Introduction
This is the privacy policy of Square Health Limited relating to the processing by Us of Your personal data.
Under Data Protection Law We have a legal duty to protect any information We collect from You and We are committed to protecting and respecting Your privacy. We use leading technologies and encryption software to safeguard personal data, and keep strict security standards to prevent any unauthorised access to it.
Questions, comments and requests regarding Our privacy policy are welcomed and should be addressed to our Data Protection Officer at Square Health Limited, Crown House, William Street, Windsor SL4 1AT or by email to data.protection@squarehealth.com.
In this policy:
-
Square Health refers to Square Health Limited, company number 7054181 of Crown House, William Street, Windsor SL4 1AT, and We, Us, Our, Ours and Ourselves also refer to Square Health;
- You, Your, Yours and Yourself refer to you;
- Data Protection Law refers to the DPA, the UK GDPR and all other laws and regulations relating to the collection and other processing of personal data;
- DPA refers to the Data Protection Act 2018;
- UK GDPR refers to the General Data Protection Regulation (EU Regulation 2016/679) as amended and in force in the UK;
- OH Services refers to the occupational healthcare services which are provided by Square Health to You, as an employee of a Square Health client and which includes (but is not limited to) carrying out the occupational health assessment, producing an occupational health report, and assisting Your employer in deciding which reasonable adjustments (if any) should be made for You and/or Your fitness for work;
- personal data refers to personal data as defined in the UK GDPR (including, if relevant, health data or any other special category personal data as defined in the DPA or UK GDPR);
- special category data is defined in the UK GDPR and includes race or ethnic origin, the processing of genetic data and data concerning health (amongst others)
- Square Health Practitioner refers to a Square Health panel doctor or healthcare practitioner, or pathology laboratory or other analysis service used by Square Health to provide a Square Health Service;
- Square Health OH Practitioner refers to an occupational health professional engaged by Square Health to provide the OH Services;
- Square Health Pharmacist refers to a pharmacy professional engaged by Square Health to provide the Square Health Pharmacy Service;
- Square Health Pharmacy Service refers to the provision of pharmacy services by Square Health;
- Square Health Service refers to a medical or healthcare service (not OH Services) which is provided by Square Health – whether accessed or provided via one of our apps (a Square Health App) or otherwise;
- Square Health Screening Service refers to our health screening service that is provided to You through a Square Health client, such as an insurance company to which you have applied for insurance;
- Third Party Service refers to a service which is provided by a third party provider and, for Square Health Services, which is accessed via a Square Health App;
- Child (or children) refers to any child for whom You are the parent or legal guardian or for whom You are otherwise responsible and who is entitled to use a Square Health App (whether or not under Your supervision) in order to access a Square Health Service or a Third Party Service.
For the purposes of Data Protection Law, We are the data controller for personal data we collect, except in exceptional circumstances, such as when We provide Square Health Screening Services on behalf of a Square Health client. In those circumstances, the legal basis and purposes of processing will be determined by the client, who will be the data controller.
Lawful basis for processing, special category data and criminal offence data
Under Data Protection Law, We must identify a lawful basis for processing personal data. These lawful bases are found in Article 6 UK GDPR:
- Consent (Article 6(1)(a) UK GDPR);
- Contract (Article 6(1)(b) UK GDPR);
- Legal obligation (Article 6(1)(c) UK GDPR);
- Vital interests (Article 6(1)(d) UK GDPR);
- Public interest task (Article 6(1)(e) UK GDPR); and
- Legitimate interest (Article 6(1)(ea) and (f) UK GDPR).
There are additional conditions in Article 9 UK GDPR We must identify when We process special category data – the most relevant for Us are:
- Explicit consent (Article 9(2)(a) UK GDPR);
- Social protection (Article 9(2)(b) UK GDPR);
- Exercise or defence of legal claims (Article 9(2)(f) UK GDPR);
- Medical diagnosis/Healthcare and treatment (Article 9(2)(h) UK GDPR); and
- Occupational health (Article 9(2)(h) UK GDPR).
Criminal offence data (Article 10 UK GDPR) - where We process information about criminal convictions and offences or related security measures (for example, the results of Disclosure and Barring Service (DBS) checks and other pre-engagement vetting of Square Health Practitioners and staff), We do so only where authorised by law. We rely on the conditions for processing such data set out in the Data Protection Act 2018, including the employment and substantial public interest conditions in Schedule 1 to that Act.
