Ric Malkinson – Traditional Acupuncture is the data controller – this means I decide how your personal data is processed and for what purposes.
Whose information does this privacy notice apply to?
This privacy notice applies to information I collect from:
• patients;
• prospective patients;
• former patients;
• visitors to my website;
What is personal data?
Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. Examples of personal data I may hold about you include your contact and appointment details.
Special category data is a sub-category of personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation. Examples of special category data we may hold about you include your patient notes.
How do I collect and process your personal data?
All personal details that you share with me will remain confidential. I comply with my obligations under the GDPR by keeping personal data up to date; by storing and destroying it securely; by not collecting or retaining excessive amounts of data; by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.
It is necessary for me to collect and process certain data for the purposes of keeping an accurate register of my patients, and in order to make a diagnosis, decide on any necessary referral, and plan and record treatments. I am also required to collect certain details by law, and by my professional body, the British Acupuncture Council (BAcC).
This data includes:
• Name, address, telephone number, date of birth, e-mail address (I am unable to send or receive encrypted emails so you should be aware that any emails I send or receive may not be protected in transit. I will also monitor any emails sent to me, including file attachments, for viruses or malicious software)
• Medications
• Medical history and current health, and information pertaining to this (for example ongoing or one-off stressors)
• Your GP’s name and address (in the event that I need to contact your GP including in an emergency and because it is a mandatory requirement in the British Acupuncture Code of Professional Conduct).
• Where relevant I maintain records of the patient’s consent to treatment, or the consent of their next-of-kin in order to be able to prove that the patient (and/or parent/guardian/next of kin) has given informed consent to treatment to secure evidence in the event of a civil claim, criminal prosecution, insurance claim or complaint.
This data is stored by me in paper (hard copy) files only. The files are stored in a locked filing cabinet, and if transported to a new secure location, every step will be taken to ensure safe arrival at the new location.
I will delete any email conversations once I have responded as necessary. Your telephone number may be stored in my mobile phone contacts. I may text you to amend an appointment, please let me know if you would prefer a telephone call instead. Texts sent and received will be deleted on my phone.
Sharing your personal data
Your personal data will be treated as strictly confidential, and will be shared:
• with named third parties with your explicit consent;
• with the relevant authority such as the police or a court, if necessary for compliance with a legal obligation to which we are subject e.g. a court order;
• with your doctor or the police if necessary to protect yours or another person’s life;
• with the police or a local authority for the purpose of safeguarding children or vulnerable adults; or
• with my regulatory body, the British Acupuncture Council, or my insurance company in the event of a complaint or insurance claim being brought against me; or
• my solicitor in the event of any investigation or legal proceedings being brought against me.
Should you request treatment from a different practitioner who may require information from your notes, I will inform you what details have been requested and seek your consent.
For further details about the situations when information about you might be shared please see the Information Commissioner’s website at https://ico.org.uk/for-the-public/personal-information/sharing-my-info/
How long do I keep your personal data?
I will keep patient records for a period of 7 years in accordance with the British Acupuncture Code of Professional Conduct https://www.acupuncture.org.uk/public-content/effective-practice/bacc-professional-codes.html (or 25th birthday if the client was under 16 years of age).
At this time, your records will be destroyed, by me, by shredding or burning. Should I be unable to safely store and destroy records (for example due to illness or death) I have made provision for a trusted colleague to store and destroy my records as appropriate.
Your rights and your personal data
Unless subject to an exemption under the GDPR, you have certain rights with respect to your personal data as set out below.
• The right to request a copy of your personal data which I hold about you, within 3 months of request.
• The right to request that we correct any personal data if it is found to be inaccurate or out of date.
• The right to request your personal data is erased where it is no longer necessary for us to retain such data.
• The right to withdraw your consent to the processing at any time. This right does not apply where we are processing information using a lawful purpose other than consent.
• The right to request that we provide you with your personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable) [This right only applies where the processing is based on consent or is necessary for the performance of a contract with you and in either case I am processing the data by automated means].
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.
• The right to be informed immediately should any of your data (your ‘patient notes’) be lost. The Information Commissioning Officer will also be informed within 72 hours as required by law.
• The right to lodge a complaint with the Information Commissioner’s Office.
For further details about these rights please see the Information Commissioner’s website at https://ico.org.uk/for-the-public/is-my-information-being-handled-correctly/
I will endeavour to keep your details accurate and up to date, by following up any changes to address and telephone number, health conditions and medications.
Further processing
If I wish to use your personal data for a new purpose, not covered by this Privacy Notice, then I will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, I will seek your prior consent to the new processing.
Contact Details
To exercise all relevant rights, queries or complaints please in the first instance contact me at:
Ric Malkinson – Traditional Acupuncture
16 Marsh Lane
Cheltenham
GL51 9JB
M: 07828 968123
E: ric@acupuncturecheltenham.com
You can contact the Information Commissioners Office on 0303 123 1113 or via email https://ico.org.uk/global/contact-us/email/ or at the Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire. SK9 5AF.
The following applies to my website users :
• When someone visits my website I use a third party service, Google Analytics, to collect standard internet log information and details of visitor behaviour patterns. I do this to find out things such as the number of visitors to the various parts of the site. This information is only processed in a way which does not identify anyone. I do not make, and do not allow Google to make, any attempt to find out the identities of those visiting my website. If I do want to collect personally identifiable information through my website, I will be up front about this. I will make it clear when we collect personal information and will explain what I intend to do with it.
• I use website cookies to improve user experience of my website by enabling my website to ‘remember’ users, either for the duration of their visit – using a ‘session cookie’ – or for repeat visits – using a ‘persistent cookie’.
• I use a third party service 1&1 to help maintain the security and performance of my website. To deliver this service it processes the IP addresses of visitors to my website.
• I use a third party service, 1&1, to host my website. This site is hosted at 1&1, which is run by 1&1. I use Google Analytics to collect anonymous information about users’ activity on the site, for example the number of users viewing pages on the site, to monitor and report on the effectiveness of the site and help me to improve it. For more information about how 1&1 processes data, please see https://www.1and1.co.uk/terms-gtc/terms-privacy/?
