INTRODUCTION
At Therapeutics, we are committed to protecting and respecting your privacy.
This Policy explains when and why we collect and process personal information about those who enquire about our services (prospects) and clients of ours (employers and employees); how we use it; the conditions under which we may disclose it to others and how we keep it secure.
We may change this Policy from time to time so please check this periodically to ensure that you understand any changes. If you are an existing client, we will notify you of any major changes to the Policy.
Any questions regarding this Policy and our privacy practices should be sent by email info@therapeutics-southampton.co.uk or by writing to us at Trojans, Stoneham Lane, Eastleigh SO50 9HT or by calling 02830653707
DATA PROTECTION PRINCIPLES
We will comply with data protection law. This says that the personal information we hold about you must be:
1. Used lawfully, fairly and in a transparent way.
2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.
3. Relevant to the purposes we have told you about and limited only to those purposes.
4. Accurate and kept up to date.
5. Kept only as long as necessary for the purposes we have told you about.
6. Kept securely.
THE KIND OF INFORMATION WE HOLD ABOUT YOU
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
There are “special categories” of more sensitive personal data which require a higher level of protection.
We will collect, store, and use the following categories of personal information about you, your next of kin, your GP or medical contact.
• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses
• Date of birth
• Next of Kin
• Medical Contract
• Insurance company details
We may also collect, store and use the following “special categories” of more sensitive personal information:
• Information about your health, including any medical condition, health and sickness records
• Information about disability
HOW IS YOUR PERSONAL INFORMATION COLLECTED?
We collect personal information either directly from you directly.
We will collect additional personal information in the course of providing advice and assistance.
HOW WE WILL USE INFORMATION ABOUT YOU
We will only use your personal information when the law allows us to:
1. Where we need to perform the contract, we have entered with you.
2. Where we need to comply with a legal obligation.
3. Where it is necessary for our legitimate interests (or those of a third party) and your interests and fundamental rights do not override those interests.
We may also use your personal information in the following situations, which are likely to be rare:
1. Where we need to protect your interests (or someone else’s interests).
2. Where it is needed in the public interest.
In most cases we will use the personal information listed above to provide you with advice and assistance with regards to your illness or injury.
We may also use your data to:
• Send you Updates via our newsletter;
• Carry out our obligations arising from any contracts entered into by you and us;
• Notify you of changes to our services;
• Send you communications which you have requested and that may be of interest to you. These may include fact sheets or guides relating to your enquiry which you have requested.
Change of purpose
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you and we will explain the legal basis which allows us to do so.
Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.
HOW WE USE PARTICULARLY SENSITIVE PERSONAL INFORMATION
“Special categories” of particularly sensitive personal information require higher levels of protection. We need to have further justification for collecting, storing and using this type of personal information. We may process special categories of personal information in the following circumstances:
1. In limited circumstances, with your explicit written consent.
2. Where we need to carry out our legal obligations and in line with our Data Protection Policy.
3. Where it is needed in the public interest, such as for equal opportunities monitoring and in line with our Data Protection Policy.
AUTOMATED DECISION-MAKING
You will not be subject to decisions that will have a significant impact on you based solely on automated decision-making, unless we have a lawful basis for doing so and we have notified you.
We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.
DATA SHARING & OTHERS WHO MAY HAVE ACCESS TO YOUR PERSONAL INFORMATION
We will not share your data with third parties unless we have obtained your permission in advance or we are required to disclose or share information by law, because of a regulatory requirement or to our insurer.
We require third parties to respect the security of your data and to treat it in accordance with the law.
We may transfer your personal information outside the EU.
If we do have to share your data, you can expect a similar degree of protection in respect of your personal information.
Why might you share my personal information with third parties?
We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you or where we have another legitimate interest in doing so.
We may transfer your personal information to a third party as part of a sale of some or all our business and assets to any third party or as part of any business restructuring or reorganisation.
What about cloud-based storage and other providers?
Cliniko
We currently use Cliniko for Business, which is a cloud-based storage provider, to store and process data. Cliniko have taken updated their terms of service to ensure compliance with the GDPR. We may from time to time change our cloud storage provider, in which case we will require that the equivalent legal agreements are in place to protect the security of your personal data in accordance with the GDPR and our policies.