Where required by Schedule 1 (in respect of processing special category data and criminal offence data), We maintain an Appropriate Policy Document explaining Our procedures for securing compliance with the data protection principles.
Information We may collect and process about You
Square Health Practitioners/Square Health OH Practitioners
|
Category of personal data |
Purpose of Processing |
Lawful basis of processing |
|
Contact details (eg name, address, telephone number, personal address, business address, email address) |
Due diligence Payment processing Service reporting Appointment booking |
|
|
Date of birth, professional registration numbers, CV/employment history |
Due diligence |
|
|
DBS check information to include criminal conviction data |
Due diligence |
|
|
Passport / Driving licence |
Due diligence |
|
|
Qualification/ accreditation certificates, indemnity insurance |
Due diligence |
|
|
Performance records/Service reporting |
To review performance of the services |
|
|
Bank details, VAT registration number, tax status |
Payment processing |
|
|
Photo |
To include on ID badge – for ID verification |
|
|
Audio / Video recording of consultation |
To review performance of the Square Health Services, such as through internal audits or complaint handling |
|
|
Feedback You choose to provide following a clinical consultation or a telephone call with Our customer service agents (which may include Your name and contact details, comments about Your experience, and any health or other special category data You choose to include in Your feedback) |
To invite You to give feedback following a clinical consultation or a telephone call with Our customer service agents, and to collect, analyse and act on that feedback in order to monitor, review and improve the quality of the Square Heath Services |
|
|
Your contact details and information about the Square Health Services You have accessed, together with any further feedback You choose to provide |
To contact You again following Your initial feedback to ask for more detailed or personalised feedback about Your experience of the Square Health Services |
|
Individuals that access Square Health Services
|
Category of personal data |
Purpose of Processing |
Lawful basis of processing |
|
Name, address, e-mail address and phone number, date of birth, gender and photograph |
To provide the Square Health Services |
|
|
Information relating to health including medical records, physical and mental performance, characteristics, any ailments, diseases, and disabilities |
To provide the Square Health Services |
|
|
Race and other special category information where it is relevant to the provision of the Square Health Services |
To provide the Square Health Services |
|
|
Audio / Video recording of consultation |
To review performance of the Square Health Services, such as through internal audits or complaint handling |
|
|
Audio recording of call with Square Health Operations assistants |
To review performance of the Square Health Services, such as through internal audits or complaint handling |
|
Individuals that access Square Health Screening Services (where we are the data controller)
|
Category of personal data |
Purpose of Processing |
Lawful basis of processing |
|
Name, title, address and other contact details, date of birth, gender, information about Your work/education and lifestyle, marital status, Your GP details |
|
|
|
Medical records, physical build (height/weight), medical history (including, but not limited to current and past history, psychological history, family history, medication, tests and investigation results), results of Your physical examination, test results |
|
|
Individuals that access OH Services
|
Category of personal data |
Purpose of Processing |
Lawful basis of processing |
|
Name, date of birth, job title, contact details |
To provide the OH Services |
|
|
Accessibility requirements |
To provide the OH Services |
|
|
Relevant information about how you carry out your work and any impact on your health condition |
To provide the OH Services |
|
|
Information about your lifestyle that is relevant to your health condition |
To provide the OH Services |
|
|
Information about your health condition provided pre- or during your assessment |
To provide the OH Services |
|
|
Any other relevant information that would assist in making an occupational health report |
To provide the OH Services |
|
|
Audio / Video recording of the occupational health assessment |
To provide the OH Services |
|
Individuals that access Square Health Pharmacy Service
|
Category of personal data |
Purpose of Processing |
Lawful basis of processing |
| Name, date of birth, contact details, prescribing clinician[s] and, where relevant, identity verification details |
To provide the Square Health Pharmacy Service, including processing and dispensing Your order, communicating with You about it and, where relevant, verifying Your identity |
|
| Account information, including login details, account settings, password reset history and preferences |
To create, administer and secure Your pharmacy account, enable You to log in, and maintain Your account settings and preferences |
|
| Transaction information, including the products and services You order, delivery choices, payment status, refunds, order history and associated communications |
To process, fulfil and deliver Your orders, manage payments, refunds and related communications, and maintain a record of Your order history |
|
| Medical information including name of medication prescribed, dosage as well as any directions for use |
