gynaecologists (the College) is a Data Controller for much of the personal information we collect and use. This includes current, past and prospective membership, employees, Officers/committee and board members, suppliers, clients, customers, and others with whom we have business, or with whom we communicate.

We are a small organisation with less than 250 employees, so we do not have a Data Protection Officer. This function is fulfilled by the Senior Information Risk Officer (SIRO). Our address is in the footer below and our email address is: dataprotection@rcog.org.uk.

We consider the lawful and correct treatment of personal information essential to the efficient and successful conduct of our business. We recognise it is crucial to fostering and maintaining the confidence of our main stakeholders and the wider public.

We are committed to handling personal information lawfully and correctly, and recognise the safeguards enshrined in data protection law. Our Privacy Policy tells you what, how and when we collect, process, share and destroy (or erase) the personal data collected for our business.

Please see our latest Data Protection Policy for further details on our commitment to data protection, including definitions of key terms used here, and how we protect your personal data.

RCOG ICO Registration

The Information Commissioner’s Office (ICO) is the UK’s independent body set up to uphold information rights. Find out more about their organisation and structure on their website: https://ico.org.uk/about-the-ico/

Reference number: Z6382904
Tier: Tier 1
Start date: 30 January 2025
End date: 29 January 2027.

Our purposes for processing personal information

The purposes we collect, process, share and store your personal information are:

• To provide you with training, education, support, research and library services throughout the Parts 1, 2 and 3 MRCOG and DRCOG examinations, sub-speciality expertise, continual professional development and performance monitoring, Advanced Training Skill Modules, and Advanced Professional Modules, in partnership with statutory education bodies where appropriate
• To quality assure education and training programmes
• To manage and deliver the Parts 1, 2 and 3 MRCOG and DRCOG examinations
• To deliver your Membership Ceremonies
• To manage and administer your membership with the College as a Trainee, Associate, Affiliate, Fellow, and Member, including College elections, doctor support, complaints and feedback
• To manage and administer the College’s committees and operations
• To develop O&G healthcare through dedicated research projects
• To develop and publish public information leaflets, clinical guidelines and journals
• To cascade O&G knowledge, learning and expertise globally
• To deliver meetings and events held at the College
• To process and aggregate your equality, diversity and inclusion (EDI) data where necessary and with your consent, then share anonymised analysis with relevant RCOG partners, such as the NHS Workforce Race Equality Standard (WRES)
• To raise money for the College through dedicated activities and fundraising
• To manage your registration on the College website, making regular checks with you and the Customer Relationship Management system to ensure your details and preferences are correct
• To keep you informed of O&G related events and activities either run by, commissioned or supported by the College
• To enable the digitisation and delivery of online services using IT and collaboration platforms – e.g. Microsoft Teams, SharePoint and Co-Pilot
• To provide you with an Archive and Museum service so you can access and use our Heritage Collections, including access to the collections facilitated in partnership with colleagues within the College only
• To recruit, manage, administer, performance manage, pay and professionally develop our staff and volunteers including direct employees, workers, honorary contractors and freelancers
• To ensure the health, safety and security (including CCTV) of employees, tenants, contractors and visitors to our premises
• To manage and deliver the essential administrative, financial and audit functions of the College, including fraud prevention and the handling of all Individual Rights Requests.

The RCOG is not responsible for Third Party Privacy Notices but these are checked as part of completing contractual due diligence with them – you are advised to check them too.

In addition to the above purposes for how the RCOG processes your identifiable data, your anonymised data may be used by the College:

• To compare diversity monitoring data of volunteers and to monitor whether our volunteer cohort reflects the breadth and diversity of our membership
• To monitor and report on performance of exam candidates across the protected characteristics
• To monitor and report on progression of trainees, e.g. ARCP outcomes, across the protected characteristics
• To feed into the workforce census and AAC process to support campaigning, influencing, workforce planning and evaluation of work such as retention initiatives
• To ensure our examiner cohort reflects the breadth and diversity of our membership
• To report on diversity across all awards, and monitor diversity within our events, media spokespeople and panel members and ensure it reflects our membership.

