Privacy Policy

Last updated: 27 July 2026

1. About this Privacy Policy

This Privacy Policy explains how personal information is collected, used, stored and protected when you visit wearemecp2dup.org or communicate with MECP2 Duplication Global through the website.

MECP2 Duplication Global is an international alliance of non-profit organisations working together to support people and families affected by MECP2 Duplication Syndrome, advance research and improve understanding of the condition.

In this Privacy Policy, “we”, “us” and “our” refer to the data controller identified above.

2. Scope of this policy

This Privacy Policy applies to:

  • visitors to wearemecp2dup.org

  • people who contact us through the website

  • people who subscribe to our email updates

  • people who communicate with us by email or through social media

  • people who submit stories, feedback or other information to us

This Privacy Policy does not automatically apply to websites operated by our member organisations, the REMEDS patient registry, social media platforms or other external services. Those organisations will have their own privacy policies and may act as separate data controllers.

3. Personal information we collect

Depending on how you interact with us, we may collect the following information.

Information you provide

This may include:

  • your name

  • your email address

  • your organisation or role, where relevant

  • the subject and content of an enquiry

  • your newsletter and communication preferences

  • information included in correspondence with us

  • stories, comments, photographs or other materials you choose to submit

  • records of permissions or consent you provide

Technical and usage information

When you use the website, we or our service providers may collect:

  • your IP address

  • browser and device type

  • operating system

  • approximate country or region

  • pages visited and links selected

  • date, time and duration of visits

  • referring website or search engine

  • cookie identifiers and consent preferences

  • website security and error logs

Non-essential analytics information will only be collected where you have provided consent, when consent is required by applicable law.

4. Health and other sensitive information

Because our work concerns a rare medical condition, an enquiry or story submitted to us may include information about:

  • physical or mental health

  • disability

  • genetic information

  • medical treatment or diagnosis

  • a child or family member

  • racial or ethnic background

  • other sensitive personal circumstances

Under UK and European data protection law, some of this information is known as special category personal data and receives additional protection.

You are not required to provide detailed medical information through the general contact form. Please only provide information that is reasonably necessary for us to respond to your enquiry.

Where we ask you to submit health or other sensitive information, we will normally ask for your explicit consent to use that information for the stated purpose. You may withdraw your consent at any time, although this will not affect processing that has already taken place.

We do not use health, genetic or other sensitive information for advertising, profiling or commercial marketing.

5. How and why we use personal information

We may use personal information for the following purposes.

Responding to enquiries

We use your contact details and message to:

  • respond to questions

  • provide information or signposting

  • direct you to an appropriate member organisation

  • manage ongoing correspondence

Our lawful basis is normally our legitimate interest in responding to people who contact us. Where an enquiry contains health or other sensitive information, we will also rely on an appropriate special category condition, normally explicit consent.

Sending newsletter and email updates

Where you subscribe, we may send you:

  • research updates

  • news about MECP2 Duplication Syndrome

  • information about the alliance

  • family stories

  • campaigns, events or opportunities to get involved

Our lawful basis is your consent. You can unsubscribe at any time by using the unsubscribe link in an email or contacting us.

Unsubscribing will not prevent us from sending essential administrative messages relating to a separate enquiry you have made.

Operating and protecting the website

We use technical information to:

  • operate and maintain the website

  • prevent spam, fraud and misuse

  • identify security incidents

  • investigate technical problems

  • protect our systems and users

  • maintain records of cookie choices

Our lawful basis is our legitimate interest in operating a safe and reliable website and, where applicable, compliance with legal obligations.

Understanding website use

Where you consent to analytics, we may use aggregated website information to understand:

  • how visitors find the website

  • which pages are most useful

  • how the website performs

  • how content and accessibility can be improved

Our lawful basis is consent where required by law. We aim to use aggregated or de-identified information wherever reasonably possible.

