YOUR PERSONAL INFORMATION - GENERAL DATA PROTECTION REGULATION (GDPR)
GDPR (implemented by DPA2018 in the UK) brought in new legal protection for personal information from May 2018. This tells you what personal information I hold and why, and what your rights are.
This Reflexology Clinic is run by myself, Sheena Smith and I am the controller of the personal data you provide.
I can be contacted on 07554 669326 or feetfirstholistics@gmail.com
The type of personal information I collect, how I get the personal information and why I hold it
In order to give professional reflexology treatments, I will need to gather and retain potentially sensitive information about your health. Most of the personal information I process is provided to me directly by you and I will only use this information for informing reflexology treatments and associated recommendations concerning aspects of health and wellbeing which I will offer to you. The information that I hold is:
- Your contact details
- Medical history and other health-related information
- Treatment details and related notes
Lawful Basis for holding and using Client Information
Under the UK General Data Protection Regulation (UK GDPR), the lawful basis I rely on for processing this information are:
- I have a legal obligation:
- ‘Claims occurring’ insurance: (records to be kept for 7 years after last treatment)
- Law regarding children’s records (records to be kept until the child is 25 or if 17 when treated, then 26)
- CNHC requirements to retain information for 8 years
- I have a legitimate interest, e.my requirement to retain the information to provide you with the best possible treatment options and advice
As I hold special category data (i.e. health related information), the additional condition under which I hold and use this information is: for me to fulfil my role as a health care practitioner bound under the AoR Confidentiality as defined in the AoR Code of Practice and Ethics.
Protecting your Personal Data - How I store your personal information
I am committed to ensuring that your personal data is secure. To prevent unauthorised access or disclosure, I have put in place appropriate technical, physical and managerial procedures to safeguard and secure the information we collect from you. I will contact you using the contact preferences you have given me.
How long I retain your information for
I will only keep your information if you come to me for treatment.
For insurance purposes I have to retain records for 7 years after the last treatment.
To comply with the law, children’s records will be kept until the child reaches 25 or if 17 when treated, then 26).
CNHC require records to be held for 8 years.
After this time your records will be shredded.
Your data will not be transferred outside the EU
Your data protection rights
Under data protection law, you have rights including:
Your right of access - You have the right to ask me for copies of your personal information.
Your right to rectification - You have the right to ask me to rectify personal information you think is inaccurate. You also have the right to ask me to complete information you think is incomplete.
Your right to erasure - You have the right to ask me to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask me to restrict the processing of your personal information in certain circumstances.
Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.
Your right to data portability - You have the right to ask that I transfer the personal information you gave me to another organisation, or to you, in certain circumstances.
You are not required to pay any charge for exercising your rights. If you make a request, I have one month to respond to you.
If you wish to exercise any of these rights, please use the contact details given above.
Therapists rights
If you don’t agree to your therapist keeping records of information about you and your treatments, or if you don’t allow them to use the information in the way they need to for treatments, the therapist may not be able to treat you
Your therapist must keep your records of treatment for a certain period as described above, which may mean that even if you ask them to erase any details about you, they might have to keep these details until after that period has passed
Your therapist can move their records between their computers and IT systems without your permission if your details are protected from being seen by others.
How to complain
If you have any concerns about my use of your personal information, you can make a data protection complaint to me:
Email: feetfirstholistics@gmail.com
Telephone: 07554669326
If you remain unhappy with how I’ve used your data after raising a complaint with me, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