Our lawful bases for processing personal information

All personal data must have a lawful basis for processing. The College must select the relevant lawful basis from the following, as listed in Articles 6 and 9 in the UK GDPR:

• Personal data processing (Article 6):
  1. Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
  2. Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
  3. Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
  4. Vital interests: the processing is necessary to protect someone’s life.
  5. Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
  6. Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data, which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)
  7. Recognised legitimate interests: the processing is specified for handling personal information that is in the public interest. For example, share it with an organisation who needs it to fulfil their public task or official conditions, and to protect the physical, mental or emotional well-being of people needing extra support.
• Special category data processing (Article 9):
  1. the data subject has given explicit consent
  2. processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law
  3. processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent
  4. processing is carried out in the course of its legitimate activities with appropriate safeguards by specific organisations, on condition that the processing relates solely to the members or to former members of that organisation
  5. processing relates to personal data made public by the data subject
  6. processing is necessary for the establishment, exercise or defence of legal claims
  7. processing is necessary for reasons of substantial public interest
  8. processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services
  9. processing is necessary for reasons of public interest in the area of public health
  10. processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical.

As the College is a charitable, membership organisation, not all of the bases listed may be relevant for the purpose of the personal data processing.

Special category College Membership data is processed under Article 9(g) substantial Public Interest. It is only shared where explicit consent is obtained or where it has been fully anonymised and does not identify the individuals concerned.

Please see our Data Protection Policy for a glossary of terms and definitions.

The recipients of the personal information we process

The College only shares personal information where we have a lawful basis to do so. The recipients of such information include:

• College employees
• trainees, Fellows and Members, including Associates and Affiliates
• RCOG Officers/Council/committee and Board of Trustee members
• contracted suppliers and partners
• international and national professional partners, such as other O&G and specialist societies
• NHS Trusts and hospitals
• Regional NHS commissioning boards, including NHS England
• private healthcare providers.

Sharing information with partners

When the College has a lawful basis for sharing personal data with external third party individuals, contractors, suppliers, partner organisations, Data Processors or Data Controllers, the sharing is governed by:

• EITHER, a UK GDPR compliant contract/service agreement – e.g. written, current and containing the RCOG Data Protection Schedule;
• OR, a UK GDPR compliant information sharing agreement based on NHS Digital standards.

Please see the Records Management and Data Protection Policies and Procedures for details.

Our international transfers of personal information

The College is an international organisation so we process and transfer personal information with the EU/EEA and across the World.

We ensure adequate safeguards are in place to process and transfer your personal information securely.

Adequate safeguards include:

• Countries either signing up to the requirements of UK GDPR, or equivalent, by obtaining an “adequacy” decision by the UK government
• The new Information Commissioner Office’s (ICO) approved processes for the international transfer of data, e.g. completing and signing the new International Data Transfer Agreement.

Our protection of personal information

The College is certified by Cyber Essentials Plus security accreditation, which is audited and renewed annually. We ensure all our partners processing personal information on our behalf meet the same or equivalent standards.

Our retention of personal information

The College has an established Retention Schedule developed in line with statutory requirements and the best practice outlined by the NHS, The National Archives and the Information Commissioner’s Office.

All of our records, including those containing personal information, are managed according to this schedule. This ensures the College only retains personal information for the minimum amount of time necessary.

Individual’s rights to the personal information we process

Data Subjects have:

1. the right to be informed - e.g. Fair processing/privacy notices
2. the right of access - e.g. subject access requests (SARs)
3. the right to rectification - e.g. have their data corrected
4. the right to erasure – e.g. have their data deleted/removed
5. the right to restrict processing – e.g. stop their data being used
6. the right to data portability – e.g. transfer their data easily
7. the right to object – e.g. challenge what we’re doing with their data
8. rights in relation to automated decision making and profiling – e.g. safeguards to make sure we do not make potentially damaging decisions about them without human involvement.

Please see our Individual Rights Request guidance for further detail and our online form if you want to make a request.

How to complain

Data Subjects have the right to complain to the College on how it processes their personal data. As per the new Data (Use and Access) Act 2025, complaints should be submitted, in the first instance, under the RCOG Complaints policy and procedure.

