top of page

Privacy Policy

What is the purpose of this Privacy Policy?

We need to collect and process Personal Data that relates to our patients in connection with their consultation and treatment plan. This Policy is to explain how we use and safeguard that Personal Data.

 

Definitions

The definitions below are enshrined in EU law so are not always written in plain English! We have included examples to try to make things clearer.

 

Who we are

Wholistic Medical Centre is run by Dr Shamim Daya, a GP with a holistic approach to general practice, and her unique team of health practitioners.

​

Our main focus is on primary preventative care for men, women and children (over the age of 5), integrating medical and holistic perspectives with an emphasis on early detection and early intervention.

 

The Wholistic Medical Centre was founded in 1997 by Dr Shamim Daya and combines the best of conventional medical testing with modern less-conventional techniques. A process which offers a greater scope of information for each patient: hence a more efficient and effective treatment plan.

 

When you use our services, you’ll share some information with us. We want to be upfront about the information we collect, how we use it, who we share it with and the choices we give you to control, access and update your information.

 

For the purposes of data protection legislation, we are the data controller of your personal data.

 

We have appointed a data privacy manager who is responsible for overseeing questions in relation to this Privacy Policy. Please see appendix 3 for more information.

 

How is Personal Data collected?

Typically a patient will have provided Personal Data or we have recorded Personal Data about the patient at the point of first registering for a consultation at Wholistic Medical Centre.  This will initially be collected via a patient questionnaire completed by you.  Additional data will be noted in your personal file during subsequent appointments at the clinic.

​

Occasionally we are passed Personal Data by a third party such as Medical Consultants that have referred you to us, or where you have requested them to pass on such information.

 

For what purposes is Personal Data used?

We will only use Personal Data when the law allows us to which can be summarised under the following headings:

 

(a) Consent: an individual has given clear consent for us to process their personal data for specific purposes outlined in appendix 1.

 

(b) Contract: the collection process is necessary for us to fulfil the contract between a patient and Wholistic Medical Centre when seeking medical healthcare treatment and advice.

 

(c) Legal obligation: the collection and processing of a patient’s medical history is necessary for us to comply with the law. We are required to hold medical data securely for 10 years.

 

(f) Legitimate interests: the processing of our patient’s personal data is necessary in order for us to fulfil the contract between patient and practitioner for our legitimate interests or the legitimate interests of a third party.

 

The personal information we collect and use

"Personal Data" means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.

​

In plain English this can be summarised as information that we hold about an individual patient from which they can be identified.

It may include but may not be limited to the following:

"Processing" means any operation or set of operations which is performed on Personal Data or on sets of Personal Data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction such as collection, recording, organization, storage, adaptation or alternation, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, blocking, erasure or destruction.

​

“Sensitive Personal Data” means personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

 

 

Details of the Personal Data that we are most likely to process are set out in Appendix One

 

What safeguards are in place?

We will comply with the eight data protection principles in the Data Protection Act which states that Personal Data must be:

​

  • processed fairly and lawfully ;

​

  • obtained only for one or more specified and lawful purposes and not be further processed in any manner incompatible with that purpose or those purposes;
     

  • be adequate, relevant and not excessive in relation to the purpose or purposes for which they are processed;
     

  • be accurate and, where necessary, kept up to date;
     

  • shall not be kept for longer than is necessary for lawful purposes;
     

  • shall be processed in accordance with the rights of data subjects under the Data Protection Act;
     

  • protected by having appropriate technical and organisational measures in place to safeguard against unauthorised or unlawful processing of personal data and against accidental loss or destruction of, or damage to, the Personal Data;
     

  • Personal data shall not be transferred to a country or territory outside the European Economic Area unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

 

Details of the key safeguarding measures that we adopt are set out in Appendix Two

 

 

What rights and obligations do Patients have?

​

Duty to inform us of changes

It is important that Personal Data is kept accurate and up to date. Patients should please advise us if their personal information changes whilst they are under our care.

​

Rights in connection with Personal Data

Under certain circumstances, individuals have the right to:

  • Request a copy of their Personal Data (commonly known as a "data subject access request"). This enables them to receive a copy of the personal information we hold about them and to check that we are lawfully processing it.

  • Request correction of the Personal Data that we hold about them.

  • Request the erasure of Personal Data. An individual may ask us to delete or remove Personal Data where there is no good reason for us continuing to process it. An individual may also request that we stop processing Personal Data where we are relying on a legitimate interest and there is something about their particular situation which permits an object to processing on this ground.

  • Request the restriction of processing of Personal Data for example until its accuracy or the reason for processing it is more clearly established.

  • Request the transfer of Personal Data to another party.

​

Individuals who wish to review, verify, correct or request erasure of Personal Data, object to the processing of Personal Data, or request that we transfer a copy of Personal Data to another party, please contact our nominated Data Controller.

