Privacy Policy

This privacy notice tells you about the information we collect from you when you use our website and services. In collecting this information, we are acting as a data controller and, by law, we are required to provide you with information about us, about why and how we use your data, and about the rights you have over your data.

Who are we?

We are Resilience Medicine Clinic (“the Clinic”).

The Clinic collects and uses your information in order to provide our services to you. We are a data controller in relation to the processing of personal information that you provide us when using our services.

This policy explains:

• The types of information we collect about you
• The purposes for which we use that information
• Who we may share your information with
• How long we keep information about you for
• Where the information about you is stored
• The rights you have under data protection legislation
• Contact details if you have any queries or concerns about what is said in this notice

Terms used

“Clinic Team”. The Clinic Team is made up of the clinicians who directly provide or support your care at the Clinic and may also include administrative colleagues.

“Personal data”. Personal data is any information relating to a living individual who can be identified from the information.

“Special personal data” or “special category data”, this is data that is deemed to be more sensitive than the above personal data. It includes for example data about your health (including mental health), genetic data and biometric data where processed to uniquely identify an individual; your gender and ethnicity.

We set out below the bases we rely upon to process your personal data:

Consent: where we ask for your consent to process your data for a specific purpose. Such as when we ask you to complete a medical questionnaire or when we ask for your consent to contact your GP to obtain your medical records. As a patient you may be asked for consent to allow us to collect sensitive personal data about you to ensure your safe treatment and care.

Contractual obligations: where we need your data to fulfil our contractual obligations, i.e. your contact details and address to process payment and secure your booking.

Legal compliance: where we are required by law or regulatory bodies to process your data for example proof of ID and age where the law requires.

Legitimate Interests: where we require your data to pursue our interests in a way which might reasonably be expected as part of running our business and which does not significantly impact your rights or freedom. We will use the contact details you provide, to call/SMS/email you regarding your enquiry and provide you with targeted relevant information. We may also combine and anonymise your data with that of other customers to help make improvements to our service and business.

What information does the Clinic use?

The personal data/information the Clinic uses and stores about you includes:

• Personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
• Biographical information like your date of birth, nationality and gender.
• Information about your next of kin and carers (including their contact details and emergency contact information).
• Your NHS number.
• Communications with or about you, for example letters and emails between the Clinic and you, letters we send to your GP to inform them of your treatment or letters you ask us to write to your employer.

The Clinic may also collect, use and store the following special personal data about you:

• Notes and reports relevant to your health, including any information you have told us about your health.
• Details of your treatment and care, including the professional opinion of the staff caring for you.
• Results of investigations, such as laboratory tests and x-rays.
• Relevant information from health and social care professionals, relatives or those who care for you.
• Information about your ethnicity, sexual orientation, sex life, religious beliefs or opinion or genetic data where this is relevant to your care or is information that you have provided to us as part of your care.
• Equality and diversity information about you. This may include details of your ethnicity, sexual orientation, religious or philosophical beliefs or any disability.

How do we use your information?

We only use this data for the purposes of your treatment and to ensure your care and safety as a patient.

We will only use personal information when the law allows us to do so, relying on a relevant basis for lawful processing in each instance (for example, consent).  We will use your personal information in the following circumstances:

• Provide you with treatments for your condition or symptoms.
• Communicate with you and, if appropriate your next of kin and/or carer(s), about your care.
• Carry out internal audits and monitor the care the Clinic provides to ensure it is of the highest standard.
• Get feedback on our service and respond to any complaint from you.
• Keep you up to date about a change, cancellation or postponement of any appointment
• Respond to queries from regulators or if there is a legal requirement for us to do so.
• Conduct legal claims, comply with a court order or other legal obligation, seek legal advice or advice about
• Insurance coverage or other assistance from our professional advisors.
• Provide information to national registries that systematically collect data about particular conditions to help research or evaluation.
• Prevent or manage risks to public health.
• Ask you whether or not you want to participate in research projects.
• Produce anonymous information that we can use to train and educate the Clinic’s staff. We will only use information from which you can be identified for training purposes if you have agreed to this beforehand.
• If you ask us to, to provide a letter about your treatment to your employer.
• To provide you with information, products or services that you request from us.
• To carry out our obligations arising from any contracts entered into between you and us.
• To ensure that content from our website is presented in the most effective manner for you.
• To provide you with information, products or services that we feel may interest you, (where you have consented to be contacted for such purposes to the extent consent is required by law).
• Where you are a referring doctor, to contact you and verify any details relating to your practice and/or the client in question.
• To allow you to participate in interactive features of our service, when you choose to do so.
• To notify you about changes to our service.
• To maintain a basic amount of information about you and your transaction history, in order to provide you with a service tailored to your preferences.
• To retain basic transaction details for the purpose of tax reporting or updating medical records.
• To use non-essential cookies on our website . You have the right to withdraw consent to such use at any time by contacting us but please note that some or all parts of our website may no longer be accessible to you.
• To send you direct marketing communications via email, text message, post or telephone call where you have consented to this. You have the right to withdraw consent to any such use at any time by contacting us.
• Please note that we may process your personal information under more than one lawful basis depending on the specific purpose for which we are using your data.
• We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will notify you beforehand.
• Where we need to collect personal information by law, or under the terms of a contract we have with you, and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you (for example, to provide you with services).
• Please note that we may process your personal information without your knowledge or consent where this is required or permitted by law.
• We may collect, use and share aggregated data such as statistical or demographic data for any purpose. Aggregated data may be derived from your personal information but is not considered “personal data” in law as this data does not directly or indirectly reveal your identity. For example, we may aggregate your website usage data to calculate the percentage of users accessing a specific website feature. However, if we combine or connect aggregated data with your personal information so that it can directly or indirectly identify you, we treat the combined data as personal information which will be used in accordance with this privacy policy.