If we can’t resolve the issue, you can escalate your complaint to the Information Commissioner, who is an independent regulator, in the following ways:

Email: icocasework@ico.org.uk
Telephone: 0303 123 1113
Textphone: 01625 545860

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF.

National Data Opt Out Policy

All health and care organisations must comply with the national data opt-out policy by March 2020. This requirement is supported by Information Standard: DCB3058: Compliance with National Data Opt-outs.

To comply with the national data opt-out policy, we have put procedures in place to review uses or disclosures of confidential patient information against the operational policy guidance. For example, built the requirements into our Data Protection Impact Assessments, contract clauses and Information Sharing arrangements, as well as adopting technical solutions where appropriate.

Therefore, the College commits to only processing health/patient data where the Data Subjects have not opted out of their data to be used for secondary purposes such as research.

Our Privacy Policy “in practice”

The College applies the privacy policy into the following day-to-day practice:

• All personal data collection forms refer to this Policy and sometimes supplement it with further explanations using ICO derived checklists
• Where consent is the lawful basis for processing, we obtain specific, informed and explicit consent using ICO derived checklists
• Regular housekeeping of your personal data is undertaken to ensure compliance with the College Retention Schedule
• All changes to the Privacy Policy are shared with College members.

Supporting Privacy Notices from across the College

The College has developed detailed privacy policies for the following processing of personal data across the College:

• Chief Executive’s Office
  • People and Organisational Development
    • Recruitment
    • Terms and Conditions of Employment
• Membership, Global and Governance
  • Corporate Governance
    • Officer and Council Elections.

Cookies

This Cookies Policy explains how the College uses cookies on our website, in compliance with the UK General Data Protection Regulation (UK GDPR) and the Privacy and Electronic Communications Regulations (PECR). Cookies are small text files downloaded to your device when you visit our website.

How we use cookies

We use cookies for various purposes, categorized as follows:

• Strictly necessary cookies: Essential for our website to function and cannot be turned off. They enable core functionalities like secure login and online booking services.
• Analytics/performance cookies: Allow us to measure and improve the performance of our site by understanding how visitors interact with our content.
• Marketing cookies: Track visitor activity across different websites to deliver relevant advertisements. These require your explicit consent.

Cookie details

Please refer to the cookies table (Appendix I) for detailed information about the specific cookies we use, their purposes, duration, and whether they are first-party or third-party cookies.

We currently use cookies from Azure (the site’s host), Civic Cookie Control (the tool that manages your use of cookies), Facebook (for marketing), and Google Analytics (for measuring site performance).

Consent and cookie preferences

You can manage your cookie preferences at any time through our cookie consent control panel, accessible from the icon at the bottom right corner of every page on our website. Through this panel, you can freely give or withdraw your consent for analytics and marketing cookies. Please note that you cannot disable strictly necessary cookies as the website requires them to function properly.

You can also manage cookies through your browser settings. For guidance on managing cookies via browser settings, please refer to the ICO’s cookie guidance page.

Changes to this policy

We regularly review and update this policy. Please check periodically to stay informed of any updates. This policy was last updated in April 2025.

Contact information

If you have any questions about this policy or our data protection practices, please contact the Information Governance Team:

• Email: dataprotection@rcog.org.uk
• Postal Address: 10–18 Union Street, London, SE1 1SZ, UK
• Telephone: +44 20 7772 6309

Appendix I: Cookies on the RCOG site

Azure

Microsoft Azure, often referred to as Azure, is a cloud computing platform run by Microsoft. It offers access, management, and the development of applications and services through global data centres.

Cookie Control

Cookie Control is the well-known CMP created by CIVIC UK, to manage consent for your website's cookies. Cookie Control is used by the UK ICO.

Facebook

Meta Platforms, Inc., doing business as Meta, and formerly named Facebook, Inc., and TheFacebook, Inc., is an American multinational technology conglomerate based in Menlo Park, California. The company owns and operates Facebook, Instagram, Threads, and WhatsApp, among other products and services.

Google Analytics

Google Analytics is a web analytics service offered by Google that tracks and reports website traffic and also the mobile app traffic & events, currently as a platform inside the Google Marketing Platform brand.

For further advice concerning any aspect of this policy, please contact the Information Governance (IG) Team by email or call +44 20 7772 6309.