This privacy notice sets out details of the information SMCC and the clinicians responsible for your treatment (including their medical secretaries) may collect from you and how that information may be used. Please take your time to read this privacy notice carefully.
This privacy notice:
- Provides you with a detailed overview of how we will manage your data, from the point at which it is gathered and onwards.
- Will give you all the details you need on how we use your information, and how we will comply with law in doing so. We may also, with your specific agreement, contact you with marketing materials.
- Sets out your rights in respect of your personal information, and how to exercise them. You can, for instance, seek access to your medical information, object to us using your information in particular ways and request rectification of any information which is inaccurate.
We are also open to improvement; if you have any feedback on this notice contact your Data Protection Officer with your thoughts.
About us
In this privacy notice we use ‘we’ or ‘us’ or ‘our’ or SMCC refer to the Sutton Medical Consulting Ltd using your personal information, and the clinicians who provide your treatment.
We will advise you in our communications with you within the SMCC group any decisions about the use of your personal information, this information is held by Sutton Medical Consulting Centre, 233 Tamworth Road, Sutton Coldfield, B75 6DX company no. 05989806.
Our Data Protection Officer and how to contact us
The data protection officer (“DPO”) helps us ensure that SMCC complies with data protection law. The DPO can be contacted by:
- Telephone: 0121 308 7774
- Email: admin.team@suttonmed.co.uk
- Post: Data Protection Officer, Sutton Medical Consulting Centre, Ashfurlong Medical Centre, 233 Tamworth Road, Sutton Coldfield, West Midlands, B75 6DX.
If you would like further information about any of the matters in this privacy notice or have any other questions about how we collect, store or use your personal information, please contact the DPO using details above.
Your personal data and clinicians
As a patient of SMCC, your treatment may be provided by a clinician who is a medical practitioner. For ease of reference, we refer to them simply as ’clinicians’ throughout this privacy notice. Those clinicians make decisions about what information is collected about you, and may maintain their own set of medical records in relation to the treatment they provide.
They are a data controller in respect of your personal information which they hold within those records, meaning that they must comply with the data protection legislation and relevant guidance when handling your personal information.
To the extent relevant to their practice, you can expect clinicians (including their medical secretaries) to handle your information in line with this privacy notice. This includes using your personal information as set out in more detail below.
Clinicians who work alongside SMCC (including their medical secretaries) are expected to handle your personal data in accordance with the principles set out within this Privacy Notice.
Clinicians who work with SMCC (including their medical secretaries) may process your personal information at a non SMCC site (medical or non-medical).
If you have any concerns about the way your clinician has handled your personal information please contact the DPO.
What personal information do we collect and use from patients?
The personal information that we collect will depend on your relationship with us. We will collect different information depending on whether or not you are already a patient of SMCC.
We may use “special categories or personal information” (otherwise known as “special
categories of data”) about you, such as information relating to your physical and mental health. For example, if you are a patient we will need to use information about your health in order to treat you.
If you provide personal information to us about other individuals (including medical or financial information) you should inform the individual about the contents of this privacy notice. We will process such information in accordance with this privacy notice.
In addition, you should note that in the event you amend data which we already hold about you (for instance by amending a pre-populated form) then we will update our systems to reflect the amendments. Our systems will continue to store historical data.
Personal information
As a patient of SMCC, the personal information we hold about you may include the following:
- Name
- Contact details, such as postal address, email address and telephone number (including mobile number).
- Financial information such as private insurers
- Occupation
- Emergency contact details, including next of kin
- Background referral details
Special categories personal information
As a patient of SMCC, we will hold information relating to your medical treatment which is known as a special category or personal data under the law, meaning that it must be handled even more sensitively. The special categories of personal information we hold about you may include the following:
Details of your current or former physical or mental health. This may include information about any healthcare you have received (both from SMCC directly and other healthcare providers such as GPs, dentists or hospitals (private and/or NHS)) or need, including about clinic and hospital visits and medicines administered.
We provide further details below on the manner in which we handle such information:
- Details of services you have received from us.
- Details of your nationality, race and/or ethnicity.
- Details of your religion.
- Details of any genetic data or biometric data relating to you.
- Data concerning your sex life and/or sexual orientation.
The confidentiality of your medical information is important to SMCC. We make every effort to prevent unauthorised access to and use information relating to your current or former physical and mental health.
