How we handle patient personal data at The London Clinic

3. How we lawfully process your data

We use data for a range of different purposes. These range from needing your consent to send you news and updates about us, through to meeting legal obligations placed on us under English Law as a healthcare provider where we must have certain pieces of information about those we care for. These include, but are not limited to:

• To admit you as a patient, assess and deliver your medical and care needs, and consult with your clinician: We may process your contact & demographic, and/or special category data to provide our contracted services and deliver healthcare to you.
• To protect your or another person’s vital interests: We may process your personal or special category data if you are in danger or your life is at risk.
• To handle your queries or investigate your complaint: Depending on the nature of your query or complaint, we may use your identity, contact, financial, transaction, payment, and/or special category data to respond or investigate. We may process this information under the following legal grounds: performance of a contract, legitimate interests, and/or provision of medical care.
• To obtain your feedback, conduct analysis or evaluate our services: We may use your contact, demographic and/or special category data. We may process such information under the following legal grounds: legitimate interests or (explicit) consent.
• To ensure ongoing care: We may share information relating to your medical condition or diagnosis with your referrer, the NHS, international medical service or other independent healthcare providers. This is for our legitimate interests and to ensure the ongoing provision of your care.
• To enable payment/treatment authorisation, manage your account and/or handle any insurance claims: We may share your basic identifiers, demographics and/or medical reports with your insurer and/or third-party sponsor. This is necessary for the performance of our obligations or your counter-obligations under our contract with you and for the management of our healthcare system and/or the establishment, exercise or defence of a legal claim.To process payment for your medical care. We may process your payment details and other financial information. That said, we will not store your payment card details but instead use specialised third-party payment processors;
• To process payment for your medical care: We may process your payment details and other financial information. That said, we will not store your payment card details but instead use specialised third-party payment processors.
• To manage & maintain our IT systems and administer & protect our business: We may process your identity, contact and technical data for troubleshooting, data analysis, testing, systems maintenance and reporting. This is necessary for our legitimate interests and, in some cases, to comply with our legal obligations.
• To conduct clinical research: We may use your identity, contact & demographic, and/or special category data with your (explicit) consent.
• To submit data to national health initiatives or registries: We may share your personal and/or special category data with national and other professional research or audit programmes and registries where we are legally required to, where it is necessary for reasons of public interest in the area of public health, for our legitimate interest in helping with medical research or with your (explicit) consent. Where personal data identifying you is not required, we will avoid using it as much as possible and may either anonymise the data or obfuscate your details.
• To assist in protecting the public against dishonesty, malpractice or other seriously improper behaviour for example, investigating complaints, clinical concerns, regulatory breaches or investigations: Where we are subject to regulatory bodies (such as the Care Quality Commission) we are under an obligation to share data with them in order progress and investigate the matter. Where personal data identifying you is not required, we will avoid using it as much as possible and may either anonymise the data or obfuscate your details.

If, after reading the pages relevant to how we are supporting you, you have any further queries then please contact our Data Protection Officer or your Consultant.

4. Where we get your data from

We very rarely obtain information about you without your prior knowledge. We will collect your personal data either from you directly, from your Consultant, or from a referring body.

There might be some instances where we receive data about you from other organisations or people. For example, if we receive a piece of information from your General Practitioner (‘GP’), embassy or insurance company, you should know about it prior to us receiving the data or we may confirm we have received it as part of your interaction with your care team.

5. Who we share your data with

Where possible we avoid sharing your data with anyone outside of The London Clinic. There will be, however, situations where this is just not possible, and a third party will need to access or be given a copy of your personal data. The typical examples of who we share data with includes:

Where personal data identifying you is not required, we will avoid using it as much as possible and may either anonymise the data or obfuscate your details.

National Data Opt-Out

The national data opt-out is an NHS Digital service which allows an NHS patient to opt out of their confidential patient information being used for research and planning. Further information on the National Data Opt-Out programme can be found here.

6. Where in the world your data is physically sitting

We use systems, technology and/or support vendors who may store or have access to physical or cloud storage which resides both in the UK and abroad. This includes countries both within the European Economic Area (‘EEA’) and, in limited circumstances, those further afield, for example the United States of America.

Where we store or share personal data with a third party in a country outside of the UK or EEA, we will put appropriate safeguards in place to protect that data in accordance with the applicable Data Protection Laws and the ICO’s guidance. These range from a contract with that third-party supplier through to technical measures to protect it while it gets there.

We may also need to share your data with a third party in a country outside of the UK if you are a resident of another country and that third party is authorising or providing part of your care.

7. How long we keep your data

We only keep your data as long as it is required either by English Law, health regulatory best practice, codes of practice, or our own legitimate business needs in line with our corporate policies.

The full range of retentions varies per record, some are only kept short-term, and some kept more long- term if they relate to legal matters or long-term medical conditions. Below are the considerations we use to determine the appropriate retention period:

• The purposes for which we process your personal data and whether we can achieve those purposes through other means;
• The applicable legal, regulatory, tax, accounting or other requirements;
• The amount, nature, and sensitivity of the personal data; and
• The potential risk of harm from unauthorised use or disclosure of your personal data.

8. How we protect your data

As you can appreciate, we cannot give you the full list of specific measures we have in place to prevent your data from being accidentally lost, used, accessed in an unauthorised way, altered or disclosed.

However, please rest assured that we are committed to ensuring a high level of protection for your data while it is in our management.

Examples of some of the measures we have in place include:

• Agreed organisation-wide standards on security and data handling;
• IT technical controls to limit access to your personal information only to those employees, agents, contractors and other third parties who have a business need-to-know;
• Physical security controls on our buildings and wards;
• Contractual controls with third parties (‘our house, our rules’);
• Training and awareness for all employees and Consultants;
• Key roles in our organisation with specialist knowledge on Information Governance, Data Protection and Cyber Security to ensure your information is always protected.

Access to your employment data is restricted and is monitored and approved by the HR Department on a need-to-know basis.

9. What your rights are in connection with your data

Where we use your information with your consent, you control how that data is used and shared by the Clinic. However, where we are using your data under a legal obligation or other grounds, your rights under Data Protection Laws are more restricted.  For example, where we feel we need to share or use data to save your life very few of the Data Protection rights apply.

A summary of all the Data Protection rights and how they apply to your interactions with us is below: