Purpose of Privacy notice
The processing of personal data is governed by
the General Data Protection Regulation 2016/679 (the GDPR). This
legislation will replace current data privacy law, giving more
rights to you as an individual and more obligations to
organisations holding your personal data. One of the rights is a
right to be informed, which means we have to give you even more
information than we do now about the way in which we use, share and
store your personal information.
This means that we will be publishing a new
privacy notice so you can access this information, along with
information about the increased rights you have in relation to the
information we hold on you and the legal basis on which we are
using it.
This new privacy notice comes into effect and
will be published on our website on 25 May 2018.
Who are we?
Jane Ravi Acupuncture is the data controller.
This means we decide how your personal data is processed and for
what purposes.
Whose information does this privacy notice apply
to?
This privacy notice applies to information we
collect from:
- patients;
- prospective patients;
- former patients;
- visitors to our website.
What is personal data?
Personal data relates to a living individual who
can be identified from that data. Identification can be by the
information alone or in conjunction with any other information in
the data controller’s possession or likely to come into such
possession. Examples of personal data we may hold about you include
your contact and appointment details.
Special category data is a sub-category of
personal data revealing racial or ethnic origin, political
opinions, religious or philosophical beliefs, or trade union
membership, and the processing of genetic data, biometric data for
the purpose of uniquely identifying a natural person, data
concerning health or data concerning a natural person’s sex life or
sexual orientation. Examples of special category data we may hold
about you include your patient notes.
How do we process your personal data?
We comply with our obligations under the GDPR by
keeping personal data up to date; by storing and destroying it
securely; by not collecting or retaining excessive amounts of data;
by protecting personal data from loss, misuse, unauthorised access
and disclosure and by ensuring that appropriate technical measures
are in place to protect personal data. We use your personal data
for the purposes set out below.
Sections 1 – 14 apply to our patients,
prospective patients, former patients and visitors to our
clinic:
- 1. We use your name, address, telephone number
and email address to make and rearrange appointments and send
receipts if requested. We are unable to send or receive encrypted
emails so you should be aware that any emails we send or receive
may not be protected in transit. We will also monitor any emails
sent to us, including file attachments, for viruses or malicious
software. Please be aware that you have a responsibility to ensure
that any email you send us is within the bounds of the
law.
- 2. Some patients and prospective patients return
pre- 1st appointment questionnaires or tell us about their medical
conditions and medication by email or online enquiry forms. We are
unable to send or receive encrypted emails so you should be aware
that any emails we send or receive may not be protected in transit.
We will also monitor any emails sent to us, including file
attachments, for viruses or malicious software. Please be aware
that you have a responsibility to ensure that any email you send us
is within the bounds of the law.
- 3. We keep a permanent attendance register which
records all appointments for patients attending our clinic to keep
a record of when you were treated for tax purposes and to secure
potential evidence in the event of a criminal prosecution, civil
litigation, insurance claim or complaint to my regulatory body, the
British Acupuncture Council.
- 4. We may use your date of birth to help identify
patients with the same name to avoid mistakes being made as to safe
and appropriate treatment, for identification purposes if referring
a patient to another health practitioner, and for identification
purposes if writing to a registered medical practitioner so that
they correctly identify the patient.
- 5. We use your presenting complaint and symptoms
reported by you for the purposes of making a full traditional
diagnosis, formulating treatment strategy and treatment
planning.
- 6. We use any relevant medical and family history
you have told us for making a full traditional diagnosis,
formulating treatment strategy and treatment planning.
- 7. We use your GP’s name and address in the event
that we need to contact your GP including in an emergency and
because it is a mandatory requirement in the British Acupuncture
Code of Professional Conduct.
- 8. We use our clinical findings about your health
and wellbeing for making a full traditional diagnosis, and
formulating treatment strategy and treatment planning. All notes
are kept as hand written notes and not electronically.
- 9. We keep a record of and refer to that record
of any treatment given and details of progress of your case,
including reviews of treatment planning to enable us to: review the
full traditional diagnosis, treatment strategy and planning; and to
secure evidence in the event of criminal proceedings, civil
litigation, an insurance claim or complaint.
- 10. We record and use any information and advice
that we have given, especially when referring patients to any other
health professional, to help you to receive the most appropriate
treatment and to secure evidence in the event of criminal
proceedings, civil litigation, an insurance claim or
complaint.
- 11. We record any decisions made in conjunction
with you to help you to receive the most appropriate treatment and
to secure evidence in the event of criminal proceedings, civil
litigation, an insurance claim or complaint.
- 12. We keep accident records for any patients,
visitors or staff who are involved in accidents at our clinic in
accordance with UK Health and Safety legislation including the
Reporting of Injuries, Diseases and Dangerous Occurrences
Regulations (RIDDOR) to comply with the law and to secure evidence
in the event of criminal proceedings, civil litigation, an
insurance claim or complaint.
- 13. In the event of an adverse incident occurring
to any of our patients we report the matter to the British
Acupuncture Council and the our insurance company to enable the
insurance company to deal with any potential claims and to help the
British Acupuncture Council to develop its safe practice
guidelines, as well as providing research data and information for
the BAcC’s insurers and other interested parties.
- 14. Where relevant we maintain records of the
patient’s consent to treatment, or the consent of their next-of-kin
in order to be able to prove that the patient (and/or
parent/guardian/next of kin) has given informed consent to
treatment to secure evidence in the event of a civil claim,
criminal prosecution, insurance claim or complaint.