To dispense the prescribed medication safely and accurately and to provide the Square Health Pharmacy Service |
|
| Information used to verify Your identity before dispensation of medication |
To verify Your identity to prevent fraud or misuse of Square Health Pharmacy Service |
|
Square Health Pharmacist
|
Category of personal data |
Purpose of Processing |
Lawful basis of processing |
| Contact details (eg name, address, telephone number, personal address, business address, email address) |
Due diligence Payment processing Service reporting |
|
| Date of birth, professional registration numbers, CV/employment history |
Due diligence |
|
| DBS check information to include criminal conviction data |
Due diligence (i.e. to comply with safeguarding and regulatory reporting requirements) |
|
| Passport / Driving licence |
Due diligence |
|
| Qualification/ accreditation certificates, indemnity insurance |
Due diligence |
|
| Engagement records (e.g. contract, work location, availability, etc)/Performance records/Service reporting |
To manage the engagement, allocate and schedule work To review performance of providing the Square Health Pharmacy Service |
|
| Bank details, VAT registration number, tax status |
Payment processing and comply with tax reporting |
|
| Photo |
To include on ID badge - for ID verification |
|
| Monitoring and security data (IT and system access logs, CCTV, building access records, audit trails of dispensing and clinical systems) |
To ensure information and premises security, protect patient safety, prevent and detect fraud or error, and comply with clinical governance and regulatory obligations |
|
| Regulatory and incident data (records relating to dispensing errors, near misses, patient safety incidents, and regulatory investigations) |
To investigate and report incidents, cooperate with regulators and maintain patient safety |
|
Visitors to Our website
You may directly or indirectly give Us personal data by entering information via Our website or through contact with member of Our customer service and marketing team, or automatically every time You use Our website (in respect of technical information).
|
Category of personal data |
Purpose of Processing |
Lawful basis of processing |
| Name, address, email address, telephone and other contact details, date of birth, information about Your employment/education and lifestyle, information about Your use of Our services or your image |
|
|
| Health or medical information | Where You voluntarily provide this information in order to clarify an enquiry or complaint sent through Our contact form on Our website |
|
| Technical information, including the internet protocol (IP) address used to connect Your device to the internet, Your login information, browser type and version, time zone setting, operating system and platform, and Your location |
|
|
Visitors to Our premises
You may visit Our Windsor premises for various reasons and when You do so, We will ask You to sign in and out at reception in Our visitor book. You may be asked to show Us a form of ID for verification purposes and We will record Your name, company, the person You are visiting, the times You entered and left the building, Your vehicle licence plate number and the date. We will provide You with a visitor pass, which may record access logs i.e. electronic records of entry and exit from Our premises.
Closed-circuit television (CCTV) operates inside and outside the building for security purposes.
The purpose for processing visitor sign-in and sign-out information and CCTV is for security and safety reasons. The lawful basis We rely on to process Your personal data is legitimate interests.
Where We obtain Your personal data from
We collect most personal data directly from You. However, in some cases We receive personal data about You from other sources, including:
- Your employer or its appointed intermediary, where We provide OH Services;
- the insurer, broker or other organisation that has arranged or is funding Your assessment, screening or treatment;
- Your GP, treating clinicians, hospitals or the NHS, where relevant to the service We provide;
- prescribers and pharmacies, in connection with the Square Health Pharmacy Service;
- identity, age and eligibility verification providers and fraud-prevention agencies; and
- publicly available sources and Our service providers acting on Our behalf.
The categories of personal data We obtain from these sources are the same categories described in the tables above, and may include special category data and criminal offence data. Where We are required to do so, We will provide You with information about the source of Your personal data.
Cookies
Our cookie policy may be viewed here https://www.squarehealth.com/cookies
Much of the information which we may collect through the use of cookies is non-personal data for the purposes of Data Protection Law but We treat Internet Protocol (IP) addresses and similar identifiers as personal data. Where non-personal data is combined with personal data, We also treat the combined information as personal data for the purposes of this Privacy Policy.
Disclosure of Your information
Square Health Practitioners
We may share Your personal information with other third parties where We have a legal obligation to do so or to assist with investigations carried out by law enforcement, government or regulatory bodies where it is fair and lawful. For example, where a regulatory body requests Your information to carry out a task in the public interest.
We shall share Your name with members/patients prior to a consultation taking place.
