Privacy Policy

2. What personal information we collect

Personal information may be collected when a Patient makes an enquiry, completes registration or medical forms, attends an appointment or communicates with us.

Depending on the services provided, this may include:

Personal and contact informa-on

• Full name

• Address

• Telephone number

• Email address

• Date of birth

• Occupation, where relevant

• Emergency contact or next of kin details

  Health and clinical informa-on

• GP and relevant healthcare professional details

• Medical history

• Current medical conditions

• Medications

• Allergies and relevant health information

• Relevant information regarding pregnancy or other circumstances affecting treatment

• Clinical assessments and findings

• Reason for treatment

• Treatment provided

• Treatment advice and aftercare

• Progress and subsequent contact

• Relevant incidents or adverse events

• Information received from other healthcare professionals

• Clinical photographs where appropriate and with the Patent’s consent

  Health information is classed as special category data and is subject to additional protection under UK GDPR.

  Financial information

  We may retain information necessary for accounting and payment purposes, including appointment charges, invoices, receipts and payment records.  We do not routinely retain full card payment details.

3. How we use and protect health information

Patient health information is treated as confidential and is only accessed where necessary for the provision and management of care, administration, legal or professional requirements, or other lawful purposes.

Our lawful basis for processing personal information is determined according to the purpose for which the information is being processed. For healthcare services, this may include processing that is necessary for the provision and management of health or social care, together with the relevant special category condition under Article 9 of UK GDPR and applicable provisions of the Data Protection Act 2018.

Patient consent to treatment is separate from the legal basis used to process personal information under data protection legislation.

4. Clinical photographs and recordings

Clinical photographs may be taken where they are necessary to assist with assessment, diagnosis, treatment, monitoring or maintaining an accurate clinical record.

Patients will be informed and appropriate consent obtained where required.

Clinical photographs will be treated as confidential clinical informa-on and will not be used for advertising, social media, publicity, publication or other non-clinical purposes without separate, appropriate consent.

Any photographs used for education, training or other purposes outside the Patient’s direct clinical care will only be used where the appropriate consent and legal basis have been established.

5. Consent to treatment

Consent to treatment is obtained separately through the relevant Patient Consent Form.

A Patient may withdraw consent to treatment at any time, subject to any legal, professional or safety requirements.

Withdrawal of treatment consent does not automatically require the deletion of clinical records, where we have a lawful reason to retain them.

6. Children and young people

Where a Patient is under 16, appropriate consent will be obtained from a parent, guardian or other person with appropriate parental responsibility, where required.

The proposed treatment will be explained to the child or young person in an age-appropriate manner so that they understand what is going to happen.

The child or young person’s views and wishes will be considered in accordance with their age, understanding and applicable legal requirements.

Clinical records relating to children and young people will be retained in accordance with our record-retention requirements and professional obligations.

7. Confidentiality

We take reasonable steps to ensure that conversations and personal information cannot be overheard or accessed by people who are not authorised to receive them.

All Patient information is treated as confidential.
Information will only be disclosed to another person or organisation where:

• the Patient has given appropriate permission;

• disclosure is necessary for the provision or coordination of care;

• disclosure is required or permitted by law;

• disclosure is necessary to protect the vital interests of the Patient or another person; or

• another lawful basis for disclosure applies.

  We will not sell or provide Patient information to third parties for their own marketing purposes.

  8. Sharing information with healthcare professionals

  Where appropriate, relevant Patient information may be shared with healthcare professionals involved in the Patient’s care, such as GPs, Podiatrists, Physiotherapists, Consultants or other relevant Practitioners.

  Where required, we will obtain the Patient’s permission before sharing information, unless there is another lawful basis or a legal or emergency requirement that permits or requires disclosure.

  Only information that is relevant and necessary will be shared.

9. Electronic records and security

Patient records are held electronically using Cliniko, together with authorised computers, iPads and other systems required to provide our services.

Cliniko and other service providers used by Soul & Soles act as data processors where applicable and are required to process information in accordance with applicable data protection requirements.

Our computers and authorised devices are protected by passwords and appropriate security measures.

Access to Patient information is restricted to authorised individuals who require access for their role.

