As Professor Phillips and his team are custodians of personal information relating to your medical treatment, we must only use that information in accordance with all applicable law and guidance. This Privacy Notice provides you with a detailed overview of how we will manage your data from the point at which it is gathered and onwards, and how that complies with the law. We will use your personal information for a variety of purposes including, but not limited to, providing you with care and treatment, sharing it with other medical professionals and research/clinical audit programmes.
In addition, you have a number of rights as a data subject. You can, for instance, seek access to your medical information, object to us using your information in particular ways, request rectification of any information which is inaccurate or deletion of information which is no longer required (subject to certain exceptions). This Privacy Notice also sets out your rights in respect of your personal information, and how to exercise them.
The policy is broken into separate sections below with headings which will help you to navigate through the document.
This Privacy Notice sets out details of the information that Professor Phillips and his team are responsible for your treatment (and including our medical secretaries), may collect from you and how that information may be used. Please take your time to read this Privacy Notice carefully.
In this Privacy Notice we use “we” or “ours” or “our” to refer to Professor Phillips and his team who are using your personal information.
In the event that you have any queries, comments or concerns in respect of the manner in which we have used, or potentially will use, your personal information then you should contact us directly via Jo Spreadborough at The Hampshire Clinic, Old Basing, Hampshire, RG24 7AL.
Your personal data
In respect of your personal information, we as a Data Controller hold information about you. This will mainly relate to your medical treatment, but will be likely to also include other information such as financial data in relation to billing. We must comply with the data protection legislation and relevant guidance when handling your personal information, and so must any medical secretary who assists in an administrative capacity. Your personal data may include any images taken in relation to your treatment which must not only be managed in accordance with the law, this Privacy Notice but also all applicable professional standards including guidance from the General Medical Council and British Medical Association.
We will provide your treatment from The Candover Clinic and Hampshire Clinic and, in due course, it may be necessary for The Candover Clinic, Hampshire Hospitals and the Hampshire Clinic to also process your personal data. We will do so in accordance with the law, the principles of this Privacy Notice and to the extent that it is necessary to do so. This could be where The Candover Clinic or Hampshire Clinic needs to arrange other healthcare services as part of your treatment, such as nursing or dietician advice, or support other aspects of the treatment which we provide to you. In that case, The Candover Clinic or Hampshire Clinic will become a joint Data Controller in respect of your personal information. You can obtain a copy of their Privacy Notice, which sets out how they will manage that information if you so wish.
Your personal information will be handled in accordance with the principles set out within this Privacy Notice. This means that whenever we use your personal data, we will only do so as set out in this Privacy Notice. From time to time, we may process your personal information at an other site (medical or non-medical), as may by medical secretary.
What personal information do we collect and use from patients?
We will use “special categories of personal information” (previously known as “sensitive personal data”) about you, such as information relating to your physical and mental health.
If you provide personal information to us about other individuals (including medical or financial information) you should inform the individual about the contents of this Privacy Notice. We will also process such information in accordance with this Privacy Notice.
In addition, you should note that in the event you amend data which we already hold about you (for instance by amending a pre-populated form) then we will update our systems to reflect the amendments. Our systems will continue to store historical data.
As one of our patients, the personal information we hold about you may include the following:
Contact details, such as postal address, email address and telephone number (including mobile number)
Financial information, such as credit card details used to pay us and insurance policy details
Emergency contact details, including next of kin
Background referral details
Special Categories Personal Information
As one of our patients, we will hold information relating to your medical treatment which is known as a special category of personal data under the law, meaning that it must be handled even more sensitively. This may include the following:
Details of your current or former physical or mental health, including information about any healthcare you have received from other healthcare providers such as GPs, dentists or hospitals (private and/or NHS), which may include details of clinic and hospital visits, as well as medicines administered. We will provide further details below on the manner in which we handle such information.
Details of services you have received
Details of your nationality, race and/or ethnicity
Details of your religion
Details of any genetic data or biometric data relating to you
Data concerning your sex life and/or sexual orientation
The confidentiality of your medical information is important to is, and we make every effort to prevent unauthorised access to and use of information relating to your current or former physical and mental health (or indeed any of your personal information more generally). In doing so, we will comply with UK data protection law, including the Data Protection Act 2018 and all applicable medical confidentiality guidelines issued by professional bodies including, but not limited to, the General Medical Council and the Nursing and Midwifery Council.
From 25 May 2018, the current Data Protection Act will be replaced by the EU General Data Protection Regulation (GDPR) and a new Data Protection Act. All uses of your information will comply with the GDPR and the new Data Protection Act from that date onwards
How do we collect your information?
We may collect personal information from a number of different sources including, but not limited to:
Other hospitals, both NHS and private
Mental health providers
Commissioners of healthcare services
Other clinicians (including their medical secretaries)
Directly from you
Information may be collected directly from you when:
You enter into a contract with Professor Phillips, members of his team, The Candover Clinic or Hampshire Clinic for the provision of healthcare services
You use those services
You complete enquiry forms on the Candover Clinic or BMI Hampshire Clinic websites
You submit a query to us including by email or by social media
You correspond with us by letter, email, telephone or social media.
From other healthcare organisations
Professor Phillips’ patients will usually receive healthcare from other organisations, and so in order to provide you with the best treatment possible we may have to collect personal information about you from them. These may include:
Medical records from your GP
Medical records from other clinicians (including their medical secretaries)
Medical records from your dentist
Medical records from the NHS or any private healthcare organisation
Medical records include information about your diagnosis, clinic and hospital visits and medicines administered.
From third parties
As detailed in the previous section, it is often necessary to seek information from other healthcare organisations. We may also collect information about you from third parties when:
You are referred to Professor Phillips for the provision of services including healthcare services
We liaise with your current or former employer, health professional or other treatment or benefit provider
We liaise with your family
We liaise with your insurance policy provider
We deal with experts (including medical experts) and other service providers about services you have received or are receiving from us
We deal with NHS health service bodies about services you have received or are receiving from us
We liaise with credit reference agencies
We liaise with debt collection agencies
We liaise with Government agencies, including the Ministry of Defence, the Home Office and HMRC
How will Professor Phillips and his team communicate with you?
We may communicate with you in a range of ways, including by telephone, email, and / or post. If we contact you using the telephone number(s) which you have provided (landline and/or mobile), and you are not available which results in the call being directed to a voicemail and/or answering service, we may leave a voice message on your voicemail and/or answering service as appropriate, and including only sufficient basic details to enable you to identify who the call is from, very limited detail as to the reason for the call and how to call us back.
to ensure that we provide you with timely updates and reminders in relation to your healthcare (including basic administration information and appointment information (including reminders)), we may communicate with you by telephone and/or unencrypted email (where you have provided us with your telephone or email address.
to provide you with your medical information (including test results and other clinical updates) and/or invoicing information, we may communicate with you by email (which will be encrypted) where you have provided us with your email address and have expressed a preference in the patient registration form to be contacted by email. The first time we send you any important encrypted email that we are not also sending by post or which requires action to be taken, we will endeavour to contact you separately to ensure that you are able to access the encrypted email you are sent.
Please note that although providing your mobile number and email address and stating a preference to be communicated by a particular method will be taken as an affirmative confirmation that you are happy for us to contact you in that manner, we are not relying on your consent to process your personal data in order to correspond with you about your treatment. As set out further below, processing your personal data for those purposes is justified on the basis that it is necessary to provide you with healthcare service.
What are the purposes for which your information is used?
We may ‘process’ your information for a number of different purposes, which is essentially the language used by the law to mean using your data