GDPR 2018 PRIVACY NOTICE

Scope

This document refers to personal data, which is defined as information concerning any living person (a natural person who hereafter will be called the Data Subject) that is not already in the public domain.

The General Data Protection Regulation (GDPR), which is EU-wide and far more extensive than its predecessor the Data Protection Act, along with the Privacy and Electronic Communications Regulations (PECR), seek to protect and enhance the rights of EU data subjects.

These rights cover the safeguarding of personal data, protection against the unlawful processing of personal data, and the unrestricted movement of personal data within the EU and its storage within the EEA.

1 – Introduction

Meridian Wellbeing Clinic, based in Jersey, which hereafter for the purposes of this Privacy Notice will be referred to as the Osteopaths, Acupuncturist, and Colonic Hydrotherapist, is pleased to provide the following information.

2 – Who We Are

The Osteopaths, Acupuncturist, and Colonic Hydrotherapists diagnose and treat health conditions. Treatments are carried out in accordance with the Institute of Osteopathy’s patient charter: www.iosteopathy.org.
The practice may also provide other treatments, about which staff will be pleased to provide more details.

3 – Personal Data

a) For the purposes of providing treatment, Osteopaths may require detailed medical information. Only relevant and necessary data for treatment will be collected. Notes may include details concerning medication, treatment, and other issues affecting health. This data is held securely and not shared with anyone not involved in treatment, although for data storage purposes it may be handled by pre-vetted staff who have signed integrity and confidentiality agreements.
To process personal data, explicit consent is required to allow Osteopaths to document and process medical data. Contact details such as telephone numbers, email addresses, and postal addresses may be used to remind patients of future appointments and provide reports or other information concerning treatment.
As part of obligations as primary healthcare practitioners, there may be circumstances related to treatment, ongoing care, or medical diagnosis that require sharing medical records with other healthcare practitioners (e.g. GPs, consultants, surgeons, and/or medical insurance companies). Where this is required, patients will be informed first unless under a legal obligation to comply.

b) For marketing purposes, Osteopaths may use contact details to respond to enquiries, including making telephone contact and emailing information believed to be of interest.

c) In making initial contact with the practice, consent is given to Osteopaths maintaining a marketing dialogue until the patient opts out (which can be done at any time) or the practice decides to desist in promoting services. Osteopaths may occasionally act on behalf of patients in the capacity of data processor, promoting other practitioners based at the premises who may not be employed by the practice. Osteopaths do not broker data, and removal from the marketing database can be requested by emailing or phoning the practice using the contact details provided at the end of this Privacy Notice.

d) Some basic personal data may be collected from marketing forms and surveys, correspondence and phone calls, and details of visits to the website, including personally identifying information such as Internet Protocol (IP) addresses.

e) The Osteopaths’ website uses cookies, which are strings of information that a website stores on a visitor’s computer and that the visitor’s browser provides to the website each time the visitor returns. WordPress.org uses cookies to help Osteopaths identify and track visitors and their website access preferences. Website visitors who do not wish to have cookies placed on their computers should set their browsers to refuse cookies before using the website.

f) Osteopaths will only collect the information needed to provide the required services. The business does not sell or broker data.

4 – Legal Basis for Processing Any Personal Data

To meet contractual obligations obtained from explicit patient consent and legitimate interest to respond to enquiries concerning the services provided.

5 – Legitimate Interests Pursued by Osteopaths

To promote treatments for patients with all types of health problems indicated for osteopathic care.

6 – Consent

Through agreeing to this privacy notice, consent is given to Osteopaths processing personal data for the purposes outlined. Consent can be withdrawn at any time by using the postal address, email address, or telephone number provided at the end of this Privacy Notice.

7 – Disclosure

Osteopaths will keep personal information safe and secure. Only staff engaged in providing treatment will have access to patient records, although the administration team will have access to contact details to make appointments and manage accounts. Osteopaths will not disclose personal information unless compelled to meet legal obligations, regulations, or valid governmental requests. The practice may also enforce its Terms and Conditions, including investigating potential violations, detecting, preventing, or mitigating fraud, security, or technical issues, or protecting against imminent harm to the rights, property, or safety of staff.

8 – Retention Policy

Osteopaths will process personal data during the duration of any treatment and will continue to store only the personal data needed for eight years after the contract has expired to meet legal obligations. After eight years, all personal data will be deleted unless basic information needs to be retained to meet future obligations, such as erasure details. Records concerning minors who have received treatment will be retained until the child has reached the age of 25.

9 – Data Storage

All data is held in the United Kingdom. Osteopaths do not store personal data outside the EEA.

10 – Your Rights as a Data Subject

At any point whilst Osteopaths are in possession of or processing personal data, all data subjects have the following rights:

Right of access – to request a copy of the information held.
Right of rectification – to correct inaccurate or incomplete data.
Right to be forgotten – to request erasure of data in certain circumstances.
Right to restriction of processing – to restrict processing under certain conditions.
Right of portability – to have data transferred to another organisation.
Right to object – to object to certain types of processing such as direct marketing.
Right to object to automated processing, including profiling – to not be subject to the legal effects of automated processing or profiling.

If Osteopaths refuse a request under rights of access, a reason will be provided, which can be legally challenged. Upon request, Osteopaths can confirm what information is held and how it is processed.

11 – Information That Can Be Requested

Identity and contact details of the person or organisation (Osteopaths) determining how and why data is processed.
Contact details of the data protection officer, where applicable.
Purpose and legal basis for processing.
Legitimate interests of Osteopaths and related information.
Categories of personal data collected, stored, and processed.
Recipients or categories of recipients to whom data is disclosed.
Data retention period.
Details of rights to correct, erase, restrict, or object to processing.
Information about the right to withdraw consent at any time.
How to lodge a complaint with the supervisory authority (ICO).
Whether provision of personal data is a statutory or contractual requirement and possible consequences of failing to provide such data.
Source of personal data if not collected directly.
Details of automated decision-making, including profiling, and meaningful information about the logic involved, as well as the significance and expected consequences of such processing.

12 – Access to Personal Data

Osteopaths will accept the following forms of identification (ID) when information on personal data is requested: a copy of a driving licence, passport, birth certificate, and a utility bill not older than three months. A minimum of one piece of photographic ID and a supporting document is required. If Osteopaths are dissatisfied with the quality, further information may be sought before personal data can be released.
All requests should be made to Badrul Huda by phoning +44 (0) 1534 768733 or writing to the address provided below.

13 – Complaints

In the event of a complaint about how personal data is being processed by Osteopaths, the right to complain to the practice is available. If no response is received within 30 days, a complaint can be made to the ICO.

Contact Details:
Badrul Huda – Meridian Wellbeing Clinic
Telephone: 01534 768733
Email: badrul.huda@jerseymail.co.uk

ICO
Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone: +44 (0) 303 123 1113
Email: https://ico.org.uk/global/contact-us/email/