GDPR Privacy Policy (Mini Version) - FAQs

You can find my full list of Policies and Procedures on our website in the document here.

 

 

 

We can also provide you with a hard copy of these upon request.

​

What is the General Data Protection Regulations, 2018 (GDPR) and how does it affect me?

The GDPR replaces the 1998 Data Protection Act to ensure your personal and sensitive, confidential data is kept private and held securely, being processed in the way that you have agreed to. It is there to protect your rights as a consumer of a service or product thatmight involve your identifiable data, e.g. your name and address or whether you have a specific condition. It also covers any session records, text messages or emails we exchange. For more information your can read the policy documents available at the Clinic.

​

How long will you hold my information for?

I am regulated by the GMC, and operate by the NHS guidelines so that I will hold your treatment records up to 8 years after your final session. Unless you are a child, in which case I must hold your data until your 25th birthday, unless you are 17 when treatment ends and then I must keep it until your 26th birthday. Therefore, all records will be deleted in the January after the above retention scales. This is in line with NHS regulations for holding data.

 

What if I don’t want my records to be held for that long?

Under the GDPR you can make a request in writing to me, for all your records to be deleted. In this case all your paper records would be shredded with a cross shredding machine and any electronic data such as emails or text messages would be permanently deleted from the devices they are stored on. I would have to save the request for deletion you made but would not save any other data. In some circumstances my insurance companies legal team may want to verify information I process.

​

Why do you need to record this information?

I collect information about; why you are using the service, medical information relevant to your treatment and your contact details so I can update you about your appointments. This information enables me to provide a high quality service to you, ensuring I am equipped with the knowledge of our previous discussions and treatment you had prior to each session. Your contact details / address and Doctors details will only be used with your explicit consent. 

I also have some third party services that collects information that cannot identify you, when you visit my website. This lets me know how many visitors visit my website, what country they are from, and how long they spend visiting my website.

I use a secure booking system with Wix which collects you contact details for the sole purpose of being able to offer you the best in your appointment e.g. appointment reminders, to know about you concerns before treatment and to be able to order in prescribed aesthetic medications in advance for you (in the case of aesthetic treatments. Neither myself or Wix use this data to market services to you.

​

What lengths are made to ensure my information is held securely?

Hardcopy documents – Are all stored in a locked cabinet with the keys kept in a secure location.

Text messages – My work phone is secured with a pin code.

Emails – My email account requires a user name and password.

Email attachments – Any attachments sent by email to you containing your personal information would be password protected and the password would be sent to you via text message.

Electronic documents – Any electronic documents e.g. A letter to your GP, or an invoice, are password protected and stored on a password protected computer if they contain personal or sensitive information.

Treatment photographs - Kept on a secure password encrypted Ipad which is for the sole use of The Whitfield Clinic. This photographs are required for medico-legal documentation and have a separate consent form.

​

Is what we discuss kept confidential?

Everything we talk about during our sessions are strictly confidential between you and me. To ensure I am doing my job effectively and that I have doing the right treatment for you, I may discuss elements your treatment with my other medical professionals anomalously (I will never release any personal or identifiable data during these discussions). These medical professionals also adhere to the GDPR.

​

What if I see you outside of the session?

If we see each other outside of the appointment I may smile but will not engage in any further conversation to ensure your confidentiality unless initiated by you. You are welcome to share with other people about the treatment you are receiving, but I am obligated by GDPR law to ensure your confidentiality is protected.

​

What about other Health and Social Care Professionals?

As I adhere to the GDPR any contact, relating to you, with other health care professionals would only be made with your signed consent. E.g. If I were to write to your GP to notify them of a treatment complication or a urgent concern about your health, I would only do this if you were to sign the specific consent for this at the end of this document.

Exceptions:

In order to safeguard you and the people around you, if you were to disclose that you were going to carry out harm to yourself or someone else, then under my “Duty of Care” I am obligated by law to inform the relevant authorities. This is to support you to live well, and I would always aim to discuss this with you prior to contacting anyone.

If I was issued with a police warrant or court order for your information, by law I would also have to provide them with your information.