Updated 10/09/2024
New and existing patient privacy notice
Borders Chiropractic LLP is aware of its obligations under the General Data Protection Regulation (GDPR) and is committed to processing your data securely and transparently. This privacy notice sets out, in line with GDPR, the types of data that we hold on you. It also sets out how we use that information, how long we keep it for and other relevant information about your data. This notice applies to current and previous patients of the clinic
Data controller details
The Clinic is a data controller, meaning that it determines the processes to be used when using your personal data. Our contact details are The Director, Borders Chiropractic, 2 Cherry Court, Cavalry Park, Peebles, EH45 9BU.
Data protection principles
In relation to your personal data, we will:
- process it fairly, lawfully and in a clear, transparent way
- collect your data only for reasons that we find proper for the course of your treatment in ways that have been explained to you
- only use it in the way that we have told you about
- ensure it is correct and up to date
- keep your data for only as long as we need it
- process it in a way that ensures it will not be used for anything that you are not aware of or have consented to (as appropriate), lost or destroyed
Types of data we process
We record and use the following categories of personal data which include:
- Details about you, such as your address, contact details, date of birth, previous medical history and any previous investigations.
- Any contact with the clinic has had with you, such as appointments, clinic visits, advice given over the phone or email, emergency appointments etc.
- Notes about your health.
- Details about your treatment and care.
- Relevant information from other healthcare professionals and health data relevant for treating you at our clinic.
- Our lawful basis for storing and using this data is contract and we are allowed to store and use your health data as we are a recognised health care provider.
- In addition, we only examine or treat you with your explicit consent.
How we collect your data
We collect data starting with our initial consultation file and our consent for treatment forms (‘New Patient Forms’). We record data as we proceed with regard to progress and treatment regimen. This data is stored in secure filing cabinets and access is controlled to minimise risk of a data breach. Our records are stored digitally in our chosen clinic management software – PracticeHub. All the providers have given written assurances that they are fully compliant with General Data Protection Regulations.
Sharing your data
Your data will be shared with employees/practitioners within the Clinic where it is necessary for them to undertake their duties. We do not share your data with any third parties.
Protecting your data
We are aware of the requirement to ensure your data is protected against accidental loss or disclosure, destruction and abuse. We have implemented processes to guard against such. Where external companies have access to your data (our online diary), we provide written instructions to them to ensure that your data are held securely and in line with GDPR requirements. External companies must implement appropriate technical and organisational measures to ensure the security of your data. Should your personal data that we control be lost, stolen or otherwise breached, where this constitutes a high risk to your rights and freedoms, we will contact you without delay. We will give you the contact details of the person who is dealing with the breach, explain to you the nature of the breach and the steps we are taking to deal with it.
How long we keep your data for
In line with data protection principles, we only keep your data for as long as we need it for, which is usually for up to 8 years after your last visit.
Automated decision making
No decision will be made about you solely on the basis of automated decision making (where a decision is taken about you using an electronic system without human involvement) which has a significant impact on you.
Your rights in relation to your data
The law on data protection gives you certain rights in relation to the data we hold on you. These are:
- the right to be informed. This means that we must tell you how we use your data, and this is the purpose of this privacy notice
- the right of access. You have the right to access the data that we hold on you. To do so, you should make a subject access request. To do this you can complete a Subject Access Request form and return it by email or post to the clinic.
- the right for any inaccuracies to be corrected. If any data that we hold about you is incomplete or inaccurate, you are able to require us to correct it
- the right to have information deleted. If you would like us to stop processing your data, you have the right to ask us to delete it from our systems where you believe there is no reason for us to continue processing it
- the right to restrict the processing of the data. For example, if you believe the data we hold is incorrect, we will stop processing the data (whilst still holding it) until we have ensured that the data is correct
- the right to portability. You may transfer the data that we hold on you for your own purposes
- the right to object to the inclusion of any information. You have the right to object to the way we use your data where we are using it for our legitimate interests
Where you have provided consent to our use of your data, you also have the unrestricted right to withdraw that consent at any time. Withdrawing your consent means that we will stop processing the data that you had previously given us consent to use. There will be no consequences for withdrawing your consent. However, in some cases, we may continue to use the data where so permitted by having a legitimate reason for doing so. If you wish to exercise any of the rights explained above, please contact: The Director, Borders Chiropractic, 2 Cherry Court, Cavalry Park, Peebles, Scottish Borders, EH45 9BU.
Making a complaint
Should you have any concerns about how your information is managed at the clinic, please contact the Director (Pamella Chu) in the first instance at pamellachu@borderschiropractic.co.uk. If your complaint is not resolved you have further recourse to the Scottish Chiropractic Association admin@sca-chiropractic.org . If the complaint remains unresolved, you then have the right to complain to the Information Commissioner’s Office via their website (www.ico.gov.uk) The supervisory authority in the UK for data protection matters is the Information Commissioner (ICO). If you think your data protection rights have been breached in any way by us, you are able to make a complaint to the ICO.
Borders Chiropractic LLP
Company number SO302957
Registered office address: 2 Cherry Court, Cavalry Park, Peebles, Scottish Borders, EH45 9BU