Plympton Chiropractic is aware of its obligations under the General Data Protection Regulation (GDPR) and is committed to protecting the privacy and security of your personal information. This privacy policy describes, in line with GDPR, how we collect and use your personal data during and after your time as a patient of this clinic. It also sets out who we might share your information with, how long we keep it for and how we protect it. This policy applies to current and former patients.
IMPORTANT INFORMATION
Data controller details
Plympton Chiropractic is a data controller, meaning that it determines the processes to be used when using your personal data. We have appointed a Data Privacy Manager, who is responsible for overseeing questions and requests in relation to this privacy policy. The contact details are as follows:
Data Privacy Manager: Jenny Morris
Address: Plympton Chiropractic, Unit 1 Lister Mill Business Park, Lister Close, Plymouth, Devon PL7 4BA
Email: info@plymptonchiropractic.co.uk
Telephone: 01752 336053
Complaints
If you have any questions about this Privacy Policy or how we handle your information, please contact the Clinic’s Data Privacy Manager in the first instance. You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).
Changes to the Privacy Policy and your duty to inform us of changes
This version was updated in May 2018. Historic versions can be obtained by contacting us. It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your time as a patient with us.
THE DATA WE COLLECT ABOUT YOU
Types of information we hold about you
Personal data or information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed.
We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
HOW YOUR PERSONAL DATA IS COLLECTED
We use different methods to collect data from and about you, including through:
HOW WE USE YOUR PERSONAL DATA
We will only use your personal data when the law permits us to. Most commonly, we will use your personal data in the following circumstances:
Performance of our contract with you (your requesting treatment and our agreement to provide it constitutes a contract)
Legitimate interests
This means the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. An example of this is:
Legal or regulatory obligation
Processing your special category data (Health Data)
To process your special category data, we rely on the contractual ground and also the special condition which allows health professionals to process the data for the purposes of preventative or occupational medicine, and the provisions of health care treatment.
Marketing
We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. If you would like to receive marketing from us we ask for your express consent.
Change of purpose
We will only use your personal information for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
If you do not provide your data to us
One of the reasons for processing your data is to allow us to carry out our duties in line with your contract of care with us. If you do not provide us with the data needed to do this, we will be unable to perform that care to ensure your best interests are being maintained. We may also be prevented from continuing with your treatment with us due to our legal obligations.
Where your data is stored
SHARING YOUR DATA
We may have to share your personal data with the parties set out below for the purposes set out previously:
INTERNATIONAL TRANSFERS
We may share your data with bodies outside of the European Economic Area should the need arise. It is likely that this situation would be to share information regarding your treatment or ongoing care with healthcare practitioners in these countries in accordance with your wishes. However, we would not transfer your data unless we were assured that the country in question had data security and protection laws of equivalence to those of the UK and the European Economic Area.
DATA SECURITY – PROTECTING YOUR DATA
We have put in place measures to protect the security of your information against accidental loss or disclosure, alteration, unauthorised access, destruction or abuse. We have implemented processes to guard against such. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
DATA RETENTION
How long we keep your data for
We have a legal obligation to retain your records for eight years after your most recent appointment (or until the age of 25, if this is longer) but after this period, you can ask us to delete your records if you wish. Otherwise, we will retain your records indefinitely in order that we can provide you with the best possible care should you need us at some future date.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Should you wish us to delete your records, we will dispose of your data in a secure manner that maintains data security.
YOUR LEGAL RIGHTS
Under certain circumstances, you have rights under data protection laws in relation to your personal data:
If you want to exercise any of the above rights, please contact Data Privacy Manager in writing.
Fees
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee for a second or subsequent copy of information or if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.