Privacy Notice (PN1)

Contact details

Data Controller: Daryl Herbert, ICO Registration Reference: ZA344429
Address: Churchill Medical Centre 1 Churchill Terrace Chingford London E4 8DG Telephone: (020) 8524 1505. Email: [email protected]
Data Protection Officer: As above. Telephone: As above. Email: As above

Data Controller: Daryl Herbert, ICO Registration Reference: ZA344429
Address: High Beech House, 8 -10 High Beech Road, Loughton, Essex. IG10 4BL
Telephone: (020) 8508 2793. Email: [email protected]
Data Protection Officer: As above. Telephone: +44 (0) 7879 691344 Email: As above

Information we hold about you

In accordance with The Osteopathic Standards, Code of Practice Standard C8:

Dates of the consultations, personal details, your problems and symptoms, relevant medical, family and social history, clinical findings, information and advice you provide, whether this is provided in person or via the telephone, diagnoses and treatment plans, records of consent, investigation or treatment and the results, any communication with, about or from you, copies of any correspondence, reports, test results (X-Ray, MRI, Blood etc.), clinical response to treatment and treatment outcomes, whether a chaperone was present or not required, whether a student or observer was present.

Security

We are committed to protecting your privacy and will only use the information collected lawfully in accordance with the Common Law Duty of Confidentiality, the General Osteopathic Practice Standards and the Data Protection Act 1998 and the General Data Protection Regulations (GDPR) 2018.

Records are held on paper and we use a combination of best working practices and technology to ensure that your information is kept confidential and secure. (More detail can be found in our Data privacy policy)

Reception and management staff have access to your contact telephone numbers only, for administrative purposes, but do not have access to your medical records.

The Legal Basis under which we hold your data

The lawful basis for processing special category health data for direct care is that processing is:

‘processing is necessary for compliance with a legal obligation to which the controller is subject’ (Article 6(1)(c).

The special category condition for processing for direct care is that processing is:

‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services...’ (Article 9(2)(h)).

Further use of data

Information may be used within this practice for clinical audit to monitor the quality of the service provided. Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified.

Sometimes your information may be requested to be used for research purposes – this practice will always gain your explicit consent before releasing the information for this purpose.

We may also use external companies to process personal information, such as for archiving and backup purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure.

Referral Procedures

We not share any of your information with any third party without your explicit permission in the form of a written consent. This may take the form of a referral to another specialist or the transfer of your records to another practitioner. This practice will always gain your explicit consent before releasing the information for such a purpose.

Record Retention Policy

We retain these records for 8 years after your last visit or if the patient is a child, until their 25th Birthday. (In accordance with The Osteopathic Standards, Code of Practice Standard D6 3.1, 3.2).

This effects your right to erasure under the GDPR guidelines, as we have a lawful basis for retaining your records. Certain “personal data”, however, can be erased, such as your email address and your mobile telephone number. This practice will always gain your explicit consent before erasing or amending this information.

Right to access (Subject Access Request) or amend your records

• Your request must be made in writing and signed
• We will respond to your request within 1 month
• You will need to give adequate information and proof of identity.
• There will be NO CHARGE

It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.

The practice is registered with the Information Commissioners Office (ICO).

If you are still unhappy, following a review by the Practice, you can then make a complaint to the Information Commissioners Office (ICO). www.ico.org.uk,
[email protected],
Telephone: 0303 123 1113 (local rate) or 01625 545 745