Why We Collect Your Personal Data and What We Do With It

When you supply your personal details to this clinic they are stored and processed for 4 reasons (the bits in bold are the relevant terms used in the Data Protection Act 2018, which includes the General Data Protection Regulation – ie the law):

1. We need to collect personal information about your health in order to provide you with the best possible care. Your requesting treatment and our agreement to provide that care constitutes a contract. You can, of course, refuse to provide the information, but if you were to do that we would not be able to provide treatment.
2. We have a “Legitimate Interest” in collecting information, because without it we couldn’t do our job effectively and safely.
3. We also think that it is important that we can contact you in order to confirm appointments with us or to update you on matters related to your medical care. This again constitutes “Legitimate Interest”, but this time it is your legitimate interest.
4. Provided we have your consent, we may occasionally send you general health information in the form of articles, advice, newsletters or videos. You may withdraw this consent at any time – just let us know by any convenient method.

We record and use the following categories of personal data: name, address, telephone numbers, email address, date of birth, health information including medical history, diagnosis and treatment data. Our lawful basis of processing data is one of contract and, for the health information, the provision of health-related services as a chiropractic clinic. In addition, we will only examine or treat you with your explicit consent.

Your records are stored:

• on paper, in locked filing cabinets, and the offices are always locked and alarmed out of hours.
• electronically, using a specialist booking software service. This provider has given us their assurances that they are fully compliant with the General Data Protection Regulations. Access to this data is password protected, and the passwords are changed regularly.

Sharing Your Personal Data

We will never share your data with anyone who does not need access without your written consent. Only the following people/agencies will have routine access to your data:

• The booking service who store and process our files
• Your practitioner(s) in order that they can provide you with treatment, coordinate appointments and reminders

From time to time, we may have to employ consultants to perform tasks, which might give them access to your personal data (but not your medical notes). We will ensure that they are fully aware that they must treat that information as confidential, and we will ensure that they sign a non-disclosure agreement.

Retaining Your Personal Data

We have a legal obligation to retain your records for 8 years after your most recent appointment (or age 25, if this is longer), but after this period you can ask us to delete your records if you wish. If you make an enquiry with us and do not come to see us in person, your data will be stored for up to 12 months before it is erased.

Data Protection Officer

As we record and use sensitive health data we take the protection of this data very seriously. We have therefore appointed a Data Protection Officer, Peter Blenkarn who is your first point of contact for any matters regarding your personal data we process. They can be contacted on 01444 812888, their email address is info@nimbusclinics.com and their postal address is Nimbus Clinics, 91 Church Walk, Burgess Hill, West Sussex, RH15 9BQ.

Your Rights

You have the right to see what personal data of yours we hold, you can also ask us to correct any factual errors or ask us to restrict or stop our processing of your data. Provided the legal minimum time period has elapsed, you can also ask us to erase your records.

If you wish to request one of the above, please make such a request in writing or by email to the Data Protection Officer, whose details are shown above. Please provide the following information: your name, address, telephone number, email address and details of the information you require. We will need to verify your identity so we may ask for a copy of your passport, driving license and/or recent utility bill.

Data Breaches

Should your personal data that we control be lost, stolen or otherwise breached, where this constitutes a high risk to your rights and freedoms, we will contact you without delay. We will give you the contact details of the Data Protection Officer who is dealing with the breach, explain to you the nature of the breach and the steps we are taking to deal with it.

Should you wish to complain

We want you to be absolutely confident that we are treating your personal data responsibly, and that we are doing everything we can to make sure that only people who can access that data have a genuine need to do so.

Of course, if you feel that we are mishandling your personal data in some way, you have the right to complain. Complaints need to be sent to what is referred to in the jargon as the “Data Controller”. They can be contacted on 01444 812888, their email address is info@nimbusclinics.com and their postal address is as given above.

If you are not satisfied with our response, then you have the right to raise the matter with the Information Comissioner’s Office (ICO) https://ico.org.uk.

Automated Decision Making and Profiling

We do not use any system that uses automated decision making or profiling in respect to your personal data.