Section 15 applies to those who complain about
our services (please delete all sections that do not apply to your
practice or amend those that need amending)) (Also, please state
how you store and transport your records: paper or
electronically.)
- 15. When we receive a complaint from a person we
make up a file containing the details of the complaint. This
normally contains the identity of the complainant and any other
individuals involved in the complaint. Any records are stored
electronically and on paper.
We will only use the personal information we
collect to process the complaint and to check on the level of
service we provide. We usually have to disclose the complainant’s
identity to whoever the complaint is about.
If a complainant doesn’t want information
identifying him or her to be disclosed, we will try to respect
that. However, it may not be possible to handle a complaint on an
anonymous basis. We may need to provide personal information
collected and processed in relation to complaints to the British
Acupuncture Council or our insurance company. We will keep personal
information contained in complaint files in line with our retention
policy.
This means that information relating to a
complaint will be retained for two years from closure. It will be
retained in a secure environment and access to it will be
restricted according to the ‘need to know’ principle.
Similarly, where enquiries are submitted to us we
will only use the information supplied to us to deal with the
enquiry and any subsequent issues and to check on the level of
service we provide.
Sections 16 – 18 apply to our website users
(please delete all sections that do not apply to your practice or
amend those that need amending)) (Also, please state how you store
and transport your records: paper or electronically.)
- 16. When someone visits our website we use a
third party service, Google Analytics, to collect standard internet
log information and details of visitor behaviour patterns. We do
this to find out things such as the number of visitors to the
various parts of the site.
This information is only processed in a way which
does not identify anyone. We do not make, and do not allow Google
to make, any attempt to find out the identities of those visiting
our website. If we do want to collect personally identifiable
information through our website, we will be up front about this. We
will make it clear when we collect personal information and will
explain what we intend to do with it.
- 17. Our website search is powered by 123Reg.
Search queries and results are logged anonymously to help us
improve our website and search functionality. No user-specific data
is collected by us or any third party.
- 18. We use a third party service, (123Reg), to
host our website.
Sharing your personal data
Your personal data will be treated as strictly
confidential, and will be shared:
- with named third parties with your explicit
consent;
- with the relevant authority such as the police or
a court, if necessary for compliance with a legal obligation to
which we are subject e.g. a court order;
- with your doctor or the police if necessary to
protect yours or another person’s life;
- with the police or a local authority for the
purpose of safeguarding a children or vulnerable adults;
or
- with my regulatory body, the British Acupuncture
Council, or my insurance company in the event of a complaint or
insurance claim being brought against me; or
- my solicitor in the event of any investigation or
legal proceedings being brought against me.
For further details about the situations when
information about you might be shared please see the Information
Commissioner’s website at
https://ico.org.uk/for-the-public/personal-information/sharing-my-info/
How long do we keep your personal
data?
We keep your personal data for no longer than
reasonably necessary. We keep patient records for a period of 7
years in accordance with the British Acupuncture Code of
Professional Conduct
https://www.acupuncture.org.uk/public-content/effective-practice/bacc-professional-codes.html
Records are stored in a lockable system and are
destroyed by shredding when required or if requested. If any
records were existing if the data controller was to die they would
be shredded securely. At any time you may request that changes are
made to your contact details.
Your rights and your personal data
Unless subject to an exemption under the GDPR,
you have certain rights with respect to your personal data as set
out below.
- The right to request a copy of your personal data
which we hold about you.
- The right to request that we correct any personal
data if it is found to be inaccurate or out of date.
- The right to request your personal data is erased
where it is no longer necessary for us to retain such
data.
- The right to withdraw your consent to the
processing at any time. This right does not apply where we are
processing information using a lawful purpose other than
consent.
- The right to request that we provide you with
your personal data and where possible, to transmit that data
directly to another data controller, (known as the right to data
portability), (where applicable) [This right only applies where the
processing is based on consent or is necessary for the performance
of a contract with you and in either case the we are processing the
data by automated means].
- The right, where there is a dispute in relation
to the accuracy or processing of your personal data, to request a
restriction is placed on further processing.
- The right to object to the processing of personal
data, (where applicable) [This right only applies where processing
is based on legitimate interests (or the performance of a task in
the public interest/exercise of official authority); direct
marketing and processing for the purposes of scientific/historical
research and statistics].
- The right to be informed if your data is lost. We
shall also inform the Information Commissioner’s Office in
accordance with the time limits in the GDPR.
- The right to lodge a complaint with the
Information Commissioner’s Office.
For further details about these rights please see
the Information Commissioner’s website at
https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
Further processing
If we wish to use your personal data for a new
purpose, not covered by this Privacy Notice, then we will provide
you with a new notice explaining this new use prior to commencing
the processing and setting out the relevant purposes and processing
conditions. Where and whenever necessary, we will seek your prior
consent to the new processing.
Contact Details
To exercise all relevant rights, queries of
complaints please in the first instance contact us at
Jane Ravi Acupuncture on 07795 256 749
You can contact the Information Commissioners
Office on 0303 123 1113 or via email
https://ico.org.uk/global/contact-us/email/ or at the Information
Commissioner's Office, Wycliffe House, Water Lane, Wilmslow,
Cheshire. SK9 5AF.
END OF PRIVACY NOTICE