Privacy
notice in response to new data protection legislation which came into effect on
May 25th 2018
Name
of Data Controller: Janice Booth Acupuncturist BA Lic Ac FBAcC
Purpose of privacy notice
The processing of personal data is governed by the General
Data Protection Regulation 2016/679 (the GDPR). This legislation replaces
previous data privacy law, giving more rights to you as an individual and more
obligations to organisations holding your personal data.
One of the rights is a right to be informed, which means I,
(as the Data Controller in the context of your receiving acupuncture treatment)
have to give you full information about the way in which I use, share and store
your personal information.
This privacy notice provides information about the increased
rights you have in relation to the information I hold on you and the legal
basis on which I am using it.
The new legislation is effective from 25 May 2018. This
information is available as a hard copy and is posted on my website: janiceboothacupuncture.co.uk
I, Janice Booth, am the data controller for my Acupuncture
practice. This means that I decide how your personal data is processed and for
what purposes.
This privacy notice applies to information I collect or have
collected from:
·
patients
·
prospective
patients
·
former
patients
What is personal data?
Personal data relates to a living individual who can be
identified from that data. Identification can be by the information alone or in
conjunction with any other information in the data controller’s possession or
likely to come into such possession. Examples of personal data I may hold about
you include your contact and appointment details.
Special category data is a sub-category of personal data
revealing racial or ethnic origin, political opinions, religious or
philosophical beliefs, or trade union membership, and the processing of genetic
data, biometric data for the purpose of uniquely identifying a natural person,
data concerning health or data concerning a natural person’s sex life or sexual
orientation. Examples of special category data I may hold about you include
your patient notes.
How do I process your
personal data?
I comply with our obligations under the GDPR by keeping
personal data up to date; by storing and destroying it securely; by not
collecting or retaining excessive amounts of data; by protecting personal data
from loss, misuse, unauthorised access and disclosure and by ensuring that
appropriate technical measures are in place to protect personal data. I use
your personal data for the purposes set out below.
What Information do I keep
on patients, prospective patients and former patients?
All my records are kept
as paper copies, hand written by me during consultations. Email information may
be printed out (or will otherwise be deleted) and stored in your paper file. No
patient information is stored electronically.
1.
I
use your name, address, telephone number and email address to make and
rearrange appointments. I am unable to send or receive encrypted emails so you
should be aware that any emails sent or received may not be protected in
transit. I monitor any emails sent to me, including file attachments, for viruses
or malicious software. Please be aware that you have a responsibility to ensure
that any email you send me is within the bounds of the law.
2.
I
keep a permanent attendance register which records all appointments for
patients attending my clinic to keep a record of when you were treated, for tax
purposes and to secure potential evidence in the unlikely event of a criminal
prosecution, civil litigation, insurance claim or complaint to my regulatory
body, the British Acupuncture Council.
3.
I
may use your date of birth to help identify patients with the same name to
avoid mistakes being made as to safe and appropriate treatment, for
identification purposes if referring a patient to another health practitioner,
and for identification purposes if writing to a registered medical practitioner
so that they correctly identify the patient.
4.
I
use your presenting complaint and symptoms reported by you for the purposes of
making a full traditional diagnosis, formulating treatment strategy and
treatment planning.
5.
I use
any relevant medical and family history you have told me for making a full
traditional diagnosis, formulating treatment strategy and treatment planning.
6.
I
use your GP’s name and address in the event that I need to contact your GP
including in an emergency and because it is a mandatory requirement in the
British Acupuncture Code of Professional Conduct.
7.
I
use my clinical findings about your health and wellbeing for making a full
traditional diagnosis, and formulating treatment strategy and treatment planning.
8.
I
keep a record of and refer to that record of any treatment given and details of
progress of your case, including reviews of treatment planning to enable me to:
review the full traditional diagnosis, treatment strategy and planning; and to
secure evidence in the event of criminal proceedings, civil litigation, an
insurance claim or complaint.
9.
I
record and use any information and advice that I have given, especially when
referring patients to any other health professional, to help you to receive the
most appropriate treatment.
10. I record any decisions made in
conjunction with you to help you to receive the most appropriate treatment and
to secure evidence in the event of criminal proceedings, civil litigation, an
insurance claim or complaint.
11. I keep accident records for any patients
who are involved in accidents at my clinic in accordance with UK Health and
Safety legislation including the Reporting of Injuries, Diseases and Dangerous
Occurrences Regulations (RIDDOR) to comply with the law and to secure evidence in the event of
criminal proceedings, civil litigation, an insurance claim or complaint.
12. In the event of an adverse incident
occurring to any of my patients I report the matter to the British Acupuncture
Council and the my insurance company to enable the insurance company to deal
with any potential claims and to help the
British Acupuncture Council to develop its safe practice guidelines, as well as
providing research data and information for the BAcC’s insurers and other
interested parties.
