How We Use Your Information

We care about your personal data and it’s important that you know how we use it and how we keepit safe. This Privacy Notice covers how, when and why we use your information. This Privacy Notice also explains the choices you can make about the way in which we use your information and how you have the right to change your mind at any time.

This Privacy Notice is not exhaustive and we are always happy to provide any additional information or explanations where needed. Please contact our QA & Logistics Manager in writing to the address details below:

QA & Logistics Manager, The SpineCorporation Limited, Millennium Way, Peak Business Park, Foxwood Road, Chesterfield S41 9RF, Derbyshire, UK

This Privacy Notice applies to all information held by The SpineCorporation Limited relating to individuals, whether you are a patient, service user, member of staff, or contractor.

Reviews of and Changes to our Privacy Notice

We will review our Privacy Notice on an annual basis. This Privacy Notice was last reviewed in May 2018.

Information We Collect and Hold About You

We need to use information about you in various forms and we will only use the minimum amount of information necessary for the purpose. Sometimes we will use information that does not identify you i.e. statistics / anonymised reports.

Who We May Share Information With

We may share information about you with the following main organisations to ensure that your health care needs are fully supported and communicated:

• NHS/Private commissioners of care – in particular the organisation that referred you to us for treatment, assistance or advice
• Other providers involved in your care – such as a hospital or your GP

Definitions

The SpineCorporation Limited processes several different types of information:

1. Identifiable – containing details that identify an individual. This may include but is not limited to such information as name, address, full postcode, date of birth.
2. Pseudonymised – information where individuals can be identified by using a coded referencewhich does not show their ‘real world’ identity.
3. Anonymised–informationaboutindividualswithidentifyingdetailsremoved.

Our records may be held on paper or in electronic computer systems.

Legal Obligations to Collect and Use Information

In the circumstances where we are required to use personal identifiable we will only do this if:

• The information is necessary for your direct healthcare
• We have received written consent from you to use your information for a specific purpose e.g. employment.
• There is an overriding public interest in using the information e.g. in order to safeguard an individual or to prevent a serious crime
• There is a legal requirement that will allow us to use or provide information e.g. a formal Court order or subpoena.

Our Commitment to Data Privacy and Confidentiality Issues

We are committed to protecting your privacy and will only process personal confidential data in accordance with the Data Protection Act 1998, the General Data Protection Regulation (2018), the Common Law Duty of Confidentiality and the Human Rights Act 1998. The SpineCorporation Limited also has a local Data Protection (GDPR) Policy which can be made available on request.

The SpineCorporation Limited is a Data Controller and under the terms of the Data Protection Act 1998 and the General Data Protection Regulation (2018) we are legally responsible for ensuring that all personal confidential data that we collect and use i.e. hold, obtain, record, use or share about you is done in compliance with this legislation.

All data controllers must notify the Information Commissioner’s Office (ICO) of all personalinformation processing activities. Our ICO Data Protection Register number is Z198363X and our entry can be found in the Data Protection Register on the Information Commissioner’s Officewebsite.

Everyone working for The SpineCorporation Limited has a legal duty to keep information about you confidential. All identifiable information that we hold about you will be held securely and confidentially. We use administrative and technical controls to do this. We use strict controls to ensure that only authorised staff are able to see information that identifies you. Only a limited number of authorised staff have access to information that identifies you where it is appropriate to their role and is strictly on a need-to-know basis.

All of our staff receive appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures. All staff are trained to ensure they understand how to recognise and reportan incident ensuring that the organisation’s procedure for investigating, managing and learninglessons from incidents.

Your information will not be sent outside of the European Economic Area (EEA) where the laws do not protect your privacy to the same extent as the law in the UK. We will never sell any information about you.

Accuracy of Information

In order to provide the highest level of customer service possible, we need to keep accurate personal data about you. We take reasonable steps to ensure the accuracy of any personal data or sensitive information we obtain. We ensure that the source of any personal data or sensitive information is clear and we carefully consider any challenges to the accuracy of the information. We also consider when it is necessary to update the information, such as name or address changes and you can help us by informing us of these changes when they occur.

Your Rights

You have certain legal rights, including a right to have your information processed fairly and lawfully and a right to access any identifiable information we hold about you.

You have the right to privacy and to expect The SpineCorporaiton Limited to keep your information confidential and secure.

You also have a right to request that your confidential information is not used beyond your own care and treatment and to have your objections considered.

If we do hold identifiable information about you and you have any queries about the information we hold please contact the QA & Logistics Manager using the details below:

QA & Logistics Manager, The SpineCorporation Limited, Millennium Way, Peak Business Park, Foxwood Road, Chesterfield S41 9RF, Derbyshire, UK. Email: info@spinecor.com

You have the right to refuse/withdraw consent to information sharing at any time by using the contact details above. If there are any consequences to withdrawing consent these will be fully explained and discussed with you first.

Complaints

The SpineCorporation Limited aims to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring concerns to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures. Contact details for complaints regarding the processing of information should be directed to the QA & Logistics Manager, The SpineCorporation Limited, Millennium Way, Peak Business Park, Foxwood Road, Chesterfield S41 9RF, Derbyshire, UK. Email:info@spinecor.com You can also raise a concern directly with the ICO; although our aim is to resolve your complaint swiftly ourselves in the first instance.

On-Line Payments

Personal data collected as part of our payment process will be held primarily to settle your treatment fees. This data will be processed by reputable third-party banking and distribution institutions that handle our customers card transactions and may be used for any of the following purposes: accounting, billing and auditing, administrative and legal purposes, security and payment verification.

Data security for merchants and payment card processors is the vital byproduct of applying the information security best practices found in the Payment Card Industry Data Security Standard (PCI DSS). The standard includes 12 requirements for any business that stores, processes or transmits payment cardholder data. These requirements specify the framework for a secure payments environment, but for purposes of PCI DSS compliance, their essence is three steps: Assess, Remediate and Report. The SpineCorporation Limited endeavours to comply with this standard to ensure your data is secure.

Please protect sensitive data at all times throughout your online transaction. Make sure that nobody can see over your shoulder when typing in personal information and close your browser when you have finished. The SpineCorporation Limtied and its third party suppliers have used their reasonable endeavours to ensure that access to information provided and the payments you make whilst using this service are secure. We work to protect the security of your information during transmission. The site is secured using a SSL Web Server Certificate to offer you secure communications by automatically encrypting all data when it is entered.

Cookies

Most websites you visit will use cookies in order to improve your user experience by enabling thatwebsite to ‘remember’ you. Cookies do lots of different jobs, like letting you navigate betweenpages efficiently, storing your preferences and generally improving your experience of a website. Cookies make the interaction between you and the website faster and easier. Cookies may be set by the website you are visiting or they may be set by other websites who run content on the page you are viewing.

What is in a Cookie?

A cookie is a simple text file that is stored on your computer or mobile device by a website’s serverand only that server will be able to retrieve or read the contents of that cookie. Each cookie is unique to your web browser. It will contain some anonymous information such as a unique identifier and the site name and some digits and numbers. It allows a website to remember things like your preferences or login.

What to do if you don’t want Cookies to be set

Some people find the idea of a website storing information on their computer or mobile device a bit intrusive, particularly when this information is stored and used by a third party without them knowing. Although this is generally quite harmless you may not, for example, want to see advertising that has been targeted to your interests. If you prefer, it is possible to block some or all cookies, or even to delete cookies that have already been set; but you need to be aware that you might lose some functions of that website. If you have any concerns about cookies, please let us know.