Business Privacy Policy Notice
The policy: This privacy policy notice is served by Gina Groom under the website www.ginagroom.co.uk. The purpose of this policy is to explain to you how I/we control, process, handle and protect your personal information through the business.
Policy key definitions:
“I”, “our”, “us”, or “we” refer to the business, [Gina Groom Soft Tissue Therapy].
“you”, “the user” refer to the person(s) using my/our services.
GDPR means General Data Protection Act.
PECR means Privacy & Electronic Communications Regulation.
ICO means Information Commissioner’s Office.
CHP means Complementary Health Professionals
Key principles of GDPR:
Our privacy policy embodies the following key principles [Article 5(1) and Article 5(2) ];
(a) Lawfulness, fairness and transparency,
(b) Purpose limitation,
(c) Data minimisation,
(d) Accuracy,
(e) Storage limitation,
(f) Integrity and confidence,
(g) Accountability.
Processing of your personal data
Under the GDPR (General Data Protection Regulation) I/we control and / or process any personal information about you electronically using the following lawful bases.
ICO Data Protection Register: I/ We are registered with the ICO under the Data Protection Register, our registration number is: ZC212118.
Lawful basis: Consent
Where my/our purpose for processing your information is so that a full picture of your health information can be obtained in order to provide you with a safe and effective complementary therapy treatment plan, to include advice post treatment for you to utilise. This is necessary because there are some contraindications and cautions depending on the therapy I am providing and I may need to adapt or refer.
I/We process your information in the following ways:
Data retention period: I/We will continue to process your information under this basis until you withdraw consent, or it is determined your consent no longer exists.
Sharing your information: We do not share your information with third parties. I/ We do share your personal information with third parties. Legally, the only time I/We can share information is if yours or another life is in danger.
Lawful basis: Contract
Our purpose for holding your records even if you have ceased to be a client is that for insurance purposes, I/we have to keep a record of your treatments for 6 years. After this time, the records are shredded.
It is necessary to keep them for this period because it may be required by you to inform healthcare or a complaint. It is also a requirement within my insurance contract.
We process your information in the following ways: Add here whether or not you keep the records physically in a locked cabinet or on a secure server with password control and ideally two factor authentication.
If, as determined by us, the lawful basis upon which we process your personal information changes, we will notify you about the change and any new lawful basis to be used if required. We shall stop processing your personal information if the lawful basis used is no longer relevant.
Your individual rights
Under the GDPR your rights are as follows. You can read more about your rights in details on the ICO website www.ico.org.uk
You have:
- the right to be informed;
- the right of access;
- the right to rectification;
- the right to erasure;
- the right to restrict processing;
- the right to data portability;
- the right to object; and
- the right not to be subject to automated decision-making including profiling.
- the right to make a complaint
- You also have the right to complain to the ICO (www.ico.org.uk) if you feel there is a problem with the way we are handling your data.
How to make a complaint
In the first instance, if you feel that a breach of data protection has taken place from my/our business, we would ask you to inform us directly so that we can address the problem with you.
As a member of the professional association Complementary Health Professionals (CHP), you can email them at enquiries@complementaryhealthprofessionals.co.uk with your complaint and how this has affected you. They will then follow their disciplinary procedures, published on their website at www.complementaryhealthprofessionals.co.uk
If necessary, CHP can escalate the complaint to the ICO.