Cliniko’s privacy policy can be found here
https://www.cliniko.com/policies/privacy/
Sage
Alongside our “cloud” based platform if you are a client your data will also be stored in our accounting software Sage for accounting and invoicing purposes. You can find details of Sage’s privacy policy here: https://www.sage.com/en-gb/legal/privacy/ Again data on Sage may be transferred outside of the EU but as you will see Sage are committed to the principles of GDPR. If you would prefer us not to store your data using Sage please inform us and we will ensure it is removed and make alternative arrangements for invoicing.
Mailchimp
Where you have consented to us sending you legal and HR updates we will store your name and email address in Mailchimp an online automated mail system. You can find more details about Mailchimp’s policy here: https://mailchimp.com/legal/privacy/
TRANSFERRING YOUR INFORMATION OUTSIDE OF EUROPE
As part of the services offered to you, the information which you provide to us may be transferred to countries outside the European Union (“EU”). By way of example, this may happen if any of our servers are from time to time located in a country outside of the EU. These countries may not have similar data protection laws to the UK. If we transfer your information outside of the EU in this way, we will take steps to ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this Policy.
Cliniko cloud-based storage, Sage, Microsoft and Mailchimp could result in your data being stored outside of the EU.
If you object to the storage of your data using Cliniko Cloud services, please notify info@therapeutics-southampton.co.uk and we will be happy to store it on a local server or device.
If you use our services while you are outside the EU, your information may be transferred outside the EU in order to provide you with those services.
DATA SECURITY
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees who have a business need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality. Details of these measures may be obtained from us.
We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.
DATA RETENTION
We will only retain data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer a client we will retain and securely destroy your personal information in accordance with applicable laws and regulations and our data retention policy.
We will review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations. We will hold your personal information on our systems for as long as is necessary for the relevant activity, or as long as is set out in any relevant contract you hold with us.
Closure and completion
Upon the completion of your case, we may contact you to explain the closure of your file and also to ask for feedback on your experience. This enables us to understand your level of satisfaction so that we can improve the quality of service we offer, and to assess our performance.
We are required to retain documents for 7 years after the closure of your file. All paper documents may be scanned, and these will be stored electronically on the cloud. Once we have scanned the file the documents will be destroyed.
Retention Periods:
• Client data will be retained for 7 years or inline with standards of professional practice is children under 18 are involved.
• Data held on Mailchimp: will be retained indefinitely unless the individual registered unsubscribes in which case it will be deleted immediately.
• Mail storage: because of the nature of our email storage system and the way in which this is managed we will periodically delete emails that are over 7 years old. This will be undertaken on a yearly. Individuals have the right to request the removal of their data from our email system at an earlier time upon written request to us.
WEBSITE PRIVACY NOTICE
Our websites include the following:
https://www.therapeutics-southampton.co.uk/
Each website is owned and managed by us.
When you visit our websites, we may automatically collect the following information:
1. Internet Protocol (IP) address
2. Browser type and version
3. Operating systems and platform
4. Plug-in types Uniform Resources Locators
5. How you came to our website, i.e. from a google search
We may use google apps for business and google analytics which gives us information about where the website traffic comes from to our websites.
Any information collected via the use of our websites is only accessible by employees or associates of Therapeutics and our website service providers.
It is important at all times to note that the transmission of information via the internet is not completely secure.
We may disclose your personal information to analytics and search engine providers that assist us in the improvement and optimization of our Websites.
Cookies
Cookies are small files which are stored on your computer when you browse the internet. They enable us to understand how our websites are being used and help us to improve the way our website works, ensuring the best content to you.
How do we use Cookies?
Our website requires the use of cookies to function correctly and provide convenient access to the best content.
We do not use the data from cookies for marketing purposes and do not allow advertising from third parties on our websites which the data from cookies can often be used for.
Although we do not have any intention of using the data from Cookies at this time it is possible that we could do so in the future. If this happens we will update this policy and our Cookies notice accordingly.
