Data Protection Policy of Hands on Healing
Documented Created: 8th April 2018
Date of Next Review: 8th April 2019
This policy outlines my data protection policy, and thus how I comply with the GDPR.
1.The data that I process and how it flows into, through and out of my business.
Data comes into my business in 4 ways:
Via email messages to me from potential clients and clients that have my email address.
Via text messages (as above)
Via my website (Webhealer)
Via Facebook /Messenger (either Hands on Healing or Enid O'Leary)
It flows through my business via:
My laptop - which goes from work to home
My smart phone - everywhere I go
My paper file - occasionally from work to home if I am working on a case study for a course
The information does not flow out of my business.
2. The personal data I hold, where it came from, who I share it with and what I do with it.
Information Asset Register
I hold personal information about my clients that they have given me.
This includes name, address, contact details, and, where appropriate, age. I also hold health and wellbeing information about them which is offered by them at their first consultation.
I hold information about each treatment that they receive from me.
I don’t share this information with anyone.
I use this information to inform my clients and provide them with any appropriate advice within the realms of the treatment, my professional experience and qualifications.
I keep all data for:
claims occurring insurance: for which I am required to keep my records for 7 years after the last treatment
law regarding children’s records: for which I am required to keep my records until the child is 25, or if 17 when treated then until they are 26.
3.The lawful basis for me to process personal data and special categories of data.
I process the personal data under:
Legitimate interest: I am required to retain the information about my clients in order to provide them with the best possible treatment options and advice.
Special Category Data - Health Related: I process under special category data, therefore the additional condition under which I hold and use this information is for me to fulfill my role as a healthcare practitioner, bound under the NRRI and AoR Confidentiality as defined in their Codes of Practice and Ethics.
4. Processes to recognise and respond to individuals' requests to access their personal data.
All individuals will need to submit a written request to access their personal data - either by email or by letter. I will provide that information without delay and at least within one calendar month of receipt. I can extend this period by a further two months for complex or numerous requests (in which case the individual will be informed and given an explanation).
I will identify the client using reasonable means.
I will keep a record of any requests to access personal data.
5. Processes to ensure that the personal data I hold remains accurate and up to date.
I will ensure that client information is kept up to date during treatments, and will update client information as I am informed of any changes.
Once a year I will also have a wholesale review of all data.
6. Schedule to dispose of various categories of data, and its secure disposal.
Once a year I will review my client information and will place dormant clients in a separate file. This will be assessed each year to ensure that data that is no longer required to be kept under GDPR is destroyed securely.
7. Procedures to respond to an individual’s request to restrict the processing of their personal data.
As I only hold data in order to provide treatments, I cannot envisage a situation where I would receive a request to restrict their processing of an individual’s personal data. However, if I do receive a request I will respond as quickly as possible, and within one calendar month, explaining clearly what I currently do with their data and that I will continue to hold their data but will ensure that it is not processed.
8. Processes to allow individuals to move, copy or transfer their personal data from one IT environment to another in a safe and secure way, without hindrance to usability.
Should clients wish their data to be copied or transferred I would work with the client to ensure that this is done in a way that was most appropriate for them - for example this could be an electronic summary of treatment received and progress made, copies of individual treatment records. I do not hold any treatment information electronically.
9. Data Protection Policy
This document forms my data protection policy and shows how I comply with GDPR.
This is a live document and will be amended as and when any changes to my data processing takes place, at the very least it will be reviewed annually.
As the only member of staff, I believe that I have done an appropriate amount of research around the implications of the new GDPR, including taking heed of the advice and guidance provided by my professional membership organisations (AoR and NRRI for my work as a Reflexologist).
10. Effective and structured information risks management
The risks associated with my data, and how that risk is managed is as follows:
Theft of electronic devices - both have password locks on all electronic devices which are changed regularly and are not shared with anyone.
Break in to office - all my paper files are stored in locked filing cabinet in a locked room. No one else has the key but me.
Theft of paper file while at home – I do not take work into my home environment so this does not apply.
11. Named Data Protection Officer (DPO) and Management Responsibility
Although not required to have a named DPO, as the sole employee I am the DPO and will ensure that I remain compliant with GDPR.
12. Security Policy
As detailed in my risk assessment. I have also chosen my electronic equipment based on their industry record as having the most robust inbuilt protection possible.
13. Data Breach Policy
A personal data breach means a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data.
Where a breach is likely to result in a high risk to the rights and freedoms of individuals, I will notify those concerned directly and without undue delay.
Data Protection Policy created: 8th April 2018
Date of Next Review: 8th April 2019
Signed: Enid O’Leary