Privacy Policy
Plympton Chiropractic is aware of its obligations under the General Data Protection Regulation (GDPR) and is committed to protecting the privacy and security of your personal information. This privacy policy describes, in line with GDPR, how we collect and use your personal data during and after your time as a patient of this clinic. It also sets out who we might share your information with, how long we keep it for and how we protect it. This policy applies to current and former patients.
IMPORTANT INFORMATION
Data controller details
Plympton Chiropractic is a data controller, meaning that it determines the processes to be used when using your personal data. We have appointed a Data Privacy Manager, who is responsible for overseeing questions and requests in relation to this privacy policy. The contact details are as follows:
Data Privacy Manager: Jenny Morris
Address: Plympton Chiropractic, Unit 1 Lister Mill Business Park, Lister Close, Plymouth, Devon PL7 4BA
Email: info@plymptonchiropractic.co.uk
Telephone: 01752 336053
Complaints
If you have any questions about this Privacy Policy or how we handle your information, please contact the Clinic’s Data Privacy Manager in the first instance. You also have the right to make a complaint to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk).
Changes to the Privacy Policy and your duty to inform us of changes
This version was updated in May 2018. Historic versions can be obtained by contacting us. It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your time as a patient with us.
THE DATA WE COLLECT ABOUT YOU
Types of information we hold about you
Personal data or information means any information about an individual from which that person can be identified. It does not include data where the identity has been removed.
We may collect, use, store and transfer different kinds of personal data about you, which we have grouped together as follows:
- Identity Data: Your personal details including your title, name, date of birth and gender
- Contact Data: Address, email address and phone numbers
- Special Category Data: Health and medical information (this includes data relating to your Chiropractic examinations and treatment at the Clinic and letters of referral regarding your health.
- Financial Data: Bank account and payment card details
- Transaction Data: Details about payments from and to you and other details of products and services you have purchased from us.
We also collect, use and share Aggregated Data such as statistical or demographic data for any purpose. Aggregated Data may be derived from your personal data but is not considered personal data in law as this data does not directly or indirectly reveal your identity. However, if we combine or connect Aggregated Data with your personal data so that it can directly or indirectly identify you, we treat the combined data as personal data which will be used in accordance with this privacy notice.
HOW YOUR PERSONAL DATA IS COLLECTED
We use different methods to collect data from and about you, including through:
- Direct interactions: You may give us your Identity, Contact, Special Category and Financial Data when you become a patient. At this clinic, we keep paper and electronic records. Information we write down on paper may be transferred to our electronic system.
- Third parties or publicly available sources: We may receive personal data about you from various third parties and public sources as set out below:
- Referrers: May provide us with data about your health to facilitate your treatment with us, such as GP’s and other Health Care Providers. We may also hold the results of tests that you have undertaken and that are relevant to your treatment at the clinic.
- Insurance Companies
- Solicitors
HOW WE USE YOUR PERSONAL DATA
We will only use your personal data when the law permits us to. Most commonly, we will use your personal data in the following circumstances:
Performance of our contract with you (your requesting treatment and our agreement to provide it constitutes a contract)
- To register you as a new patient or take steps to register you as a new patient.
- To confirm appointments, inform you of changes to appointments or clinic arrangements, changes to facilities or services at the clinic.
- To comply with our obligations under our contract, namely to provide you with the necessary treatment.
Legitimate interests
This means the interest of our business in conducting and managing our business to enable us to give you the best service and the best and most secure experience. We make sure we consider and balance any potential impact on you (both positive and negative) and your rights before we process your personal data for our legitimate interests. An example of this is:
- To collect and recover money owed to us.
- To provide you with the best possible treatment by recording health and treatment information which would be in your best interest.
- Where it is necessary for our legitimate interests and your interests and fundamental rights do not override those interests
Legal or regulatory obligation
- We also rely on the legal or regulatory obligation ground to process your data in some circumstances. This means processing your personal data where it is necessary for compliance with a legal or regulatory obligation that we are subject to.