Can I prevent Cookies?
Options for the control of cookies are provided in the cookie consent bar on this website, or most web browsers will allow you to change your browser settings to stop cookies.
There is further information on the www.gov.uk website which you may find helpful: https://www.gov.uk/help/cookies
I would like more information about how you use Cookies
Please email us and we would be happy to provide you with full details:
Links
We may from time to time through our articles provide links to another web site directly from our site. Each individual organisation operates their own policy regarding the use and sale of personal information and the use of cookies. If you have a particular interest or concern regarding the way your personal information will be used, then you are advised to read the privacy statement on the relevant site.
We will try to provide you with links to high quality, reputable sites which we believe are of interest and relevant to you, but please note that such third-party sites are not under our control and we do not contribute to the content of the sites. When you click through to these sites you leave the area controlled by us. We cannot accept responsibility for any issues arising in connection with either the third party’s use of your data, the site content or the services offered to you by these other sites.
Access to your information
You have various rights in respect of your personal information under data protection law. At any time, you may request access to any information that we hold about you. Under data protection laws you have a legal right to ask to see a copy of the personal information that we hold about you, known as a subject access request. If you would like to make a subject access request, please contact us by email: info@therapeutics-southampton.co.uk
ENQUIRIES & PROSPECTIVE CLIENTS
If you enquire about our services, we may ask for consent to provide you with factsheets relating to your issue. Depending on your preferences, our communications with you may include:
Email: We monitor whether email communications and whether they are undelivered. Should we be unable to send email to you we may cease sending email communication.
Calls: Calls made to us, and calls received from us, may be recorded for the purposes of monitoring of services provided by us.
Website: Visitors to our website may be tracked using analytics methods described in our website providers cookie policy.
If we provide you with advice over the telephone or by email we will retain details of our discussions and advice for up to 12 months. The reason for holding it for this period is in case you come back to us for advice in the future or if you have any queries or questions about the information or advice we have given you.
After 12 months all data will be destroyed securely.
CLIENTS
When we enter into a contract for service with new clients, we will collect personal data about you and other people involved ie GP and next of kin. We need this information to enter into a contract with you and to provide you with advice.
As a client if you provide us with personal data about any other individuals, this is kept strictly confidential. It is the responsibility of the client to ensure that personal data about others is accurate.
RIGHTS OF ACCESS, CORRECTION, ERASURE, AND RESTRICTION
It is important that the personal information we hold about you is accurate and current whilst we are assisting you. Please keep us informed if your personal information changes during your working relationship with us.
Your rights in connection with personal information
Under certain circumstances, by law you have the right to:
• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal information for direct marketing purposes.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact us in writing.
No fee usually required
You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.
What we may need from you
We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.
RIGHT TO WITHDRAW CONSENT
In the limited circumstances where you may have provided your consent to the collection, processing and transfer of your personal information for a specific purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us. Once we have received notification that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.
DATA PROTECTION OFFICER
We have appointed a data protection officer (DPO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact the DPO You have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues.
CHANGES TO THIS PRIVACY NOTICE
We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.
MARKETING PREFERENCES
We will not contact you for marketing purposes by post, email, phone or text message unless you have given your prior consent. You can change your marketing preferences at any time by contacting us.
HOW TO COMPLAIN ABOUT OUR PROCESSING OF PERSONAL DATA
If you have a concern or complaint about our processing of personal data, please email us or write to us at our address.
If you are not satisfied with our processing of personal data, how we have responded to your complaint about the processing of personal data, or you believe our processing of personal data is not in accordance with the law, you have the right to complain to the Information Commissioner’s Office (ICO) by calling +44(0)303 123 1113, or visiting https://ico.org.uk/concerns/
REVIEW OF THIS POLICY
The firms use of personal data and relevant policy will be reviewed regularly to ensure compliance. The firms use of personal data and relevant policy will be audited annually. This policy was last updated on 29th November 2023. When changes are made to this policy, we will publish the changed policy on our website.
Contact us
If you have any questions on the above or wish to make a request in relation to your personal data please contact us at info@therapeutics-southampton.co.uk or use our contact form.