Individuals that access Square Health Services
We may share Your or Your Child’s personal data with the following parties for the following purposes:
|
Party |
Purpose |
|
Square Health client, where access to a Square Health Service is linked to membership of a wider service of the relevant client |
To enable the relevant Square Health client to administer its service and (where appropriate) to facilitate access to benefits under that service |
|
Square Health Practitioners |
Where necessary in connection with the provision of any element of a Square Health Service |
|
Providers of Third Party Services |
Where necessary in connection with access to or provision of the relevant Third Party Service |
|
Your NHS GP |
|
Individuals that access Square Health Screening Services (where we are the data controller)
We may disclose Your personal data to the following recipients where necessary:
- To the appropriate Square Health client (such as an insurance company or independent financial advisor to which You have applied for insurance)
- Medical examiners for the purpose of obtaining a medical report and arranging a home visit and an appointment
- Laboratories for the purpose of providing test results
- Diagnostics providers (for example hospitals) for the purpose arranging investigations
- Your GP and other medical practitioner
- To a third party provider approved by the applicable Square Health client
- Professional advisors e.g. auditors and legal advisors
- Taxation or other public authorities where required by law
As described above, We may share Your personal data with one or more third-party laboratories to carry out Square Health Screening Services requested, and for that purpose the laboratory acts as Our processor. Separately, each laboratory may also retain and process Your personal data for its own legal, regulatory, accreditation, clinical governance and record-retention purposes, and when it does so it acts as an independent data controller, solely responsible for that processing. You should refer to the relevant laboratory's own privacy notice for further detail, and may contact Our DPO if You would like Us to identify the laboratory or laboratories used in connection with Your care.
We may also transfer Your personal data to people providing Us with support, administrative services and secure shredding services for the more efficient processing of Your health screening.
Individuals that access OH Services
|
Party |
Purpose |
Lawful basis of processing |
|
Your employer |
Where necessary to keep them updated as to the progress of Your occupational health process |
|
|
Square Health OH Practitioners |
Where necessary for the provision of the OH Services |
|
|
Square Health Technology Limited |
Where necessary in connection with access to or provision of the OH Services |
|
All individuals
Disclosure of information to affiliated companies
We may share personal data relating to You, including any health or medical information or other special category data that You have agreed We may use, with any affiliated company which processes personal data on Our behalf. Our affiliated companies are Square Health Group Limited, Square Technology Limited, Bodycare Clinics Limited and Doctors Chambers (UK) Limited and such other affiliated companies from time to time, as well as any of their respective holding companies and any subsidiaries of any of those holding companies, as well as our ultimate holding company and its subsidiaries. “Holding company” and “subsidiary” are defined in section 1159 of the UK Companies Act 2006.
Disclosure of information to other third parties
We may share personal data (but not special category data) with selected third parties including analytics and search engine providers that assist in the improvement and optimisation of Square Health Services and/or Square Health Apps.
We may disclose Your personal data to third parties:
- If all or substantially all of Our assets are acquired by a third party as part of a sale or transfer of our business, personal data held by Us about Our clients and users will be one of the transferred assets.
- If We are under a duty to disclose or share personal data in order to comply with any legal obligation or to assist with investigations carried out by law enforcement, government or regulatory bodies where it is fair and lawful, or
- To protect the rights, property, or safety of Us, Our clients and users, or others. This includes exchanging information with other companies and organisations for the purposes of fraud protection and credit risk reduction.
How we store your personal data
Square Health Practitioners and Square Health OH Practitioners
We use third party providers to store / host your personal data. These third parties act as our data processors (as defined in Data Protection Law). These data processers process your personal data within the UK and the EEA.
Individuals that access Square Health Services
Some personal data relating to You (and/or, if applicable, Your Child) may be held within a Square Health App used by You. All other personal data relating to You and/or (as applicable) Your Child will be stored on secure servers located in the UK or Ireland. This includes primary and secondary care information, medication information and diagnostic information. Usually, personal data relating to You (and/or, if applicable, Your Child) will be processed only within the UK or Ireland but there may be occasions where it is processed outside the UK or Ireland, for example where a Square Health Practitioner providing a consultation is located outside the UK or Ireland. Any such processing will be in full compliance with Data Protection Law.
Individuals that access OH Services
Personal data relating to You will be stored on secure servers located in the UK or Ireland. This includes your occupational health referral, supplementary information we may need to complete the assessment, the occupational health report (including any drafts) and any next steps relating to You.
Other individuals
All personal data relating to You and provided or collected via Our website will be stored on secure servers located in the UK or EEA.