Sharing stories and community content

We will only publish an identifiable personal story, photograph, quotation or similar material with appropriate permission.

We may ask you to approve:

  • the content to be published

  • your preferred name or level of anonymity

  • the countries and channels where it may appear

  • whether photographs or video may be used

  • how long permission will last

A separate consent or release form may be used for this purpose.

Legal, regulatory and safeguarding purposes

We may use or disclose information where reasonably necessary to:

  • comply with a legal obligation

  • establish, exercise or defend legal claims

  • respond to a lawful request from a regulator or public authority

  • investigate fraud, abuse or security incidents

  • protect the vital interests of an individual

  • address a serious safeguarding concern

6. Information about other people

If you provide information about another person, including a child or family member, you must have an appropriate basis for doing so.

Where possible, avoid providing names, medical records or other identifying information about another person unless it is necessary and you have their permission or are authorised to act for them.

7. Newsletter provider

We may use a specialist email service provider to manage subscriptions and send newsletters.

The provider may process your email address, subscription status, consent record and limited information about email delivery or engagement.

Where email engagement tracking is enabled, we will explain this in our cookie or consent settings and disable it where required by your choices or applicable law.

We do not purchase third-party marketing lists.

8. Contact forms and anti-spam protection

Our website uses contact forms and may use a CAPTCHA or similar anti-spam and security service.

These services may process technical information such as your IP address, browser information and interaction with the form to distinguish genuine users from automated activity.

Further information about cookies used by these services is available in our Cookie Policy and Cookie Settings.

9. REMEDS and external patient registries

The REMEDS patient registry is accessed through a separate website and is not covered by this Privacy Policy unless expressly stated otherwise.

Information entered directly into REMEDS, including medical, clinical, demographic or registry information, will be processed in accordance with the REMEDS privacy notice and consent documentation.

We do not automatically receive personal or medical information that you submit to REMEDS merely because we link to it.

You should read the REMEDS privacy information carefully before registering or completing a medical survey.

10. When we share personal information

We may share personal information with trusted organisations that help us operate the website and communicate with you, including:

  • website developers and technical support providers

  • email and newsletter providers

  • cloud storage and IT providers

  • website analytics providers

  • form, CAPTCHA and anti-spam providers

  • professional advisers

  • regulators, courts or public authorities where legally required

These providers are only permitted to use personal information for agreed purposes and must apply appropriate security and confidentiality protections.

Member organisations

Where appropriate, we may ask for your permission to forward an enquiry to one of our member organisations, for example where that organisation can provide local information or support.

Unless the law permits otherwise, we will not share sensitive health information with a member organisation without your consent.

A member organisation receiving your information may act as a separate data controller and will be responsible for explaining how it uses your information.

11. Sale and targeted advertising

We do not sell personal information.

We do not share personal information for cross-context behavioural advertising, targeted advertising or profiling in furtherance of decisions that produce legal or similarly significant effects.

If these practices change, we will update this Privacy Policy and provide any consent or opt-out mechanisms required by law.

12. International transfers

The website is hosted in the United Kingdom. However, some service providers, alliance members or recipients may be located outside the United Kingdom or the country in which you live.

Where personal information is transferred internationally, we will use an appropriate legal mechanism where required, such as:

  • a government adequacy decision

  • the UK International Data Transfer Agreement

  • the UK Addendum to the EU Standard Contractual Clauses

  • EU Standard Contractual Clauses

  • contractual and organisational safeguards

  • another lawful transfer mechanism

You may contact us for further information about safeguards relevant to your personal information.

13. How long we keep information

We keep personal information only for as long as reasonably necessary for the purpose for which it was collected.

