·        If your club/employer is entering into a contract with us, for the legitimate purpose of providing healthcare services to you, as agreed with your club/employer

·        To keep accounts and records.

Look in Part 2.

It tells you how to withdraw any consent you’ve given (see section j as well) and how to object to both direct marketing and to our use where it’s based on a balancing test (called “legitimate interests”) which involves weighing our interests or a third party’s interests against your rights.

Other information

Look in Part 3; here’s what’s in the different sections.

·        Section a: our contact details

·        Section c: the purposes and legal basis for our use of your personal information

·        Section d: the legitimate interests often underpinning our use of your personal information

·        Section e: the types of personal information we may get from someone other than you

·        Section f: third parties with whom we may share your personal information

·        Section g: transfers (exports) of personal information

·        Section h: storage periods

·        Section i: your GDPR rights

·        Section j: withdrawing consent

·        Section k: complaints to the ICO

·        Section l: information you must provide (either by law or under a contract)

·        Section m: sources of personal information (where you aren’t the source).

·        Section n: automated decisions

·        To keep accounts and records.

·        To keep accounts and records.

·        Please note that we use Vimeo to embed videos onto our site.

·        Section a: our contact details

·        Section i: your GDPR rights

·        Section k: complaints to the ICO

We ask for explicit consent to:

·        Disclose your diagnostic testing results to your referring clinician.

·        Disclose your cardiac screening results to your GP and/or, if you are under 18, to your parent.

·        Disclose your cardiac testing results to your club/employer.

To withdraw your consent, please contact us.

We will rely on your browser settings to indicate your consent to the use of cookies on our website. To withdraw your consent, please adjust your browser settings. Please see “Cookies and similar technologies” below for instructions.

Please see:

·        section a in “Key information required by the GDPR”  below for our contact details

·        section c in “Key information required by the GDPR” below for further details of where we rely on your consent

·        section j in “Key information required by the GDPR” below for further details of your right to withdraw consent, and

·        “Cookies and similar technologies” below for information about cookies and similar technologies used on this site.

we consider that our use of your personal information for:

·        Business operation and improvement

·        Patient relationship management

·        Employee relationship management

·        Supplier relationship management

·        Network and information security

·        Reporting possible criminal acts/threats to competent authorities

is in our legitimate interests.

You may object to our use on that basis. To exercise your right, please contact us.

Please see:

·        section a in “Key information required by the GDPR” below for our contact details

·        section d in “Key information required by the GDPR” below for further details of our reliance on the legitimate interests basis for processing, and

·        section i in “Key information required by the GDPR” below for further details of your right to object.

Identity and contact details and, where applicable, of the representative

Registered office: 28 Mulgrave Terrace, Gateshead, Tyne and Wear, NE8 1PQ

Main clinics: The Osborne Clinic, 22 Osborne Avenue, Jesmond, Newcastle upon Tyne, NE2 1JQ

Telephone: 0191 646 1066

Fax: 0191 247 5885

Email: info@heartscan.co.uk

We are registered as a controller with the Information Commissioner. Our registration number is ZA071423.

Contact details of the data protection officer, where applicable

The purposes of the use for which the personal information is intended as well as the legal basis for the use

Here’s a key to the second column:

Consent: your consent to one or more specific purposes

Contract: entering into a contract with you or performing a contract with you

Legal obligation: we’re required by law to do this

Vital interests: to protect your own or another individual’s vital interests (e.g. life or death situation)

Legitimate interests: we’ve identified this as a legitimate interest of ours or a third party; we consider that use of your personal information is necessary to achieve that legitimate interest; and we’ve balanced all that against your interests, rights and freedoms

The third column gets a bit more technical. Where we’re dealing with sensitive personal information we need not one legal basis but two, from a different list (and the list is a lot longer).

The main ones are:

Explicit consent: your explicit consent to one or more specific purposes

Health or social care: provision of healthcare or management of healthcare systems

Legal claims: to establish, exercise or defend a legal claim

Vital interests: that’s the same as column 2 except it has to be where the individual is incapable (physically or legally) of giving consent.

Archiving, research and statistics: this must be in the public interest; data must be minimised, and anonymised or at least pseudonymised; the activity mustn’t cause substantial distress or damage to individuals and  mustn’t relate to a particular individual except for approved research

You can find more details on the ICO website at https://ico.org.uk

·        Contract

·        Vital interests

·        Legitimate interests

·        Vital interests

·        Legal claims

·        Health or social care

·        Legal obligation

·        Vital interests

·        Legitimate interests

·        Vital interests

·        Legal claims

·        Health or social care

·        Archiving, research and statistics

Where the use of information is based on the legitimate interests condition, the legitimate interests pursued

Our legitimate interests are:

·        Business operation and improvement – operating and improving our business

·        Patient relationship management – looking after our patients

·        Employee relationship management – managing and training our employees

·        Supplier relationship management – managing our suppliers

·        Network and information security – securing our systems

·        Reporting possible criminal acts/threats to competent authorities – if and when the need arises.

The categories of personal information collected indirectly

·        Your health data, from your referring clinician if you are a patient referred for diagnostic testing and consultation services.

