Introduction

This Privacy Notice sets out the principles and practices adopted by D.C Physiotherapy for assuring our compliance with the General Data Protection Regulation (GDPR). This Notice explains what Personal Data we collect from you and how we use it: how it is collected, how it is held and how it is processed. It also explains your rights relating to your Personal Data.

The person responsible for the data protection is Dan Curran, who can be contacted at d.c.ffisiotherapi@gmail.com.

What is Personal Data?

Personal Data is defined by the GDPR as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.

Personal Data is, in simpler terms, any information about you that enables you to be identified. For example, this could be your name or contact details.

What Personal Data do we collect?

We aim to provide you with the highest quality of health care. To do this, we must collect and keep information about you, your health and the care we have provided, or plan to provide. This could include:

• Your name, home address, email address, telephone number
• Your date of birth and gender
• GP details
• Job title and employer details
• Contact we have had with you, such as clinic visits
• Notes, letters and reports about your health
• Information about your treatment and care
• Results of x-rays and other tests
• Information that you provide in a health questionnaire
• Relevant information from people who care for you and know you well, such as health professionals and relatives
• Financial information in order to process payments

How do we collect your Personal Data?

Your Personal Data is collected in a number of different ways. If you make a booking with us online via the online booking system, your Personal Data is collected on our behalf by a third party booking and management system. We may also collect Personal Data from you in person during your appointment, over the telephone or by email. If you are under 18, we may collect your Personal Data from your parent or guardian.

If you are referred to us, we may receive some of your Personal Data directly from a third party, for example from your GP or other health professional, or from your employer.

When you pay for our services, your payment will be processed by Stripe, a third party payment processor, which collects, uses and processes your information, including payment information, in accordance with their privacy policies.

You either give your card details to us to process the payment on your behalf or these details are entered by you directly into Stripe’s payment platform. We do not store your card details.

What are the legal bases for using your Personal Data?

We rely on the following legal bases for collecting and using your Personal Data:

• To enter into a contract with you and to carry out our obligations to you under that contract
• Consent - you provide your consent for us to collect and store you Personal Data when you provide us with information whether online or in person
• Compliance with a legal obligation - we have a legal duty to record some of your Personal Data such as medical information in order to meet professional standards
• To pursue our legitimate interests - in order to keep our own internal records and in or-der to provide the best service and treatments available.

How do we use your Personal Data?

We use your Personal Data to:

• Communicate with you in order to provide the service you have requested under a contract or to take steps at your request prior to entering into a contract
• Make sure that decisions about your care and treatment are always based on accurate up-to-date information
• Investigate any concerns or complaints raised by you or your family
• Make sure your care is safe and effective
• Work effectively with other care providers
• To maintain our own accounts and records
• In order to comply with a legal obligation or in legal proceedings
• In any other way where you have given your consent for that particular purpose

We remove your name and other details that could identify you so that we can use the information in your record anonymously to:

• Monitor and improve the quality of our service
• Make sure that the treatments and services we provide are meeting patients’ needs

Some information will be held for statistical purposes. If so, we will take strict measures to ensure that patients cannot be identified.

Do we share your Personal Data?

To make sure you receive the care and treatment you need, we may need to share your Personal Data with other staff and organisations. We will not share your Personal Data with these third parties unless there is a medical need or legal obligation for us to do so. This may include:

• Your GP, pharmacies and dentists
• Hospitals, walk-in centres, out of hours doctors, NHS direct
• Community services such as nurses, midwives and therapists
• Local authority departments, including social services, education and housing
• Voluntary care organisations
• Private sector organisations such as private hospitals, care homes and hospices

In some limited circumstances, we may be legally required to share certain Personal Data, which might include yours, if we are involved in legal proceedings or to comply with our legal obligations.

What are your rights?

Under the Data Protection Legislation, you have the following rights:

1. The right to be informed about our use of your Personal Data. This Privacy Notice should tell you everything you need to know, but you can contact us if you have any questions about your Personal Data and our use of it.
2. The right to be provided with a copy of the Personal Data we hold about you. Any requests should be made in writing to the email address provided.
3. The right to have your Personal Data rectified if it is inaccurate or incomplete.
4. The right to be forgotten, i.e. the right to ask us to delete or otherwise dis-pose of any of your Personal Data that we hold.
5. The right to restrict the processing of your Personal Data.
6. The right to object to us using your Personal Data for a particular purpose.
7. The right to withdraw consent. This means that, if we are relying on your consent as the legal basis for using your Personal Data, you are free to withdraw that consent at any time.
8. The right to receive your Personal Data in order to transmit it directly to an-other data controller (known as the right to data portability). This right only applies where we are processing your Personal Data with your consent or for the performance of a contract with you and in either case we are pro-cessing the data by automated means.
9. Rights relating to automated decision-making and profiling. We do not use your Personal Data in this way.
10. The right to lodge a complaint with the Information Commissioner’s Office. We would welcome the opportunity to resolve your concerns ourselves, however, so please contact us first.

How long will we keep your Personal Data?

We will not keep your Personal Data for longer than is necessary in light of the reasons for which it was first collected. We will process your Personal Data during the period of your treatment and will keep the Personal Data that we are legally required to keep for a period of 8 years after the end of our contract with you. After eight years your Personal Data will be deleted, unless there are some basic details that we are obliged to keep. Records concerning minors who have received treatment will be retained until the child has reached the age of 25. We may keep your Personal Data for longer if there are actual or potential legal proceedings that require the use of your Personal Data or if there is an-other regulatory or legal duty on us to do so.

How do we keep your Personal Data confidential?

At D.C Physiotherapy we have a legal duty to keep information about you confidential. We also have a duty to:

• Maintain full and accurate records of the care we provide to you
• Keep records confidential, secure and accurate

Changes to this Privacy Notice

We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business practices in a way that affects personal data protection.

Any changes will be made available on our website.

Contact details

For any further information, contact Daniel Curran at d.c.ffisiotherapi@gmail.com.