13.Where relevant I maintain records of the
patient’s consent to treatment, or the consent of their next-of-kin in order to
be able to prove that the patient (and/or parent/guardian/next of kin) has
given informed consent to treatment to secure evidence in the event of a civil
claim, criminal prosecution, insurance claim or complaint.
14. When someone
visits my website I use a third party service, Google Analytics, (GA)
to collect standard internet log information and details of visitor behaviour
patterns. I do this to find out things such as the number of visitors to the
various parts of the site. This information is only processed in a way which
does not identify anyone. I do not make, and do not allow Google to make, any
attempt to find out the identities of those visiting our website. You can read
about GA’s data privacy and security here: support.google.com/analytics/answer/6004245?hl=en
15. style='font:7.0pt "Times New Roman"'> Searches on my website
search are responded to by a third party, LCN Ltd. (GB), Search queries and
results are logged anonymously to help me improve the website and search
functionality. No user-specific data is collected by me or any third party.
16. I use LCN, to help
maintain the security and performance of my website. To deliver this service
LCN processes the IP addresses of visitors to my website. You can find details
of LCN’s privacy policy and how they use and process this data at: www.lcn.com/privacy
17. I use the services
provided by LCN to host my website. My site is located at: janiceboothacupuncture.co.uk. In addition to searches they collect anonymous
information about users' activity on the site, for example the number of users
viewing pages on the site, to monitor and report on the effectiveness of the
site and help improve it.
18. My website has a
facility that allows visitors, via email, to contact me and leave a message,
make an appointment or get directions to my practice. I (on my computer and
offline on paper) and LCN (online on disc) store these messages to secure evidence in the event of a
civil claim, criminal prosecution, insurance claim or complaint.
Sharing your personal data
Your personal data will be treated as strictly confidential,
and will only be shared:
·
with
named third parties with your explicit consent;
·
with
the relevant authority such as the police or a court, if necessary for
compliance with a legal obligation to which we are subject e.g. a court order;
·
with
your doctor or the police if necessary to protect yours or another person’s
life;
·
with
the police or a local authority for the purpose of safeguarding a children or
vulnerable adults; or
·
with
my regulatory body, the British Acupuncture Council, or my insurance company in
the event of a complaint or insurance claim being brought against me; or
·
my
solicitor in the event of any investigation or legal proceedings being brought
against me.
For further details about the situations when information
about you might be shared please see the Information Commissioner’s website at:
ico.org.uk/for-the-public/personal-information/sharing-my-info
How long do I keep your
personal data?
·
I
keep your personal data for no longer than is reasonably necessary.
·
I
keep patient records for a period of 7 years in accordance with the British
Acupuncture Code of Professional Conduct:
·
http://www.acupuncture.org.uk/public-content/effective-practice/bacc-professional-codes.html
·
Your
data will be shredded 7 years after your last appointment. In the case of a
minor, information is kept for 7 years after they reach the age of consent. It
will then be shredded.
·
In
the event of a sudden termination of my practice through ill health or death,
all patient data is to be shredded.
At any time you may request that changes are made to your
contact details.
Your rights and your
personal data
Unless subject to an exemption under the GDPR, you have
certain rights with respect to your personal data as set out below.
·
The
right to request a copy of your personal data which I hold about you.
·
The
right to request that I correct any personal data if it is found to be
inaccurate or out of date.
·
The
right to request your personal data is erased where it is no longer necessary
for me to retain such data.
·
The
right to withdraw your consent to the processing at any time. This right does
not apply where I are processing information using a lawful purpose other than
consent.
·
The
right to request that I provide you with your personal data and where possible,
to transmit that data directly to another data controller, (known as the right
to data portability), (where applicable) [This right only applies where the
processing is based on consent or is necessary for the performance of a
contract with you.
·
The
right, where there is a dispute in relation to the accuracy or processing of
your personal data, to request a restriction is placed on further processing.
·
The
right to be informed if your data is lost. I shall also inform the Information
Commissioner’s Office in accordance with the time limits in the GDPR.
·
The
right to lodge a complaint with the Information Commissioner’s Office.
For further details about these rights please see the
Information Commissioner’s website at https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
Further processing
If I wish to use your personal data for a new purpose, not
covered by this Privacy Notice, then I will provide you with a new notice
explaining this new use prior to commencing the processing and setting out the
relevant purposes and processing conditions. Where and whenever necessary, I
will seek your prior consent to the new processing.
Contact Details
To exercise all relevant rights, queries of complaints
please in the first instance contact me at:
Janice Booth
131 Goddard Ave
Swindon SN1 4HX
01793 641107
07766130438
jboothacupuncture@gmail.com
You can contact the Information Commissioners Office
on 0303 123 1113
or via email: https://ico.org.uk/global/contact-us/email/
or at the
Information Commissioner's Office,
Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.
END OF PRIVACY NOTICE