Our usual retention periods are:

  • general enquiries: up to 24 months after the last meaningful contact

  • health or sensitive information included in an enquiry: only for as long as necessary to respond, normally no longer than 12 months unless ongoing support or another lawful reason applies

  • newsletter subscriptions: until you unsubscribe or the service is discontinued

  • newsletter consent and suppression records: up to 6 years after withdrawal or unsubscribe

  • story and publication permissions: for the duration of publication and any additional period stated in the relevant agreement

  • cookie consent records: up to 6 years

  • website security logs: normally up to 12 months

  • analytics information: for the period shown in our Cookie Settings

  • legal, complaint and regulatory records: normally up to 6 years after closure

We may retain information for longer where required by law, necessary for safeguarding, or needed to establish, exercise or defend legal claims.

Information may be securely deleted or anonymised when it is no longer required.

14. Your privacy rights

Depending on where you live and the law that applies, you may have the right to:

  • request access to your personal information

  • request correction of inaccurate or incomplete information

  • request deletion of your information

  • restrict how your information is used

  • object to certain processing

  • receive certain information in a portable format

  • withdraw consent

  • opt out of certain advertising, sales, sharing or profiling

  • complain to a data protection regulator

  • appeal a decision relating to a privacy request, where applicable

  • appoint an authorised representative to make a request, where permitted

These rights are not absolute and may be subject to legal exceptions.

To exercise a right, contact info@wearemecp2dup.org. We may need to verify your identity before completing a request. We will not discriminate against you for exercising a privacy right.

15. Additional information for United States residents

Residents of certain US states may have additional rights under applicable state privacy law.

These may include rights to know, access, correct, delete or obtain a copy of personal information, and to opt out of the sale or sharing of personal information, targeted advertising or certain profiling.

We do not currently sell personal information or use it for cross-context behavioural advertising.

Where legally required and technically supported, we will treat a recognised universal opt-out signal, such as Global Privacy Control, as a request to opt out of relevant data sharing.

We do not use sensitive personal information to infer characteristics about individuals for advertising or unrelated commercial purposes.

16. Children’s information

The website provides information relating to a condition that primarily affects children, but our contact and newsletter services are intended mainly for parents, caregivers, healthcare professionals, researchers and other adults.

We do not knowingly ask children to submit personal or medical information directly to us.

If you are under 16, or under the relevant age in your country, please ask a parent or guardian to contact us on your behalf.

Parents or guardians who believe that a child has submitted information without appropriate permission should contact us so that we can review and, where appropriate, delete it.

17. Security

We use reasonable technical and organisational measures designed to protect personal information against:

  • loss

  • unauthorised access

  • inappropriate use

  • alteration

  • disclosure

  • destruction

These measures may include secure hosting, access controls, encryption, software updates, security monitoring, backups and staff or contractor confidentiality obligations.

No website or electronic transmission can be guaranteed to be completely secure. You should avoid submitting unnecessary medical records, passwords or highly sensitive information through a general website form.

18. Automated decision-making

We do not use personal information collected through this website to make solely automated decisions that have legal or similarly significant effects on individuals.

19. Cookies

We use cookies and similar technologies for website operation, security, consent management and, where you agree, analytics or other optional functions.

Further information is available in our Cookie Policy and Cookie Settings.

20. External links and social media

The website contains links to member organisations, the REMEDS registry, social media platforms and other external websites.

We are not responsible for the privacy, security or content of websites operated by other organisations. You should review their privacy information before providing personal information.

Interactions with our social media pages may also be processed by the relevant social media platform under its own terms and privacy policy.

21. Complaints

Please contact us first if you have a concern about how we use personal information. We will try to investigate and resolve the issue.

You may also complain to the UK Information Commissioner’s Office or the data protection authority in the country where you live or work.

22. Changes to this policy

We may update this Privacy Policy to reflect changes to the website, our services, our providers or applicable law.

The latest version will be published on this page with an updated revision date. Where a change materially affects how we use personal information, we will provide additional notice where appropriate.

23. Contact us

For privacy questions, requests or complaints, contact:
Email: info [at] wearemecp2dup.org


Join the REMEDS patient registry
Skip to toolbar