PRIVACY POLICY | Essexss

1.Your personal data – what is it?

Personal data relates to an individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation (the “GDPR”).

2. Who are we?

Essex Surgical Specialists (ESS) is the data controller (contact details below). This means ESS decides how your personal data is processed and for what purposes.

3. What personal data do we collect?

Your name, address, date of birth, gender, marital status and next of kin. Contact details including email address, home and mobile telephone numbers
Your previous and current medical health records whether provided by referrers (e.g. GPs) or other third parties
A record of all treatment provided including medical notes, records of operations, blood tests and radiology reports
Your financial information if you are a self-pay patient or the information of the company or individual who is responsible for the payment of invoices relating to your care (e.g. insurer)
Information about medical or health conditions, including whether or not you have a disability for which ESS needs to make reasonable adjustments
Information about medical or health conditions of your family
Information received in response to any surveys or complaints claims

ESS may collect this information in a variety of ways. For example, data might be collected through correspondence or telephone calls with you or through consultations and other medical assessments.

In some cases, ESS may collect personal data about you from third parties, such as insurers or referrers.

4. How do we process and use your personal data?

ESS complies with its obligations under the GDPR by keeping personal data up-to-date, by storing and destroying it securely, by not collecting or retaining excessive amounts of data, by protecting personal data from loss, misuse, unauthorised access and disclosure and by ensuring that appropriate technical measures are in place to protect personal data.

ESS use your personal data for the following purposes:

To support the provision of your healthcare
To decide how best to provide treatment to you
To keep your records up-to-date as necessary for our own legitimate interests or those of other persons and organisations
For good governance, accounting, and managing and auditing our clinical and business operations

As necessary to comply with a legal obligation:

When you exercise your rights under Data Protection Laws and make requests
For compliance with legal and regulatory requirements and related disclosures
For establishment and defence of legal rights
To verify your identity and to investigate complaints, legal claims and data protection or clinical incidents.

Based on your consent:

If you ask ESS to disclose your personal data to other people or organisations such as a company handling a claim on your behalf; or otherwise agree to disclosures;

You are free at any time to change your mind and withdraw your consent. The consequence might be that ESS cannot continue to provide full healthcare services to you.

5. Sharing your personal data

Your personal data will be treated as strictly confidential. ESS will not share any of your personal data with any third parties for any purposes except under the following limited circumstances.

Consultants/doctors and other healthcare professionals who provide treatment to you
Other healthcare providers where we feel this will enhance the quality of your care
Sub-contractors and other persons who help us to provide healthcare products and services to you
Companies and other persons providing services to you as part of your extended care
Our legal and other professional advisors, including our auditors
Fraud prevention agencies, credit reference agencies, and debt collection agencies
Government bodies and agencies in the UK and overseas (e.g. HMRC who may in turn share it with relevant overseas tax authorities and with regulators)
The Information Commissioner’s Office (ICO)
Courts, to comply with legal requirements, and for the administration of justice
In an emergency or to otherwise protect your vital interests
To protect the security or integrity of our business operations and other patients
Payment systems and providers
Anyone else where we have your consent or as required by law

6. How long do we keep your personal data?

Information will be kept for a minimum of ten years. Information may be held for longer periods where the following apply:

Retention in case of queries. We will retain your personal data as long as necessary to deal with any queries you may have
Retention in case of claims. We will retain your personal data for as long as you might legally bring claims against us
Retention in accordance with legal and regulatory requirements. We will retain your personal data after you have received healthcare services based on our legal and regulatory requirements.

ESS will only store or transfer your personal data in the UK. This means that it will be fully protected under the GDPR.

7. Your rights and your personal data
Unless subject to an exemption under the GDPR, you have the following rights with respect to your personal data:

The right to request a copy of your personal data which ESS holds about you
The right to request that ESS corrects any personal data if it is found to be inaccurate or out of date
The right to request your personal data is erased where it is no longer necessary for ESS to retain such data
The right to withdraw your consent to the processing at any time
The right to request that the data controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability), (where applicable) [Only applies where the processing is based on consent or is necessary for the performance of a contract with the data subject and in either case the data controller processes the data by automated means]
The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing;
The right to object to the processing of personal data, (where applicable) [Only applies where processing is based on legitimate interests (or the performance of a task in the public interest/exercise of official authority); direct marketing and processing for the purposes of scientific/historical research and statistics]
The right to lodge a complaint with ESS

8. Further processing

If ESS wish to use your personal data for a new purpose, not covered by this privacy policy, then ESS will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, ESS will seek your prior consent to the new processing.

9. Changes to ESS Privacy Notice

ESS may change this privacy policy on occasion. This may be necessary, for example, if the law changes or if ESS change the business in a way that affects personal data protection. Information relating to any changes will be made available on the website.

10. Contact details

To contact ESS about anything to do with your personal data and data protection, including to make a subject access request – please email essexsurgicalspecialists@outlook.com