In doing so, SMCC complies with UK data protection law, including the Data Protection Act 2018, and all applicable medical confidentiality guidelines issued by professional bodies including, but not limited to, the General Medical Council and the Nursing Midwifery Council.
From 25th May 2018, the current Data Protection Act will be replaced by the EU General Data Protection Regulation (GDPR) and a new Data Protection Act. All uses of SMCC information will comply with the GDPR and the new Data Protection Act from that date onwards.
How do we collect your information?
We may collect personal information from a number of different sources including, but not
limited to:
- GPs
- Dentists
- Other hospitals, both NHS and private
- Mental health providers
- Commissioners of healthcare services
- Clinicians (including their medical secretaries)
- Directly from you
- Information may be collected directly from you when;
- You enter into a contract with SMCC for the provision of healthcare services
- You use those services
- You complete enquiry forms on the SMCC website
- You submit a query to us including through our website, by email or by social media
- You correspond with by letter, email, telephone or social media, including where you reference SMCC in a public social media
- You take part in marketing activities
- You use SMCC GP services
From other healthcare organisations
Our patients will usually receive healthcare from other organisations in addition the SMCC, in order to provide you with the best treatment possible we may need to collect personal information about you from them, which may include:
- Medical Records from your GP
- Medical Records from your clinician, including their secretary
- Medical Records from your dentist
- Medical Records from the NHS or any private healthcare organisations
Medical records include information about your diagnosis, clinic and hospital visits and the
medicines administered. From third parties. As detailed above it is often also necessary to seek information from Third Parties when;
- You are referred us for the provision on services including healthcare.
- We liaise with your current or former employer. And healthcare providers.
- We liaise with your family.
- We liaise with your Insurance Company.
- We liaise with medical experts.
- We liaise with NHS bodies.
- We liaise with credit or debit collection services.
- We liaise with Government agencies including; Ministry of Defence, HMRC the Home office.
How we will communicate with you
We may communicate with you by; telephone, SMS, email or post. To inform you of the
following;
- Contact you via the Telephone number you have consented to give, and you have an answering machine we will leave an appropriate message.
- To provide timely updates, appointments or reminders
- To forward patient surveys to improve our services and not to use as marketing
Please note, stating your preferred communication method does not mean we rely on your consent to contact you with regards to your treatment as this is deemed as a justified reason to use personal data.
Surveys
As detailed above we may contact you to participate in a survey regarding your treatment or visit to SMCC. You may receive these surveys by post, email or in person. This is not a form of marketing and your personal details will not be used. The information obtained is voluntary and will be used to gather information assess the quality of your treatment and improve services.
You may also be contacted to participate in surveys which involve monitoring the outcomes of your treatment. These surveys are also not a form of marketing and can be generate from a third party healthcare provider such as NHS England or the CMA.
What are the purposes of collecting your information?
We may process or use your information for different purposes, as long as we do so with legal justification. When personal information is classed as “special category” we must have a legal justification to use it as proposed.
In general we will be governed by the following justifications:
- Entering into a contract with SMCC/clinician to provide your treatment
- Providing a Healthcare Pursuant as a contract between you and your clinician or SMCC
- To ensure your personal information is processed and used appropriately and does not cause harm
- We have a legal or regulatory right to use your data
- Information is required to establish, exercise or defend our legal rights
- You have provided consent
Failure to provide your information to a contractual requirement with SMCC or clinician may mean that you will be unable to receive treatment.
Appropriate business needs
A legal ground for processing data is in pursuit of legitimate interests and those interests are not overridden by your privacy rights. If we refer to use for our business needs, we are relying on this legal ground.
Special categories of personal information include:
- Health
- Sex life
- Sexual orientation
- Ethnicity
- Political opinions
- Religious or philosophical beliefs
- Genetic or biometric information
The right to object to the use of personal data
You have many rights in respects of the use of your personal data, including your right to object to using the data in a specific way i.e. sharing with a 3rd party, of which we must comply. Exceptions do apply i.e. to defend a legal claim against us, or if the data is being used for ongoing treatment.
Please find below the legal details relating to our processing purposes.
