This practice is committed to complying with the Data Protection Act 2018, the General Data Protection Regulation (GDPR), GDC, NHS and other data protection requirements relating to our work. We only keep relevant information about employees for the purposes of employment and about patients to provide them with safe and appropriate health care.<\/p>\n
The person responsible for Data Protection is the Information Governance Lead Stephanie Magi.<\/p>\n
The practice offers individuals real choice and control. Our consent procedures put individuals in charge to build customer trust and engagement. Our consent for marketing requires a positive opt-in, we don\u2019t use pre-ticked boxes or any other method of default consent. We make it easy for people to withdraw consent, tell them how to and keep contemporaneous evidence of consent. Consent to marketing is never a precondition of a service.<\/p>\n
NHS practice: Our DPO is the Information Governance Lead is Stephanie Magi<\/p>\n
Fully private practice: We do not have a Data Protection Officer as we do not process large volumes of data.<\/p>\n
Pseudonymisation<\/em> Examples of pseudonymisation we use are:<\/p>\n We report certain types of personal data breaches to the relevant supervisory authority within 72 hours of becoming aware of the breach, where feasible. If the breach results in a high risk of adversely affecting individuals\u2019 rights and freedoms we also inform those individuals without undue delay. We keep contemporaneous records of any personal data breaches, whether or not we need to notify.<\/p>\n We provide \u2018fair processing information\u2019, through our Privacy Notice, which provides transparency about how we use personal data.<\/p>\n Individuals have the right to access their personal data and supplementary information. The right of access allows individuals to be aware of and verify the lawfulness of the processing. If an individual contacts the practice to access their data they will be provided with, as requested:<\/p>\n The right to erasure is also known as \u2018the right to be forgotten\u2019. The practice will delete personal data on request of an individual where there is no compelling reason for its continued processing. The right to erasure applies to individuals who are not patients at the practice. If the individual is or has been a patient, the clinical records will be retained according to the retention periods in Record Retention.<\/p>\n Individuals have the right to have personal data rectified if it is inaccurate or incomplete.<\/p>\n Individuals have a right to \u2018block\u2019 or suppress the processing of their personal data. If requested we will store their personal data but stop processing it. We will retain just enough information about the individual to ensure that the restriction is respected in the future.<\/p>\n Individuals have the right to object to direct marketing and processing for purposes of scientific research and statistics.<\/p>\n An individual can request the practice to transfer their data in electronic or other format.<\/p>\n We implement technical and organisational m<\/p>\n easures to integrate data protection into our processing activities. Our data protection and information governance management systems and procedures take Privacy by design as their core attribute to promote privacy and data compliance.<\/p>\n We keep records of processing activities for future reference.<\/p>\n To identify the most effective way to comply with their data protection obligations and meet individuals\u2019 expectations of privacy we review our Privacy Impact Assessment annually.<\/p>\n Information Governance Procedures includes the following information security procedures:<\/p>\n This policy and the data protection and information governance procedures it relates to are reviewed annually.<\/p>\n","protected":false},"excerpt":{"rendered":" This practice is committed to complying with the Data Protection Act 2018, the General Data Protection Regulation (GDPR), GDC, NHS and other data protection requirements relating to our work. We only keep relevant information about employees for the purposes of employment and about patients to provide them with safe and appropriate health care. The person…<\/p>\n","protected":false},"author":2,"featured_media":0,"parent":0,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"footnotes":""},"class_list":["post-842","page","type-page","status-publish","hentry"],"yoast_head":"\n
\nPseudonymisation means transforming personal data so that it cannot be attributed to an individual unless there is additional information.<\/p>\n\n
\n
Data breaches<\/em><\/h2>\n
Right to be informed<\/em><\/h2>\n
Right of Access<\/em><\/h2>\n
\n
Right to erasure<\/em><\/h2>\n
Right of rectification<\/em><\/h2>\n
Right to restriction<\/em><\/h2>\n
Right to object<\/em><\/h2>\n
Data portability<\/em><\/h2>\n
Privacy by design<\/em><\/h2>\n
Records<\/em><\/h2>\n
Privacy impact assessment<\/em><\/h2>\n
Information security<\/em><\/h2>\n
\n
Review<\/em><\/h2>\n