·        Your name, age, medical history and details of previous medical test results, from your club/employer, where we’re providing services to a club.

·        Your policy number, authorisation numbers for proceeding with tests/care and invoice payment notification and any notification of shortfall due to policy restrictions, from your insurer, if your insurer is paying for your treatment.

·        Your reference, from your referee, if you are a prospective employee.

The recipients or categories of recipients of the personal information, if any

·        Your insurer, if they are paying for your treatment (we will not share any test results, just your personal details, insurance policy details and a list of tests/consultations performed with dates).

·        Your referring clinician, if you explicitly consent to them receiving your diagnostic test results.

·        Your GP or (if you are under 18) your parent, if you explicitly consent to them receiving your cardiac screening results.

·        Your club/employer or (if you are under 18) your parent, if you explicitly consent to them receiving your cardiac testing results.

·        A third party postal service (just your name and address, for delivery).

·        Legal advisers (for legal advice and claims).

·        Another business, in connection with any merger or acquisition with them.

We will not otherwise disclose your personal information to a third party unless required or permitted to do so by law.

Where applicable, the fact that personal information is to be transferred to a third country or international organisation and the existence or absence of an adequacy decision by the European Commission, or in the case of transfers subject to appropriate safeguards or non-repetitive, limited transfers based on compelling legitimate interests, reference to the appropriate or suitable safeguards and the means by which to obtain a copy of them or where they have been made available.

We do not transfer any personal information to third countries or international organisations. All personal information is stored in the UK and/or in the European Economic Area.

The period for which the personal information will be stored, or if that is not possible, the criteria used to determine that period

·        For patients who were under the age of 17 at the date on which the last treatment was concluded, until that patient’s 25th birthday

·        For patients who were aged 17 at the date on which the last treatment was provided, until that patient’s 26th birthday

·        For patients who died before the age of 18, for a period of 8 years beginning from the date of the patient’s death

·        All other cases, a period of 8 years beginning on the date of the last entry in the patient records.

At that point, the record will be reviewed and destroyed if no longer needed.

We store employee data and supplier data for up to 7 years after the end of the employee/supplier relationship, to protect our business against legal claims. At that point, the data will be reviewed and destroyed if no longer needed.

The existence of the right to request access to and rectification or erasure of personal information or restriction of use concerning the individual or to object to use as well as the right to data portability

·        for access to your personal information

·        for rectification or erasure of your personal information

·        for restriction of processing concerning you

·        to object to our processing which is based on legitimate interests

·        to object to direct marketing (we don’t currently carry out direct marketing)

·        to object to archiving in the public interest, research and statistics

·        to port (transfer) personal information you have provided to us, either to you or to another provider.

These rights are more complicated than the simple summary above. To find out more about them, please visit the Information Commissioner’s website. To exercise your rights, please contact us. Our contact details are in the “Identity and contact details” section a above. Please make it clear which right(s) you want to exercise, for example by putting the name of the right in the subject line of the email. Thank you.

You may also exercise your rights by completing the website contact form and selecting the “data protection rights” option. We will then get in touch.

Where the use is based on consent (for ordinary or sensitive personal information), the existence of the right to withdraw consent at any time, without affecting the lawfulness of use based on consent before its withdrawal

This will not affect the legality of our consent-based use before you withdrew consent.

To withdraw consent to cookies, please adjust your browser settings (please see our cookie policy for further details).

To exercise your right to withdraw in any other case, please contact us. Our contact details are in the “Identity and contact details” section a above. You may also withdraw consent by completing the website contact form and selecting the “data protection rights” option. We will then get in touch.

The right to lodge a complaint with a supervisory authority

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
England

Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate).

Website: https://ico.org.uk  which sets out email addresses and an email form.

Whether the provision of personal information is a statutory or contractual requirement, or a requirement necessary to enter into a contract, as well as whether the individual is obliged to provide the personal information and of the possible consequences of failure to provide that information

For private patients, it is a contract requirement that you complete the registration forms and (for screening) any healthcare questionnaires, fully and accurately.

If you are a supplier or prospective employee or website visitor who makes an enquiry, we’ll normally need your personal details (name and contact details) to receive goods and services, process your application or answer your query. For suppliers and prospective employees, we may also need your financial details (e.g. bank details and VAT number where applicable) so we can pay you.

The source of the personal information and if applicable, whether it came from publicly accessible sources

The existence of automated decision-making, including profiling. This means a decision based solely on automated profiling which produces legal effects concerning the individual, and which must not be based on special categories of (i.e. sensitive) personal information without explicit consent or substantial public interest, with safeguards. Meaningful information about the logic involved, as well as the significance and the envisaged consequences of the processing for the individual must also be provided.

These cookies are used by Vimeo to track information about how the Vimeo service is being used, so Vimeo can make improvements and report on performance.

Click here for an overview of Privacy at Google

See also:

https://vimeo.com/cookie_policy

and

https://vimeo.com/cookie_list

See:

https://vimeo.com/cookie_policy

and

https://vimeo.com/cookie_list