Purpose 1: To set you up as a patient including any financial background check if necessary
It is unlikely that any checks will be carried out by SMCC for you to become a patient, however if it did become necessary because of the treatment you are about to receive, this would include standard background check that cannot be performed without using your data:
- Legal grounds; taking the necessary steps when required to enter into a contact with
SMCC/clinician - Additional legal Ground for special categories of personal information. The use is necessary for reasons of substantial pubic interest
Purpose 2: To provide you with healthcare and supporting services
You have chosen SMCC to provide you with healthcare and we will use your data accordingly:
- Legal grounds; proving your with healthcare and supporting services/fulfilling the agreed contract to deliver your healthcare.
- Additional legal ground for special categories of personal information. The use is necessary to provide healthcare services to you/use is necessary to protect your vital interests where you are physically or legally incapable of giving consent.
Purpose 3: For settling accounts
We will use your personal information to ensure concise and accuracy billing data is held about you:
- Legal grounds; to provide healthcare and supporting services to you/fulfilling our contract and having the appropriate business need to use your information as long as it does not prejudice you.
- Additional legal ground for special categories of personal information; to provide healthcare and supporting services to you/to establish, exercise or defend our legal rights.
Purpose 4: For medical audit/research purposes
Medical audit
SMCC may process your data for Clinical Audits, audits which may have been carried out by SMCC, your clinician or supporting services, for the purpose of identifying improvements. You are able to object to the use of your data and to raise an objection please contact the data protection officer.
It is unlikely however we may be asked to share your data with UK registries such as NHS England, whereby ethical approval is not required. All registries requests would be reviewed.
A full copy of the current list can be found at www.hqip.org.uk/list
It is unlikely however we may without your consent and providing the audit registry has received statutory approval, or whereby the information will be provided in a purely anonymous from, otherwise consent is required.
Research
It is very unlikely SMCC will participate in medical research, however a visiting clinician may be involved, in these cases we will only share your data to the extent that is necessary to do so in assisting research and as permitted by law. If a research project does not require by law prior consent, your data will be shared on this basis:
- Legal grounds; having a legitimate interest in medical research and appropriate safeguards are in place to protect privacy
- Additional legal ground for special categories of personal information; processing is necessary in the public interest for research purposes
- In the event that consent is required then either the research organisations will obtain this directly, and any questions or further information can be obtained from them
Purpose 5: Communication with you and resolving any queries or complaints that you may have
Patients can raise queries or make complaints, we take these very seriously, and will endeavour to investigate them fully and resolve them efficiently. Your personal information will be require to allow us to carry out this task.
- Legal grounds; to provide healthcare and supporting services to you/fulfilling our contract and having the appropriate business need to use your information as long as it does not prejudice you.
- Additional legal ground for special categories of personal information; to provide healthcare and supporting services to you/to establish, exercise or defend our legal rights.
Purpose 6: Communicating with any other individual that you ask us to update about your care and updating other healthcare professionals about your care
In addition, other healthcare professionals or organisations may need to know about your
treatment in order for them to provide you with safe and effective care, and so we may need to share your personal information with them. Further details on the third parties who may need access to your information is set out later in this document.
- Legal grounds; our providing you with healthcare and other related services. We have a legitimate interest in ensuring that other healthcare professionals who routinely involved in your care have a full picture of your treatment.
- Additional legal ground for special categories of personal information; we need to use the data in order to provide healthcare services to you. The use is necessary for reasons of substantial public interest under UK law. The use is necessary in order for us to establish, exercise or defend our legal rights.
We may participate in initiatives to monitor safety and quality, helping to ensure that patients are getting the best possible outcomes from their treatment and care. The competition and markets authority private healthcare market investigation order 2014 establishes the Private Healthcare Information Network (“PHIN”), as an organisation who will monitor outcomes of patients who receive private treatment. However, this information will usually only relate to inpatient treatment, not provided by SMCC.
The records shared may contain personal and medical information about patients, including you. PHIN will apply the highest standards of confidentiality to personal information in accordance with data protection laws and the duty of confidentiality. Any information that is published by PHIN will always be in anonymised statistical form and will not be shared or analysed for any purpose other than those stated. Further information about how PHIN uses information, including it’s privacy notice, is available at www.phin.org.uk.
Purpose 7: Complying with our legal or regulatory obligations, and defending or exercising our legal rights
As a provider of healthcare, we are subject to a wide range of legal and regulatory
responsibilities which is not possible to fully list here. We may be required by law or by regulators to provide personal information, and in which case we will have a legal responsibility to do so.