How is information about me stored?

Your information will be stored electronically on a patient information system. From time to time some of your data may be stored temporarily in other systems in order to provide patient services and support.

We take the security of your data seriously and take all appropriate steps, including encryption in transit and at rest, and multi-factor authentication, to protect it from unauthorised access, loss and misuse. We never sell any of your personal data for any purpose. 

We further restrict access to any sensitive personal data we may collect (such as medical records) and it is never used for marketing purposes.

Cookies

To help us give you the best possible experience, our websites and emails contain cookies, and similar technologies. Cookies are small text files that are downloaded to your computer/device when you visit websites. They serve a range of purposes such as helping us understand our website usage, activity and user behaviour.

When you use our website you will be provided the option to consent to all cookies, only essential cookies, or customise your cookie options.

Does the Clinic share my personal information?

As part of providing you with care we may need to share your information. This includes sharing information with:

• Your referring healthcare professional
• Organisations that provide diagnostic tests;
• Organisations that provide private ambulance or patient transport services

With your agreement, information can be shared with relatives, partners or friends who act as a carer for you. We may share information with anyone you have given as an emergency contact, for example your next of kin.

Sharing your information for other purposes

Usually the Clinic will not share information about you and your health with other organisations unless they are involved in your care or you have agreed to the data sharing, such as when instructing us to send your prescription to a pharmacy. 

However, there are some limited circumstances where we may share information with other organisations who are not directly involved in your care. For example:

• We may share information with the police, fire and rescue services if:
  ⁃ There is an immediate risk of harm to you or other people
  ⁃ There is a legal requirement to do so e.g. the police have obtained a court order requiring us to provide information
• We may share information with our professional advisors, including lawyers and accountants, if this is necessary to take and receive professional advice (including legal advice) and with insurers,
• We may share information with individuals or organisations specified in a court order.
• Where we, or substantially all of our assets, are merged or acquired by a third party, in which case this information may form part of the transferred or merged assets

How long will the Clinic keep personal data about me for?

Your personal data will be held by the Clinic for as long as is necessary to fulfil the purpose for which it was collected. It will then be stored for a period of 10 years. At the end of that period, your data will either be deleted or anonymised so that it can be used in a non-identifiable way for statistical analysis which helps us make improvements to our service and business.

Will the Clinic transfer my data outside of the EU? 

In most instances, your data will be stored on servers located in the UK or EU. Some software providers we use may have servers located in the United States. 

These software providers are bound to comply with the GDPR requirements and your data is subject to the same safeguards as if it were held in the EU.

What rights do I have?

Both the UK General Data Protection Regulation (GDPR) give individuals rights about their personal data:

• Request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information the Clinic holds about you and to check that the Clinic is lawfully processing it. 
• Request correction of the personal information that the Clinic holds about you. This enables you to have any incomplete or inaccurate information the Clinic holds about you corrected.
• Request erasure of your personal information. This enables you to ask the Clinic to delete or remove personal information where there is no good reason for the Clinic continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where the Clinic is relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground.
• Request the restriction of processing of your personal information. This enables you to ask the Clinic to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

Please note there may be instances where we refuse your request for any of the above (unless otherwise stated) where we have a strong overriding reason or are legally obliged to.

If you wish to exercise any of your rights, have a complaint or questions about this policy, please contact our Data Protection Officer at the contact details specified in the section below.

You can find out more about your rights under the GDPR through the Information Commissioner’s Office for the UK: https://ico.org.uk/  

Who can I contact at the Clinic in relation to my data?

If you have any questions about how the Clinic uses your personal data, your rights or the content of this notice, the Clinic has appointed a Data Protection Officer (“DPO”). Please contact the DPO at dataprotection@resiliencemedicine.co.uk 

If you do not think that the Clinic has complied with your data protection rights or legislation you can contact the Information Commissioner’s Office at https://ico.org.uk/ 

Changes to this privacy policy

We may update this privacy policy from time to time to reflect how we use your personal data. We encourage you to review this policy regularly on our website to stay informed of how we use your data.

Terms