PRIVACY POLICY

This privacy policy covers Solihull Well Being Clinic and explains how we use personal data we collect from you when you use our website and/or make an enquiry regarding services on offer. Please be assured we only collect the personal data we need in order to provide and oversee our service to you, and do not use it for marketing purposes without your prior consent.

Topics Covered:

What data do we collect?
How do we collect your data?
How will we use your data?
How do we store your data and keep it protected?
How long are records kept?
Use of data for marketing purposes
What are your data protection rights?
How is data collected through cookies
Privacy policies of therapists/practitioners affiliated with us
How to contact us to update or request your data to be removed
How to contact us to request access to personal data or clinical records we hold
How to contact relevant authorities if you have concerns

What data do we collect?

Solihull Well Being Clinic collects the following data:

Personal identification information (name, email address, phone number) which i) is sometimes supplied in your initial email to the service; ii) may be obtained by way of a contact/enquiry form you choose to fill out when making an initial enquiry; and iii) may be invited from you when we respond to your initial enquiry.
If you are a minor (under the age of 18yrs) or for some reason lack decision making capacity (e.g. due to a learning disability), we will also collect data for your parent or legal guardian (name, email address, phone number etc.).

Data collected by your therapist or practitioner:

If you choose to book assessment or treatment sessions with us, we will also ask for your postal address, date of birth and the contact details for your GP. These are necessary aspects of the clinical record we hold for you. (We may additionally ask for details of your next of kin).
Your therapist may ask questions about your history and personal context (e.g. education, health, family background, employment etc.), which would be part of the clinical record he/she holds for you.

2. How do we collect your data?

Data is collected in a number of ways;

from you personally, when you contact the service (or in the case of a minor, when a parent or legal guardian contacts us) either by telephone or email
if you fill out a contact form or chat request on the service’s website or social media pages
if your contact details are passed to us by a third party who is referring you for services (e.g. a health insurance company, GP, private consultant/ therapist, employee assistance programme, legal representative etc).
if you attend group sessions, workshops or open days run by Solihull Well Being Clinic, and choose to volunteer your contact information
if you use or view our website and your web browser allows use of cookies.

3. How will we use your data?

We never share your data with third parties and will never sell your data to others. Our service collects your data so that we can;

Process a referral request (e.g. so that we ensure we contact you as requested and discuss your needs)
Keep in contact with you regarding any service provision we may offer (e.g. appointments, waiting lists etc.)
Update your GP, referrer or health insurance provider regards progress or additional needs, where relevant and appropriate.
Share your data with a named therapist or practitioner when they have been identified as the person best placed to assist you, and where you have given consent for the data to be shared
Email you or send a newsletter with information we feel may benefit you (but only if you have opted into this process, and with the option to unsubscribe).
Pursue unpaid invoices, using a debt collection agent in the unlikely event that services rendered have not been paid for.

4. How do we store your data and keep it protected?

Centrally held data is stored in a spreadsheet document. Therapists/practitioners may also hold data in their respective client folders. Where there are physical files, these must always be kept in a secure filing cabinet. Some therapists/practitioners lock away files at Solihull Well Being Clinic premises, where security measures are in place (e.g. lockable filing cabinet, building intrusion alarm, controlled access to the building when open and CCTV).

Where data is kept electronically by Solihull Well Being Clinic, it is held within subscribed cloud services which afford encryption of data both in transit and at rest. The cloud services used are consistent with industry-specific security, privacy, and compliance requirements, being HITRUST-CSF-certified, and meeting both HIPAA (Health Insurance Portability and Accountability Act of 1996) and ISO/IEC 27000-series standards, among many others, designed to protect from intrusion, theft, and cyber attack.

All computers used to access documents stored in the cloud have up to date malware and antivirus protection. Solihull Well Being Clinic emails afford encryption of data emails in transit, using TLS (Transport Layer Security). Unfortunately, this does not necessarily keep email encrypted after it arrives at its destination server. Any client who is not satisfied with these security arrangements, would need to request communication by phone or postal mail, which Solihull Well Being Clinic can arrange.

5. How long are records kept?

The Data Protection Act 1998, The Access to Health Records Act 1990 and The Medical Reports Act 1998 outline the need for Hospital records to be retained for a minimum of eight years, whilst GP records are retained for a minimum of 10 years. Solihull Well Being Clinic keeps all clinically relevant client records for an 8yr period, after which they are destroyed using confidential waste services. The only exception is for minors, whose data needs to be kept for a minimum of 3years after the date they turn 18 years of age, at which point it is destroyed using confidential waste services. This arrangement allows us to comply with Professional Body Guidance, UK Tax Law and Indemnity Insurance Policies.

Personal contact details may be retained with Solihull Well Being Clinic, as per the arrangements described in this privacy document, if you have opted to receive a newsletter or email updates of services, until such time that you unsubscribe from these arrangements.

6. Use of data for marketing purposes

As indicated, any information Solihull Well Being Clinic uses for marketing our services to you is taken with consent, and thereafter kept with us until you notify us that you no longer wish to receive this information. We never share your data for marketing purposes with other organisations.

