Privacy Notice

Our policy

Principal Medical Limited (PML) processes information relating to individuals whilst carrying out daily business. Personal information or data that is processed includes information about current, past and prospective employees, patients, customers, clients, suppliers, professional advisers and other third-party organisations. The collection and use of this information is regulated by the Data Protection Act 2018. Please read the Data Protection Act for more information.

This privacy notice explains why PML collects information about you, what we do with that information, how we keep it safe and confidential and what your rights are in relation to this. Personal Information in this privacy notice means any information about you or other people, to provide you with the most appropriate service.

Why we collect information about you

We collect, store and process data for the purpose of providing healthcare services, running our organisation which includes monitoring the quality of care and service that we provide, maintaining accounts and records, promoting our services and to support and manage our employees.

In carrying out this role, we may collect information about you which helps us respond to your queries or secure specialist services. We may keep your information in written form and/or in digital form and may include:

• Details about you such as your name, address (including correspondence if different), telephone numbers, date of birth, contacts (next of kin), GP details.
• Further sensitive information may be collected such as your marital status, occupation, religion, email address, place of birth, ethnic origin and other information as required.
• Notes and reports about your health, treatment and care.
• Results of investigations, such as laboratory tests, x-rays, etc.
• Relevant information from other health professionals, relatives or those who care for you.
• Contact with you by our community service teams e.g. home visits and appointments.
• Financial details
• Employment and educational details

We also record incoming and outgoing telephone conversations in accordance with Article 6 of the general data protection regulations. CCTV recordings are also made to ensure patient and staff safety.

When you use our website, you may give us information about yourself as an individual by filling in forms, completing questionnaires or by corresponding with us by telephone or email. We also collect aggregate information on which pages web users’ access or visit, and information volunteered by the website user (such as survey information and/or site registrations). The information we collect is used to improve the quality of our service.

There are elements of this website which are password protected and in order for us to provide access to these areas, you give us personal information which identifies you individually such as your name and email address. By signing up to these sections of the website, you are consenting to sharing your information with us.

What do we do with personal information?

Personal information captured and processed in our clinical services is used to manage and assist the staff involved in your care, in ensuring that you are assessed and advised on the most appropriate care for you and is communicated and shared with all relevant health professionals.

It may also be used to:

• Remind you about your appointments and send you relevant correspondence
• Review the care we provide to ensure it is of the highest standard and quality, e.g. through audit or service improvement
• Support the funding of your care, e.g. with commissioning organisations
• Help to train and educate healthcare professionals
• Report and investigate complaints, claims and incidents and report events to the appropriate authorities when we are required to do so by law.
• Contact you with regards to patient satisfaction surveys relating to services you have used to further improve our services.

Personal information captured for maintaining accounts and records, promoting our services and supporting and managing our patients and employees is used purely for the purposes of explained. We may process information about our:

• Staff
• Customers
• Suppliers
• Business Contacts
• Professional advisers

Please see Privacy Notice Appendix A for more details, this can be requested via our online form

Who personal information may be shared with

We may have to share your information, subject to strict agreements on how it will be used.

PML provides health care services and personal information can be shared as part of providing your care with relevant consents. However, importantly, we can also share information about you where there is another legal basis to do so. Some of the organisations we may share information with are:

• Healthcare professionals and providers
• Social and welfare organisations
• Government and Local Authorities and Agencies
• Family, associates and representatives of the person whose personal data we are processing.
• Commissioners
• Suppliers and service provider
• Financial organisations
• Current, past and prospective employers

Security of personal information

PML is strongly committed to protecting the privacy of individuals. When you provide us with personal information through our website or by other means of data capture, in the process of providing healthcare services and running our organisation, it will be treated in the strictest of confidence and in accordance with the Data Protection Act 2018.

We will only use information collected lawfully in accordance with:

• Data Protection Act 2018
• United Kingdom General Data Protection Regulation (UK GDPR)
• Human Rights Act
• Common Law Duty of Confidentiality
• NHS Codes of Confidentiality and Information Security
• Health and Social Care Act 2012
• And all applicable legislation

PML ensures that personal information is held securely and takes appropriate technical and organisational measures; including restricting access to data and securing computers, with access control, through usernames and passwords for electronically held personal information. For personal information held on paper, this information is held in locked facilities with restricted access and where permanently based for archive purposes, the records are held in secure external storage.

No personal information you give us will be passed on to third parties for commercial purposes. Our policy is that all information will be shared among PML members (and any third party) on a need basis, and according to legal regulations and appropriate consent. If we have to confirm or share information with other organisations, this will be in-line with a legal requirement to do so and only kept for as long as is required by law.

We will use your data to provide you with the services for which you have registered with us (e.g. to process job applications) and for the purposes described in this statement. If you have applied for a job with PML through our online application process, your personal information will only be held on our servers until the advertised role is filled. After that, we will only keep it electronically for a maximum period of six months unless you request otherwise.

We manage patient records in line with the Records Management NHS Code of Practice for Health and Social Care which sets the required standards of practice in the management of records for those who work within or under contract to NHS organisations in England, based on current legal requirements and professional best practice and in line with our records management policy.

Data Retention Periods: PML retains personal data only for as long as is necessary to fulfil the purposes for which it was collected, including the provision of healthcare services, compliance with legal and regulatory obligations, and the establishment, exercise or defence of legal claims. Retention periods are determined in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, Information Commissioner’s Office (ICO) guidance, the NHS Records Management Code of Practice for Health and Social Care, and any other applicable UK legal and regulatory requirements. Once the applicable retention period has expired, personal data will be securely deleted, destroyed, or anonymised in accordance with our Records Management Policy and information governance procedures.

