Data Protection
Recording your details and how your information is used: updated September 2020 for Covid-19
Recording your details and how your information is used
To support NHS Test and Trace (part of the Department for Health and Social Care) in England, I have been mandated by law to collect and keep a limited record of patients and visitors who come onto the premises, for the purpose of contact tracing. By doing this, and by sharing these records with NHS Test and Trace where requested, I can help to identify people who may have been exposed to the coronavirus.
As a patient/visitor of Caroline Challender Wellbeing you will be asked to provide the following basic information:
•
your name
•
contact phone number
•
date of visit, and your arrival and departure times
As the data controller for the collection of your personal data, I will be responsible for compliance with data protection legislation for as long as I hold your information. When that information is requested by the NHS Test and Trace service, at that point they would be responsible for compliance with data protection legislation for that period of time.
The NHS Test and Trace service, as part of safeguarding your personal data, has in place technical, organisational and administrative security measures to protect your personal information that it receives from us/me, that it holds from loss, misuse, and unauthorised access, disclosure, alteration and destruction.
In addition, if you only interact with me during your visit, my name will be recorded alongside your information.
NHS Test and Trace have asked me to retain this information for 21 days from the date of your visit, to enable contact tracing to be carried out by NHS Test and Trace during that period. I will only share information with NHS Test and Trace if it is specifically requested by them.
For example, if another patient at the clinic reported symptoms and subsequently tested positive, NHS Test and Trace can request the log of patient/visitor details for a particular time period (for example, over a particular treatment slot, day, two-day period).
I will require you to prebook appointments for visits or to complete a form on arrival.
Under government guidance, the information I collect may include information which I would not ordinarily collect from you and which I therefore collect only for the purpose of contact tracing. Information of this type will not be used for other purposes, and NHS Test and Trace will not disclose this information to any third party unless required to do so by law (for example, as a result of receiving a court order). In addition, where the information is only collected for the purpose of contact tracing, it will be destroyed by me 21 days after the date of your visit.
However, the government guidance may also cover information that I would usually collect and hold onto as part of ordinary dealings with you (for example, your name, date of birth and phone number). Where this is the case, this information only will continue to be held after 21 days and I will use it as I usually would, unless and until you tell me not to.
Your information will always be stored and used in compliance with the relevant data protection legislation.
The use of your information is covered by the General Data Protection Regulations Article 6 (1) (c) – a legal obligation which this clinic is subject to. The legal obligation to which I am subject, means that I am mandated by law, by a set of new regulations from the government, to co-operate with the NHS Test and Trace service, in order to help maintain a safe operating environment and to help fight any local outbreak of coronavirus.
By law, you have a number of rights as a data subject, such as the right to be informed, the right to access information held about you and the right to rectification of any inaccurate data that I hold about you.
You have the right to request that I erase personal data about you that I hold (although this is not an absolute right).
You have the right to request that I restrict processing of personal data about you that I hold in certain circumstances.
You have the right to object to processing of personal data about you on grounds relating to your particular situation (also again this right is not absolute).
If you are unhappy or wish to complain about how your information is used, you should contact me in the first instance to resolve your issue.
If you are still not satisfied, you can complain to the Information Commissioner’s Office. Their website address is www.ico.org.uk.