​

What we may need to comply with a Data Subject Access Request

We may need to request specific information to help us confirm a lawful right to access the information (or to exercise any other rights). This is another appropriate security measure to ensure that Personal Data is not disclosed to any person who has no right to access it.

 

Charges

No fee is usually required to access Personal Data (or to exercise any of the other rights). However, we may charge a reasonable fee if the request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

 

Right to withdraw consent

In certain circumstances consent may be required to the processing of Personal Data. Where a patient provides such consent to the processing of Personal Data for a specific purpose, that patient has the right to withdraw consent for that specific processing at any time. To withdraw consent, please contact the nominated Data Controller. Once notification is received that consent has been withdrawn, we will no longer process Personal Data for the said specific purpose, unless we have another lawful basis to do so.

 

Our Data Protection Officer

We will have in place a Data Protection Officer at all times so far as is possible. At the date of issue of this Privacy Notice we have appointed the person named in Appendix 3 as our Data Protection Officer. The Data Protection Officer will oversee compliance with this Privacy Notice. For any questions about this Privacy Notice or how we handle Personal Data, please contact the Data Protection Officer using the contact details included in Appendix 3. ]

 

Making a complaint

Individuals have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection matters.

​

Amending this Privacy Policy

We may update this Privacy Notice from time to time and we will issue a new privacy notice when we make any material changes including when we the identity of the Data Protection Officer changes.

 

Issued 15th May2018.

 

Appendix One – Data Processing

The situations in which we are most likely to process Personal Data are in connection with the following processes set out below:

 

  • Personal contact information – for billing, invoicing, and posting supplements, or to send encrypted consultation summaries or test results.

  • Date of Birth to prevent fraud and ensure correct identity

  • Gender to ensure that we provide you with the appropriate patient history questionnaire and advice.

  • Personal email address to communicate with patients regarding their appointments, to send medical reports or test results or provide newsletter updates where consent has been given.

  • Medical History – necessary for practitioners to accurately assess and provide an appropriate treatment plan.

  • Test results from other agencies – to provide information relevant to treatment plan.

  • Bank account information in some cases where requested by patients - for processing payments through secure payment system.

  • Credit card information – this is provided at time of payment and not stored on WMC systems other than via Secure Trading

​

We believe that we have a legitimate interest in processing the above Personal Data in the context of the overall relationship with a patient. Some of the above grounds for processing may overlap and there may be several grounds which justify our use of Personal Data.

 

 

Appendix Two – Our safeguarding measures

Please note that we do not transfer any Personal Data to countries or territories that do not have adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data.

​

We do not use any Personal Data for automated decision making or other form of profiling.

​

We aim to keep Personal Data accurate and up to date. Data that is out of date or inaccurate will be amended when we are made aware of that. Patients should notify us if they become aware of any inaccuracies in their Personal Data held by us.

 

We will not keep Personal Data for longer than is permitted. This means that data will be destroyed or erased from our systems when it is no longer lawfully required. For regulatory purposes we are required to keep patient records for a 10 year period after which it is securely destroyed. Prior to this period non-current patient records are stored using a secure archiving company. 

​

We have in place procedures and solutions to maintain the security of all personal data from the point of collection to the point of destruction and have taken appropriate measures against unlawful or unauthorised processing of personal data, and against the accidental loss of, or damage to, personal data.

 

  • Maintaining data security means guaranteeing the confidentiality, integrity and availability (for authorised purposes) of the personal data. For example, we take the following steps to protect data:

  • Staff are trained in relation to the importance of privacy and data security.

  • We keep our patient records in a secure key coded locked room.

  • Medical Records in a safe and locked area within the clinic.

  • Medical Records are stored in a regulated Archiving space if a patient has not been seen within 12 months and by law we are required to keep these records for 10 years after which time they are destroyed by the regulated archiving company.

  • Test results are sent by encrypted email that is password protected

  • Personal details are stored on security protected cloud systems

  • Credit card details (when provided) are stored on security protected cloud payment systems.

  • Invoices will only be emailed to you when requested.

  • Laptops and Computers are protected by password or encryption.

  • Electronic files can only be accessed via password logins

​

We will only pass Personal Data to third parties where we are lawfully obliged to do so. For example, a patient may ask us to provide their details to another medical practitioner.

​

We will not disclose Personal Data to a third party without consent unless we are satisfied that they are legally entitled to the data. Where we do disclose Personal Data to a third party without consent, we will only do so where that third party has confirmed that it has in place adequate measures to protect Personal Data.

 

Appendix Three – Our nominated Data Protection Officer:

 

Dr Shamim Daya

Wholistic Medical Centre

8 Upper Wimpole Street

London W1G 6LH

 

Tel: 020 7486 2196

Email: drdaya@wholisticmedical.co.uk

​

bottom of page