Processing your special category data (Health Data)
To process your special category data, we rely on the contractual ground and also the special condition which allows health professionals to process the data for the purposes of preventative or occupational medicine, and the provisions of health care treatment.
Marketing
We strive to provide you with choices regarding certain personal data uses, particularly around marketing and advertising. If you would like to receive marketing from us we ask for your express consent.
Change of purpose
We will only use your personal information for the purposes for which we collected it unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so. Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
If you do not provide your data to us
One of the reasons for processing your data is to allow us to carry out our duties in line with your contract of care with us. If you do not provide us with the data needed to do this, we will be unable to perform that care to ensure your best interests are being maintained. We may also be prevented from continuing with your treatment with us due to our legal obligations.
Where your data is stored
- Personal data is kept in the clinic in locked filing cabinets and the building is always locked out of working hours.
- Electronic health and medical data is kept on a cloud based specialist medical records service. We use Private Practice Software (PPS).
- Data may also be stored on our office computers. These are also password protected, backed up regularly, and the building is locked out of hours.
- With your consent, your data (specifically name and email address) may also be stored on the servers of cloud based providers such as Mailchimp and Rehab My Patient for the purpose of sending you exercise plans and updates about the clinic.
- All providers of electronic data storage have given us their assurances that they are fully compliant with the General Data Protection Regulations. Access to all electronic data is password protected.
SHARING YOUR DATA
We may have to share your personal data with the parties set out below for the purposes set out previously:
- Colleagues within the Clinic but only where it is necessary for them to undertake their duties. This includes, for example, other chiropractors working for, at or on behalf of the clinic, other healthcare practitioners working at the clinic, should you wish to make an appointment with them, and reception staff. Medical histories and sensitive personal information would only be shared with other healthcare practitioners with your consent.
- We may share your data with third parties in order to facilitate a referral to another healthcare practitioner, investigation or to keep your GP informed about your progress with treatment.
- Service Providers who provide IT and system administration services
- Professional Advisers including lawyers, bankers, auditors and insurers based in the United Kingdom who provide consultancy, banking, legal, insurance and accounting services.
- HM Revenue & Customs, Regulators and other authorities based in the United Kingdom who require reporting of processing activities in certain circumstances.
- Third parties to whom we may choose to sell, transfer, or merge parts of our business or our assets. Alternatively, we may seek to acquire other businesses or merge with them. If a change happens to our business, then the new owners may use your personal data in the same way as set out in this privacy notice.
- We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.
INTERNATIONAL TRANSFERS
We may share your data with bodies outside of the European Economic Area should the need arise. It is likely that this situation would be to share information regarding your treatment or ongoing care with healthcare practitioners in these countries in accordance with your wishes. However, we would not transfer your data unless we were assured that the country in question had data security and protection laws of equivalence to those of the UK and the European Economic Area.
DATA SECURITY – PROTECTING YOUR DATA
We have put in place measures to protect the security of your information against accidental loss or disclosure, alteration, unauthorised access, destruction or abuse. We have implemented processes to guard against such. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
DATA RETENTION
How long we keep your data for
We have a legal obligation to retain your records for eight years after your most recent appointment (or until the age of 25, if this is longer) but after this period, you can ask us to delete your records if you wish. Otherwise, we will retain your records indefinitely in order that we can provide you with the best possible care should you need us at some future date.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Should you wish us to delete your records, we will dispose of your data in a secure manner that maintains data security.
YOUR LEGAL RIGHTS
Under certain circumstances, you have rights under data protection laws in relation to your personal data:
- Request access to your personal information. This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
- Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
- Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below), where we may have processed your information unlawfully or where we are required to erase your personal data to comply with local law.
- Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
- Request the restriction of processingof your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
- Request the transfer of your personal information to another party.
- Withdraw consent at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain products or services to you. We will advise you if this is the case at the time you withdraw your consent.
If you want to exercise any of the above rights, please contact Data Privacy Manager in writing.
Fees
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee for a second or subsequent copy of information or if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is a security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
Time limit to respond
We try to respond to all legitimate requests within one month. Occasionally it may take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.