International transfers of Your personal data
The personal data We collect is primarily stored and processed within the UK, Ireland and other countries in the EEA. Where We transfer Your personal data to a country outside the UK that is not covered by UK adequacy regulations, We will ensure that an appropriate safeguard recognised under the UK GDPR is in place before the transfer takes place. This will usually be:
(a) the UK Government adequacy regulations, where the destination country or recipient has been assessed as providing an adequate level of protection; or
(b) the Information Commissioner Office International Data Transfer Agreement (IDTA), or the UK Addendum to the European Commission Standard Contractual Clauses, together with a transfer risk assessment and any additional measures identified as necessary.
You may obtain information about the safeguards (subject to redaction of commercially sensitive and confidential information) We use for these transfers by contacting Our Data Protection Officer using the details set out in this Policy.
Passwords and security
Where We need to send You personal data or any other confidential information - for example, when providing You with a copy of Your personal data - We will do so securely to protect the information while it is in transit. In accordance with Our obligations under Data Protection Law, such emails will be sent using encryption and be password protected. The password will be communicated to You separately. These measures are part of our commitment to implementing appropriate technical safeguards to protect Your personal data against unauthorised access or disclosure.
Where We have given You (or where You have chosen) a password for any reason, You are responsible for keeping this password confidential. We ask You not to share a password with anyone.
We also encrypt data which are transmitted via Our website. However, the transmission of information via the internet can never be completely secure due to security threats outside Our control. For this reason, although We will do our best to protect Your personal data, We cannot guarantee the security of Your data transmitted via Our website. Once We have received your information, We will use strict procedures and security features to minimise the risk of unauthorised access.
Our website may contain links to and from third party applications or websites. If You follow a link to any of these applications or websites, please note that these applications or websites have their own privacy policies and that We do not accept any responsibility or liability for these policies. Please check these policies before You submit any personal data to these websites.
Location data
If You have switched on location sharing for a Square Health App on Your phone, we will collect Your location data and only use it if, during Your consultation, Your Square Health Practitioner believes they need to call emergency services to attend to You. If You don’t have location sharing switched on, there may be a delay in calling emergency services while the Square Health Practitioner determines Your location.
We will collect and use Your location data in accordance with Article 6(1)(d) UK GDPR (processing is necessary in order to protect the vital interests of the data subject or of another natural person) and regulation 16 of The Privacy and Electronic Communications (EC Directive) Regulations 2003 (Emergency calls).
Your location data will not be retained after Your consultation has ended. We will not use Your location data for any other purpose.
Children's data
Our services may be provided to, or used by, children, including where a parent, guardian or other responsible adult arranges care on their behalf and, for age-appropriate services, where a Child engages with Us directly. We recognise that children's personal data merits specific protection, and We take particular care when We process it.
We only process children's personal data where We have a lawful basis to do so. Depending on the service, that basis may include the performance of a contract, compliance with a legal obligation, the protection of someone's vital interests, Our legitimate interests, or the Child’s consent (or the consent of a parent or guardian). Where We process a Child's health data or other special category data, We rely on an additional condition under Article 9 UK GDPR and the Data Protection Act 2018, most commonly the provision of health or social care and treatment.
We do not rely on consent as Our only basis for processing children's data and where We do rely on consent for an online service offered directly to a child, We take account of the child's age when deciding whether it can be given by the child or must be given by a person holding parental responsibility.
Where Our products or services are age-restricted (for example, certain medicines supplied through the Square Health Pharmacy Service), We carry out appropriate age and eligibility verification before supplying them, and We may decline to provide a service where We are not satisfied that it is appropriate.
In designing and providing any online service likely to be accessed by children, We have regard to the Information Commissioner Office Age Appropriate Design Code (Children's Code), including applying data minimisation and appropriate default protections. We will not use children's personal data in ways that are incompatible with their best interests.
Retention of Your personal data
Personal data may be retained by Us in accordance with our retention policy for the period required to comply with Our obligations to insurance and financial providers or other third parties and/or other legal obligations, and/or where it is necessary for an identified business purpose. All personal data retained by Us will be held securely as described in this privacy policy.