Cookies

Our website uses cookies to distinguish you from other users of our website. This helps us to provide you with a good experience when you browse our website and also allows us to improve our site. By continuing to browse the site, you are agreeing to our use of cookies. A cookie is a small file of letters and numbers that we store on your browser or the hard drive of your computer if you agree. Cookies contain information that is transferred to your computer’s hard drive.

We use the following cookies:

• Strictly necessary cookies. These are cookies that are required for the operation of our website. They include, for example, cookies that enable you to log into secure areas of our website.
• Analytical/performance cookies. They allow us to recognise and count the number of visitors and to see how visitors move around our website when they are using it. This helps us to improve the way our website works, for example, by ensuring that users are finding what they are looking for easily.
• Functionality cookies. These are used to recognise you when you return to our website. This enables us to personalise our content for you, greet you by name and remember your preferences (for example, your choice of language or region).
• Targeting cookies. These cookies record your visit to our website, the pages you have visited and the links you have followed. We will use this information to make our website more relevant to your interests. We may also share this information with third parties for this purpose.

Please note that third parties (including, for example, providers of external services like web traffic analysis services) may also use cookies, over which we have no control. These cookies are likely to be analytical/performance cookies or targeting cookies.

You can block cookies by activating the setting on your browser that allows you to refuse the setting of all or some cookies. However, if you use your browser settings to block all cookies (including essential cookies) you may not be able to access all or parts of our site. To find out how to allow, block, delete and manage the cookies on all standard web browsers, please go to the about cookies website. If you use a mobile phone to browse our websites or other sites that use cookies, please refer to your handset manual for guidance.

What are your rights?

Since UK GDPR you have important rights to protect your personal data. You can access any of these rights by contacting us. The following is a summary of those rights:

• Right to be informed – individuals have the right to be informed about the collection and use of their personal data.
• Right of Access – you have rights to request access to the personal data we hold about y
• Right of rectification – you have the right to request the correction of inaccurate or incomplete information recorded in the record, subject to certain safeguards.
• Right to erasure (Right to be Forgotten) – You have the right to ask us to delete your personal information in certain circumstances. However, this right does not apply in all situations. We may be required to keep some information where there is a legal, regulatory or legitimate business reason to do so, including where healthcare records must be retained in accordance with NHS records management requirements. Right to restrict processing – where certain conditions apply, you have a right to restrict the processing.
• Right of portability – you have the right to request personal information to be transferred to others on certain occasions.
• Right to object – individuals have the right to object to the processing of their personal data in certain circumstances e.g. being used for direct marketing. Objections can be made verbally or in writing.

We will not be able to erase or cease processing personal information that is required to maintain our business purpose, we have a legal reason to keep it, or required to facilitate your contract with us.

If you are happy for your data to be extracted and used for the purposes described in this privacy notice then you do not need to do anything.  Should you decide in the future that you want to opt out of receiving communications or cease to be the point of contact for your organisation, please contact us on 01295 981166, at which point all of the personal data we hold for you would be deleted with the exception of information we may still be legally required to hold.

Your right to withdraw consent for us to share your personal information (Opt-Out)

If you are happy for your data to be extracted and used for the purposes described in this privacy notice then you do not need to do anything. If you do not want your information to be used for any purpose beyond providing your care you can choose to opt-out. If you wish to do so, please let us know so we can code your record appropriately. We will respect your decision if you do not wish your information to be used for any purpose other than your care but in some circumstances we may still be legally required to disclose your data.

There are two main types of opt-out.

• Type 1 Opt-Out: If you do not want information that identifies you to be shared outside the practice, for purposes beyond your direct care, you can register a ‘Type 1 Opt-Out’. This prevents your personal confidential information from being used other than in particular circumstances required by law, such as a public health emergency like an outbreak of a pandemic disease.
• National Data Opt-Out (formerly known as Type 2 Opt-Out): NHS Digital collects information from a range of places where people receive care, such as hospitals and community services. If you do not want your personal confidential information to be shared outside of NHS Digital, for purposes other than for your direct care, you can register for the National Data Opt-Out. For further information visit the NHS website

Access to your information

Under the Data Protection Act 2018 and General Data Protection Regulation 2018 everybody has the right to see, or have a copy, of data we hold that can identify you, with some exceptions. You do not need to give a reason to see your data. If you want to access your data you must make the request in writing. Under certain circumstances, some information may be withheld where permitted by law. Requests for access to personal information are generally provided free of charge. However, we may charge a reasonable fee where a request is manifestly unfounded or excessive, particularly if it is repetitive, or where additional copies of information already provided are requested.

If you wish to have a copy of the information we hold about you, please contact us.

Change of details

It is important that you tell us if any of your details such as your name, address or email have changed or if any of your details are incorrect in order for this to be amended. Please inform us of any changes promptly so our records for you are accurate and up to date.

Notification

The Data Protection Act 2018 requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information.

PML is registered with the Information Commissioner’s Office (ICO) to process personal and special categories of information under the Data Protection Act 2018 as a data controller. Our registration number is Z1066624 and our registration can be viewed online in the public register on the ICO website

Data protection officer

Please contact our Director of Quality: Tony Summersgill

• Email: t.summersgill@nhs.net
• Address: PML, 3 Barberry Place, Bicester, Oxfordshire, OX26 3HA
• Telephone: 01295 981166

Any changes to this notice will be published on our website.

Complaints

If you have concerns or you are not satisfied with our response or believe we are processing personal information not in accordance with the law you can complain to the ICO:

• Address: The Information Commissioner’s office, Wycliffe House, Water Lane, Wilmslow Cheshire SK9 5AF
• Phone: 0303 123 1113
• Fax: 01625 524 510

Visit the ICO website