Where appropriate, devices are protected by password or passcode, automatic screen locking and other security measures.

We take reasonable technical and organisa-onal measures to protect personal information against accidental loss, unauthorised access, alteration, disclosure or destruction.

10. Transfer of Patient records from All About Feet Limited

Where appropriate and where necessary to ensure continuity of care, relevant Patient records previously held by All About Feet Limited may be transferred to and retained by Soul & Soles, where Soul & Soles becomes responsible for providing the Patient’s ongoing care.

Patients will be informed where appropriate and the information will continue to be handled confidentially and in accordance with applicable data protection legislation.

The transfer of records does not mean that information can be used for unrelated purposes. It will continue to be used only where there is an appropriate lawful basis.

11. Retention of records

We retain Patient records for as long as is reasonably necessary to provide ongoing care, meet professional and legal obligations, protect the interests of Patients and practitioners, and deal with any potential complaints, claims or regulatory requirements.

Clinical records will normally be retained for at least eight years after the Patient’s last treatment or contact, unless a longer retention period is required or considered appropriate.

For children and young people, records will normally be retained until the Patient reaches 25 years of age, or for at least eight years after the last treatment or contact, whichever is later, subject to applicable professional and legal requirements.

Records will not be retained indefinitely without a legitimate reason.

When information is no longer required, it will be securely deleted or destroyed in an appropriate manner.

If a Patient stops attending, their electronic record may be marked as inactive or archived within Cliniko. Archiving does not necessarily mean that the record is immediately deleted, as we may have a legal or professional obligation to retain it.

12. Accuracy of information

We aim to ensure that Patient information is accurate, complete and kept up to date.

The accuracy of informa-on depends partly on the information provided by the Patient or received lawfully from another healthcare professional.

Patients are encouraged to inform us of any changes to their contact details, medical history, medication or other information that may affect their care.

13. Marketing communications

From time to time, Soul & Soles may wish to send Patients information about our services, new treatments, events or newsletters.

Where marketing is sent electronically, including by email or text message, we will comply with applicable data protection legislation and the Privacy and Electronic Communications Regulations (PECR).

Where consent is required, marketing consent will be obtained separately from consent to treatment and from acceptance of this Privacy Policy.

Patients may withdraw their marketing consent or object to direct marketing at any time. We will make it easy for Patients to unsubscribe or change their marketing preferences.

Withdrawing marketing consent will not affect a Patient’s ability to receive treatment.

14. Service and appointment communications

We may contact Patients by telephone, email, text message or other appropriate means where necessary for the administration of their appointments and provision of care.

These communications may include appointment confirmations, reminders, cancellations, changes to appointments, treatment-related information and aftercare.

Such communications are separate from direct marketing.

15. Patients’ data protection rights

Under applicable data protection legislation, Patients may have the right to:

• request access to the personal information we hold about them;

• request correction of inaccurate or incomplete information;

• request restriction of processing in certain circumstances;

• object to certain processing, including having an absolute right to object to direct

  marketing;

• request deletion of information where there is no lawful reason for us to continue retaining

  it; and

• request the transfer of certain personal information in a portable format where the right to

  data portability applies.
  These rights are subject to certain legal exemptions and restrictions. In particular, health information may be subject to specific rules when responding to a Subject Access Request.

16. Requesting access to your records

Patients have the right to request access to their personal information. This is commonly known as a Subject Access Request (SAR).

Requests can be made in writing or verbally, although we may need to confirm the identity of the person making the request.

We will normally respond to a valid Subject Access Request without undue delay and within one month of receiving the request and any information reasonably required to verify the Patient’s identity. In certain complex circumstances, the legal time limit may be extended by up to a further two months.

Requests should be sent to:

Michelle Robinson

Soul & Soles
22 West Fryerne, Yateley, Hampshire, GU46 7SU

Email: hello@soulandsoles.co.uk 

 

17. Data breaches

We take the security of Patient information seriously.

If we become aware of a personal data breach, we will assess the breach promptly and take appropriate steps to contain, investigate and remedy it.

Where legally required, we will notify the Information Commissioner’s Office (ICO) within the applicable statutory timescale and will notify affected individuals where required.