To decide how long to keep personal data, We consider its nature and sensitivity, the potential risk of harm from unauthorised use or disclosure, the purposes for which We process it and whether We can achieve those purposes by other means, and the applicable legal, regulatory and professional requirements. The retention periods We apply to the main categories of personal data are set out below:
(i) Clinical and health records (including consultation notes, screening and occupational health records): retained in accordance with the retention periods set out in Our internal retention schedule. These periods vary according to the type of record (for example, records relating to practitioners are subject to longer retention periods), and in each case We keep records for no longer than is necessary for the purposes described in this Policy and to meet Our contractual, legal, regulatory and professional obligations;
(ii) Pharmacy dispensing and transaction records: retained for a minimum of two years in accordance with applicable medicines and pharmacy legislation, and longer where required for controlled drugs or private prescriptions;
(iii) Practitioner vetting and DBS records: retained in accordance with Our Appropriate Policy Document and applicable legal, contractual, professional and regulatory obligations;
(iv) Technical account, website and other technical data: retained for a reasonable period after Your account is closed or Your last interaction with Us, as determined by reference to the criteria described in this section;
(v) Marketing preferences: retained until You withdraw consent or object, and the fact of Your withdrawal of consent or objection will be retained as part of Your account or profile information to ensure We continue to adhere to Your preference.
Where specific periods are not set out above, We determine the retention period by reference to the criteria described in this section. Once the applicable retention period for Your personal data has expired, We will ensure that Your personal data is securely and permanently deleted using appropriate technical measures designed to prevent recovery or unauthorised access. These practices reflect our commitment to the data minimisation principle under Data Protection Law, which requires that personal data is not kept for longer than is necessary for the purposes for which it was collected.
Marketing and analytics
We may use Your personal data to send You marketing communications about Square Health Services. We will only send You direct marketing communications where We have a lawful basis to do so. In practice, this means We rely on one of the following:
- Your consent: where required, We will ask for Your consent before sending You marketing communications.
- “Soft opt-in": where You are an existing customer or user of a Square Health App or Square Health Service - We may send You marketing communications about Our similar services without obtaining Your prior consent. This is sometimes referred to as the "soft opt-in" and is permitted under the Privacy and Electronic Communications Regulations (EC Directive) 2003.
We may also use Your personal data for analytics purposes. This involves analysing information about how You interact with a Square Health App or Square Health Service - such as the features You use, the frequency of Your visits, and Your engagement patterns, in order to better understand Your preferences, improve Our services, and inform Our marketing strategy. Where We do this, We rely on either Your consent or Our legitimate interests as the lawful basis for this processing.
If You have given Your consent for Us to use Your personal data for whatever reason, You have the right to withdraw Your consent, including for marketing purposes. If You have consented to receive marketing communications or We are relying on the “soft opt-in", at any time subsequently You can ask not to receive marketing communications by emailing us at data.protection@squarehealth.com or by adjusting Your marketing preferences in a Square Health App.
Your rights
Data Protection Law gives You various rights including the:
-
right to receive a copy of Your personal data
-
right to ask Us to update or correct any inaccurate personal data
-
right to request Us to delete Your personal data (‘right to be forgotten’) unless We have a contractual/legal requirement to keep it.
You can exercise Your data protection rights by writing to Our Data Protection Officer at Crown House, William Street, Windsor SL4 1AT OR by sending Your request to
Data Protection Law gives You the following rights:
- right to receive a copy of Your personal data
- right to ask Us to update or correct any inaccurate personal data
- right to request Us to delete Your personal data (‘right to be forgotten’) unless We have a contractual/legal requirement to keep it
- right to ask Us to restrict Our processing of Your personal data
- right to object to Our processing of Your personal data
- right to data portability
- rights relating to automated decision-making and profiling
You can exercise Your data protection rights by writing to Our Data Protection Officer at Crown House, William Street, Windsor SL4 1AT OR by sending Your request to data.protection@squarehealth.com. If You have any concerns about Our use of Your personal data, You can make a complaint to Us using the above details. If You remain unhappy with how We’ve used Your data after raising a complaint with Us, Data Protection Law gives You the right to complain to Our supervisory authority, the Information Commissioner’s Office (www.ico.org.uk).
Automated decision-making and profiling
We do not make decisions about You based solely on automated processing (that is, without any meaningful human involvement), including profiling, that produce legal effects concerning You or similarly significantly affect You. Where We use automated tools to support Our services, the outcome is reviewed by a suitably qualified person (such as a prescriber or clinician) before any decision affecting You is made, so that meaningful human involvement always forms part of the decision. If We introduce any solely automated decision-making that produces legal or similarly significant effects in the future, We will update this Policy, explain the logic involved and the significance and likely consequences of that processing, and ensure You have the right to obtain human intervention.
Changes to Our privacy policy
Any changes We may make to Our privacy policy in the future will be displayed on Our website or at Our discretion may be notified to You by email or SMS. New terms may be displayed on-screen and You may be required to read and accept them in order to continue to use Our website.