From time to time, SMCC and its clinicians are also the subject of legal actions or complaints. In order to fully investigate and respond to those actions, it is necessary to access your personal information (although only to the extent that it is necessary and relevant to the subject-matter).
- Legal grounds; the use is necessary in order for us to comply with our legal obligations.
- Additional legal ground for special categories of personal information: We need to use the data in order for others to provide informed healthcare services to you. The use is necessary for reasons of the provision of health or social care or treatment or the management of health or social care systems. The use is necessary for establishing, exercising or defending legal claims
- We are also required by law to conduct audits of health records, including medical information, for quality purposes. Your personal and medical information will be treated in accordance with guidance issued by the Care Quality Commission (England), Health Inspectorate Wales and Healthcare Improvement Scotland.
Purpose 8: Providing improved quality, training and security (for example, with respect to recorded or monitored phone calls to our contact numbers) including conducting post treatment surveys
We always look to learn from your experience in order to improve the experience for future
patients. With that in mind, we will use your personal information to identify where such
improvements can be made, such as reviewing recorded phone calls to assess whether anything can be learnt and contacting you to seek your valuable thoughts.
- Legal grounds; our having an appropriate business need to use your information which does not overly prejudice you.
- Additional legal ground for special categories of personal information; we need to use the data in order to manage the healthcare service we deliver, including carrying
out surveys (which are not a form of marketing) in order to identify and carry out necessary improvements.
Purpose 9: Managing our business operations such as maintaining accounting records, analysis or financial results, internal audit requirements, receiving professional advice (eg tax or legal advice)
In order to do this, we will not need to use your special categories of personal information and so we have not identified the additional ground to use your information for this purpose.
- Legal grounds: our having an appropriate business need to use your information which does not overly prejudice you.
Purpose 10: Provide marketing information to you (including information about other products and services offered by selected third party partners)
As a business, we need to carry out marketing but we are mindful of your rights and expectations in that regard. As a result, we will only provide you with marketing which is relevant to our business and only where you have specifically confirmed your consent to do so.
- Legal grounds; our having an appropriate business need to use your information which does not overly prejudice you.
- You have provided consent.
Who do we share your information with?
Disclose to third parties
We may disclose your information to the third parties listed below for the purposes described in this privacy notice. This might include:
- A doctor, nurse, carer or any other healthcare professional involved in your treatment
- Other members of support staff involved in the delivery of your care, like receptionists and porters
- Anyone that you ask us to communicate with or provide as an emergency contact, for example your next of kin or carer
- NHS organisations, including NHS Resolution, NHS England, Department of Health
- Other private sector healthcare providers
- Your GP
- Your dentist
- Your clinician (including their medical secretaries)
- Third parties who assist in the administration of your healthcare, such as insurance companies
- Private Healthcare Information Network
- National and other professional research/audit programmes and registries
- Government bodies, including Ministry of Defence, the Home Office, and HMRC
- Our regulators, like the Care Quality Commission, Health Inspectorate Wales and Healthcare Improvement Scotland
- The police and other third parties where reasonably necessary for the prevention or detection of crime
- Our insurers
- Debt collection agencies
- Credit referencing agencies
- Our third party services such as IT suppliers, actuaries, auditors, lawyers, marketing agencies, document management providers and tax advisers
- Selected third parties in connection with any sale, transfer or disposal of our business
We may communicate with these third parties securely in a variety of ways including, but not limited to, email, post, fax and telephone.
What marketing activities do we carry out?
We may also use your personal information to provide you with information about products or services which may be of interest to you where you have provided your consent for us to do so.
If you no longer wish to receive marketing emails sent by us, you can click on the “unsubscribe” link that appears in all our emails, otherwise you can always contact the admin team.
Targeted marketing may be used via our social media platforms.
We will never provide your contact details to any market research agencies.
How long do we keep personal information for?
We will only keep your personal information for as long as reasonably necessary to fulfil the relevant purposes set out in this privacy notice and in order to comply with our legal and regulatory obligations.
If you would like further information regarding the periods for which your personal information will be stored, please contact our DPO for further details.
International data transfers
We may store or process information that we collect about you in other countries outside the European Economic Area (“EEA”). Where we make a transfer of your personal information outside of the EEA we will take the required steps to ensure that your personal information is protected, and only used for medical purposes relating to your treatment.
