UKREMT Privacy Notice

UKREMT is the UK Register of Emergency Medical Teams. It is a managed voluntary register for pre-hospital clinicians, responders, event medical staff and emergency medical teams. UKREMT is hosted by GWAS Ambulance Charity CIO.

For data protection purposes, UKREMT / GWAS Ambulance Charity CIO is responsible for deciding how personal data submitted through the UKREMT website and application process is used.

This Privacy Notice explains how UKREMT collects, uses, stores and shares personal data when someone:

• applies to join UKREMT
• creates or manages a member account
• uploads evidence or documents
• appears on the public registration check
• uses a digital member card or certificate
• contacts UKREMT
• raises a Fitness to Practise concern
• is involved in a Fitness to Practise investigation, review or appeal
• uses the UKREMT website or member portal

UKREMT may collect and process the following categories of personal data where relevant:

• name and contact details
• date of birth
• address or town / region
• email address and telephone number
• registration number / PIN
• declared qualifications and clinical grade
• evidence of qualifications, certificates, training or CPD
• employment, volunteering or experience information
• identity verification information where required
• DBS status or declaration information where requested
• professional registration details, where applicable
• uploaded documents and supporting evidence
• public register status
• digital ID card and certificate information
• application history and renewal history
• account login and system activity information
• communications with UKREMT
• complaints, concerns, Fitness to Practise information, investigation records, outcomes, reviews and appeals
• safeguarding or public protection information where relevant and lawful

UKREMT uses personal data to:

• receive and assess applications
• verify identity, qualifications, training and registration eligibility
• maintain the UKREMT managed voluntary register
• issue digital member cards and certificates
• allow members, employers and the public to check registration status
• manage renewals, CPD and revalidation
• communicate with applicants and registrants
• respond to enquiries
• manage governance, audit and quality assurance
• investigate Fitness to Practise concerns
• manage reviews, appeals and outcomes
• protect patients, service users, members and the public
• prevent fraud, misuse of UKREMT status or forged documentation
• comply with legal, regulatory, safeguarding, insurance, governance and record-keeping obligations

UKREMT processes personal data under one or more of the following lawful bases:

• consent, where UKREMT genuinely relies on consent for optional processing, such as an optional publication feature or marketing communication
• contract or steps requested before entering a contract, where processing is required to assess and administer registration or membership
• legitimate interests, where processing is necessary for the operation, governance, verification, historical integrity and protection of the managed voluntary register, subject to a balancing assessment
• legal obligation, where UKREMT is required to retain, disclose or process information by law
• vital interests, where processing may be necessary to protect someone's life or safety

For special category data, UKREMT may rely on conditions relating to explicit consent, employment / social protection obligations, legal claims, substantial public interest, safeguarding, health or social care governance, or protection of the public, where applicable.

UKREMT operates a public registration check so that employers, event organisers, patients, service users and members of the public can confirm a person's current or relevant historic status on the UKREMT managed voluntary register.

The public registration check may display limited information, such as:

• registrant name
• registration number / PIN
• city
• registration status, including where applicable Active, Pending, Lapsed, Suspended, Rejected, Removed or Voluntary Removed
• registration grade or level
• expiry date
• whether UKREMT currently records a valid Enhanced DBS status (status only — never the certificate number or expiry date)
• public notes or restrictions where appropriate and lawful

UKREMT will never publish a registrant’s full address, postcode, county or region, state, country, date of birth, telephone number, email address, DBS certificate number, DBS expiry date, private documents or uploaded certificates through the public register. Public location information is limited to CITY only. A member photograph is not exposed through the public register unless a future explicit opt-in consent control is introduced.

If registration ends, lapses, is suspended, is rejected, is removed, or is voluntarily withdrawn, UKREMT may continue to display a limited public verification record showing the relevant status and permitted registration details where this remains necessary and proportionate for verification, public protection, prevention of misrepresentation, governance, audit, Fitness to Practise, legal claims or the integrity of the Register. Voluntary withdrawal does not automatically erase the historical registration record.

UKREMT may use personal data to create digital ID cards, certificates and registration verification tools. These may include:

• name
• registration number / PIN
• registration grade or level
• expiry date
• QR code or verification link
• photograph, if the system uses one
• public registration status

Digital ID cards and certificates remain the property of UKREMT and may be withdrawn, suspended or updated if registration status changes.

UKREMT may process personal data and sensitive information when managing concerns, complaints, Fitness to Practise referrals, investigations, outcomes, reviews and appeals. This may include:

• referral forms
• witness statements
• evidence documents
• correspondence
• panel notes
• decisions and outcomes
• review and appeal records
• safeguarding or public protection information
• information from employers, event providers, training providers, statutory regulators, police or other relevant bodies where lawful and necessary

UKREMT will handle this information carefully and restrict access to authorised personnel only. Information may be shared where necessary to protect patients, service users, members, employers, the public, or the integrity of the register.

UKREMT may share personal data where necessary with:

• GWAS Ambulance Charity CIO personnel involved in UKREMT governance
• authorised UKREMT administrators, auditors or panel members
• system providers used to host and operate the website, application system, member portal and digital cards
• training providers, awarding bodies or employers for verification purposes
• event organisers or employers where verification or public safety requires it
• statutory regulators, such as HCPC, GMC or NMC, where relevant and lawful
• safeguarding bodies, police, legal advisers, insurers or courts where required or appropriate
• other parties where the registrant has given consent or where UKREMT has a lawful reason to share information

UKREMT will not sell personal data.

UKREMT will take reasonable technical and organisational steps to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. This includes:

• role-based access controls
• password-protected systems
• restricted admin access
• secure document handling
• audit and governance oversight
• limiting access to sensitive Fitness to Practise records
• removing or archiving data when no longer required

UKREMT will only keep personal data for as long as necessary for registration, governance, legal, audit, safeguarding, insurance, public protection or Fitness to Practise purposes.

• unsuccessful application records: normally up to 2 years
• active registrant records: for the duration of registration
• expired, lapsed, rejected, removed or voluntarily removed registrant records: retained for as long as reasonably necessary for verification, governance, prevention of misrepresentation, public protection, audit or legal-claims purposes; a limited public status record may remain visible where necessary and proportionate
• financial or transaction records, if any: normally 6 years
• Fitness to Practise, safeguarding or serious concern records: retained for as long as necessary for public protection, legal, insurance, governance or safeguarding reasons
• website enquiry records: normally up to 2 years unless linked to a registration or governance matter

Some records may be retained for longer where required for safeguarding, legal claims, public protection, audit, insurance or regulatory reasons.

Individuals have rights under UK data protection law. These may include the right to:

• be informed about how their data is used
• access their personal data
• ask for inaccurate data to be corrected
• ask for data to be erased in certain circumstances
• ask for processing to be restricted
• object to processing based on legitimate interests in certain circumstances; UKREMT will consider any objection and whether compelling legitimate grounds require continued processing
• object at any time to direct marketing; this right is absolute and routine marketing or newsletter communications will stop
• request data portability where applicable
• withdraw consent where processing is based on consent
• complain to the Information Commissioner's Office

To request access to personal data, correction of information, removal from public display, or to raise a data protection concern, please contact UKREMT using the website contact route or the email address listed in section 1 of this notice.

UKREMT may need to verify your identity before responding to a request.

If you are unhappy with how UKREMT handles your personal data, you should contact UKREMT first so that the issue can be reviewed.

You also have the right to complain to the Information Commissioner's Office (ICO).

UKREMT may update this Privacy Notice from time to time to reflect changes in law, governance, website functionality, registration processes or data handling arrangements. The current version will always be available on the UKREMT website.