7. What are your data protection rights?

Solihull Well Being Clinic manages all personal data in accordance with GDPR guidelines, which provide a range of rights for individuals. These rights include;

the right to be informed about the collection and use of your personal data (e.g. the purposes for processing personal data, retention periods for that personal data, and who it will be shared with. This is all termed ‘privacy information’)
the right to access privacy information that is concise, transparent, intelligible, easily accessible, and offered in a clear and plain language
the right to be informed as to the lawful basis and legitimate purposes of processing data
the right to withdraw consent for processing personal data (where applicable)
the right to be informed and to give consent to any proposed changes in use of personal data, before those changes are implemented
the right to be informed as to who you may contact at Solihull Well Being Clinic, in their role as Data Protection Officer
the right to lodge a complaint with a supervisory authority

8. How is data collected through cookies

Solihull Well Being Clinic’s website has been developed through a third party organisation. The website uses essential cookies. To explain, cookies are small pieces of data stored in the browser of the device (e.g. computer or smartphone) you use when accessing the Solihull Well Being Clinic website. It allows the website to recognise your device and store some information about your preferences or past actions (e.g. actions you may have taken on the site). The cookies uses do not identify you, as we do not ask you to register to use our website. They may however monitor and analyse the performance, operation and effectiveness of our website, whilst also checking it remains secure and safe to use. You can disable cookies on your device, following the guidance provided by your web browser/supplier.

Solihull Well Being Clinic’s website has been developed through a third party organisation. The website uses 'cookies', which are small pieces of data stored in the browser of the device (e.g. computer or smartphone) you use when accessing any website. It allows the website to recognise your device and store some information about your preferences or past actions (e.g. actions you may have taken on the site). Cookies may also be used to monitor and analyse the performance, operation and effectiveness of our website, whilst also checking it remains secure and safe to use. There is a choice to opt out of any analytical or marketing based cookies (this option appears when you arrive on our website home page). You can also disable cookies on your own device, following the guidance provided by your web browser/supplier. Rest assured any cookies we collect do not identify you, as we do not ask you to register to use our website.

9. Privacy policies of therapists/practitioners who use rooms with us

All therapists/practitioners affiliated with Solihull Well Being Clinic have been informed about this privacy policy, and encouraged to adhere to these standards of processing personal data. However, as these individuals are sole traders, they are responsible for their own privacy policy and management of clinical records. If you have questions about the use and processing or personal data and clinical records by your therapist/practitioner, it would be advisable for you to contact them, and make a specific request to see their policy documents. Solihull Well Being Clinic, by way of the privacy document, is responsible only for the personal data held centrally, as stipulated in earlier parts of this document.

Dr Bobby Sura and Menka Sura are Co-Directors at Solihull Well Being Clinic , and also hold a clinical caseload. The processing of personal data and clinical records held by Dr Bobby Sura and Menka Sura is in accordance with this privacy document. You will also be informed as to confidentiality of clinical records, by way of the therapeutic contract Dr Bobby Sura or Menka Sura asks you to sign, before assessment and intervention begins. Other therapists/practitioners affiliated with Solihull Well Being Clinic will have their own policy and responsibilities for managing the clinical records they hold.

10. How to contact us to update or request your data to be removed

Personal data that we hold is destroyed or erased from our systems as per section 5 of this privacy document. If you think that we are holding out-of-date or inaccurate personal data, please let us know.

If at any point you believe the personal information that we hold for you may be incorrect, or you would prefer we no longer hold this data, you can request to see the information we have in order to have it corrected or deleted. We cannot erase or destroy the clinical records we hold, and need to retain these as stipulated in section 5 of this document.

11. How to contact us to request access to personal data or clinical records we hold

You may request access to any personal data or clinical record held about you within our service, by raising a SARS request. We are obliged to give access to your records within 21 days and ask that you send us a formal, written request. (Please note that Solihull Well Being Clinic is only responsible for clinical records and personal data held by Dr Bobby Sura and Menka Sura, as per section 9 of this document)

Please make your request to the Data Protection Officer, Dr Bobby Sura, in writing to Solihull Well Being Clinic, 15 Highfield Road, Hall Green, Birmingham, B280EL

Any therapist/practitioner is at liberty to limit access to clinical records where the practitioner/therapist who has worked with you assesses the information could cause harm to your physical or mental health, or where information would be disclosed relating to a third person who has not consented. An individual with parental responsibility for a child has the right to view the child’s clinical records, although the therapist/practitioner who met with the child would need to take into account their confidentiality duty.

The Access to Health Records Act 1990 allows client’s personal representatives and any person who may have a claim arising out of the client’s death access to their record.

If you or a representative require access to clinical records for the purposes of a legal matter, the nominal charge of £20 is payable, and we can release any records held centrally at Solihull Well Being Clinic (including those managed by Dr Bobby Sura and Menka Sura) within 21 days of the request. If the request is for a summary report, this will be charged at the usual fee rate we charge, which we can share at the point of request. Please note that therapists/practitioners other than Dr Bobby Sura and Menka Sura will need to be approached directly, and they will be responsible for managing the access request or need for a report, as per their own policy in such matters. All access requests are managed as per the policy stipulated in section 11 of this document.

12, How to contact relevant authorities if you have concerns

If you wish to raise a complaint on how we have handled your personal data, you can contact us to have the matter investigated. If you are not satisfied with our response or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office https://ico.org.uk/ or by phone using the ICO helpline by calling 0303 123 1113