We will only do so to the extent that it is relevant and necessary. The United States and the EEA have in place a framework, known as privacy shield has been assessed by the EU Commission, and deemed to provide adequate protection to personal data.
Please note that we have listed above the current common transfers of personal data outside of the EEA but it may be necessary, in future, to transfer such data for other purposes. In the event that it is necessary to do so, we will update this privacy notice.
Your rights
Under data protection law you have certain rights in relation to the personal information that we hold about you. These include rights to know what information we hold about you and how it is used. You may exercise these rights at any time by contacting us using the details set out above at section 5.
There will not usually be a charge for handling a request to exercise your rights. If we cannot comply with your request to exercise your rights we will usually tell you why.
There are some special rules about how these rights apply to health information as set out in legislation including the Data Protection Act (current and future), the General Data Protection Regulation as well as any secondary legislation which regulated the use of personal information.
If you make a large number of requests or it is clear that it is not reasonable for us to comply with a request then we do not have to respond. Alternatively, we can charge for responding.
The right to access your personal information
You are usually entitled to a copy of the personal information we hold about you and details about how we use it. Your information will usually be provided to you in writing, unless otherwise requested. If you have made the request electronically (eg by email) the information will be provided to you by electronic means where possible.
Please note that in some cases we may not be able to fully comply with your request, for
example if your request involves personal data or another person and it would not be fair to that person to provide it to you. You are entitled to the following under data protection law.
Under article 15(1) of the GDPR we must usually confirm whether we have personal information about you. If we do not hold personal information about you we usually need to explain to you:
The purposes for which we use your personal information
The types of personal information we hold about you:
- Who your personal information has been or will be shared with, including in particular organisations based outside the EEA.
- If your personal information leaves the EU, how we make sure that it is protected.
- Where possible, the length of time we expect to hold your personal information. If that is not possible, the criteria we use to determine how long we hold your information for.
- If the personal data we hold about you was not provided by you, details of the source of the information.
- Whether we make any decisions about you soley by computer and if so details of how those decisions are made and the impact they may have on you.
- Your right to ask us to amend or delete your personal information.
- Your right to ask us to restrict how your personal information is used or to object to our use of your personal information.
- Your right to complain to the Information Commissioner’s Office.
We also need to provide you with a copy of your personal data.
The right to rectification
We take reasonable steps to ensure that the information we hold about you is accurate and
complete. However, if you do not believe this is the case, you can ask us to update or amend it.
The right to erasure
We may update this privacy notice from time to time to ensure that it remains accurate, changes to the manner in which your personal information is to be used then we will provide you with an updated copy of this privacy notice.
In some circumstances, you have the right to request that we delete the personal information we hold about you. However, there are exceptions to this right and in certain circumstances we can refuse to delete the information in question.
In particular, for example, we do not have to comply with your request if it is necessary to keep your information in order to perform tasks which are in the public interest, including public health, or for the purposes of establishing, exercise or defending legal claims.
The right to restriction of processing
In some circumstances, we must “pause” our use of your personal data if you ask us to. We do not have to comply with all requests to restrict our use of your personal information. In particular, for example, we not have to comply with your request if it is necessary to keep your information in order to perform tasks which are in the public interest, including public health, or for the purposes of establishing, exercise or defending legal claims.
The right to data portability
In some circumstances, we must transfer personal information that you have provided to us or to you or (if this is technically feasible another individual/ organisation of your choice.) The information must be transferred in an electronic format.
The right to object to marketing
You can ask us to stop sending you marketing messages at any time and we must comply with your request. You can do this by contacting the DPO (see section 5 for details).
The right not to be subject to automatic decisions
You have a right to not be subject to automatic decisions (i.e. decisions that are made about you by computer alone) that have a legal or other significant effect on you.
The right to withdraw consent
In some cases we need your consent in order for our use of your personal information to comply with data protection legislation. We have explained where we rely on your consent in this way. Where we do this, you have the right to withdraw your consent to further use of your personal information. You can do this by contacting the DPO whose details can be found in section 5.
The right to complain to the Information Commissioner’s Office
You can complain to the Information Commissioner’s Office if you are unhappy with the way that we have dealt with a request from you to exercise any of these rights, or if you think we have not complied with our legal obligations.
More information can be found on the Information Commissioner’s Office website:
Making a complaint will not affect any other legal rights or remedies that you have.
This privacy notice was last updated on 25th May 2018.