Introduction

The Kingsbridge Healthcare Group respects your right to privacy and his Privacy Notice is a statement to describe to our patients, carers, visitors and the general public how and why we collect, use, store, retain and disclose the personal data that we hold.

The following Privacy Notice forms part of our ongoing commitment to the fair and lawful processing of all personal data.

We will review this Privacy Notice on a periodic basis and we advise you to check back on our website for the latest version. 

By visiting this web site, you are accepting the terms of this Web Site Privacy Policy. Any external links to other web sites are clearly identifiable as such, and we are not responsible for the content or the privacy policies of these other web sites.

Who is the Kingsbridge Healthcare Group?

The Kingsbridge Healthcare Group (KHG) registered at Kingsbridge Healthcare Group Administration Centre, Danesfort Building, ,21 StranmillIs Road, Belfast, BT9 5UB, is a group of companies offering a wide variety of private healthcare products and services across Ireland and the UK. The companies that form the group are as follows:

• Kingsbridge Private Hospital Belfast Ltd
• Kingsbridge Private Hospital Sligo Ltd
• Kingsbridge Private Hospital North West Ltd
• Kingsbridge Training Academy (Skills I ltd)
• Kingsbridge Medical Diagnostics Ltd
• Kingsbridge Opticians and Hearing Care (Optique Eye and Ear Ltd)
• 3fivetwo Medical Ltd
• Cosmetech Ltd

Each of these companies may, to the extent relevant, collect, retain and use information about you and we refer to these collectively as 'Kingsbridge Healthcare Group' in this notice.

What Information Is Collected About You?

Kingsbridge Healthcare Group companies process personal information and data in order to enable us to support the provision of healthcare and training services to patients/clients, maintain our own accounts and records, promote our services, and to support and manage our employees. We also process personal information about health care professionals that deliver services throughout the organisation.

We also use information to support and monitor our services to enable the delivery of high-quality healthcare and training services. This type of information will usually be provided in an aggregate or anonymised form, so that we cannot identify an individual.

Kingsbridge Healthcare Group may ask for and hold various details of personal information regarding yourself which will be used to aid in the delivery of appropriate care and treatment.

The data collected may include the following:

• Basic Personal details such as your name, address, date of birth, email address, phone number, current General Practitioner (GP) details, next of kin and family details such as dependants and online identifiers.
• All details relating to any previous, current or planned treatment and care, including all notes and reports relating to your health
• All Healthcare results such as X-ray, CT or MRI results, blood tests etc.
• Marketing preferences relating to group services and products
• Education, training, mostly frequently of clinicians such as GPs
• Employment details, for example for those that work for us either directly or are commissioned by us to provide a service
• Visual images, personal appearance and behaviour, for example if CCTV images are used as part of building security
• Responses to surveys, where individuals have responded to surveys about healthcare issues, service levels, training courses or other group company activities
• User IP addresses in circumstances where they have not been deleted, clipped or anonymised
• Payment information including card details
• Any further information that you choose to tell us

The following may also be collected in certain circumstances:

• Sensitive personal data such as race, ethnic origin, political and religious beliefs, sex life, sexual orientation, genetic data and biometric data
• Further health related information such as whether or not you have a disability or other health conditions, such as allergies. Vaccination status

The information and data described above is collected in a number of different ways and can include:

• Information directly given to us by yourself by email, phone, letter etc
• Information provided by a parent, carer or guardian
• Information provided from healthcare professionals such as treating consultants, your GP, dentist or physiotherapist
• Information received from Northern Ireland Health and Social Care Trusts
• Information provided by an employer, insurer,
• Marketing opt ins
• Completed satisfaction surveys
• Registration or booking online for any of our or services.
• Voluntarily complete a customer survey or provide feedback on any of our website or via email.
• Debt collection agencies or government agencies
• Use or view our website via your browser’s cookies

In order for us to provide your health assessment, care and/or treatment, we ask that you provide as much information to us as you can.  You are of course free not to disclose information to us and you should only provide such information as you feel comfortable doing so.  Please bear in mind, however, that if you are only willing to share limited information, we may not be able to provide you with a full health assessment or the full range of care and treatment (as applicable), and that could mean being unable to see you at the hospital or clinic (since we may not be able to share your information in the way required in order to provide your health assessment, care or treatment, or run our business (for example, billing) and comply with our legal obligations).

CCTV

We use CCTV in various parts of our facilities. CCTV is used for the safety and security of our patients, health assessment clients, visitors, and staff. 

How your information and data is used?

• To ensure that you receive safe, effective and appropriate treatment
• To assist in decision making surrounding your care
• To ensure effective working with other organisations e.g. the Health and Social Care Trusts, who may be involved in your care
• To ensure that our services meet your current and any future needs
• To ensure that the care we provide is to the highest standard and can be reviewed as necessary
• To provide you with any goods and/or services that have been ordered
• To contact you with regards to any enquires that have been made
• Marketing activities for example to send you other Kingsbridge Healthcare Group information such as courses, newsletters or product releases that we feel may be of interest to you
• For Research and Audit purposes
• To prepare statistics on performance
• In order to train Healthcare Professionals and support staff
• To help us to establish, exercise, or defend legal claims 
• To collect payment

Kingsbridge Healthcare Group have successfully achieved the Cyber Essentials Plus certification. This accomplishment reflects our commitment to ensuring the highest standards of cybersecurity within Kingsbridge.

Cyber Essentials Plus signifies that we have undergone thorough independent testing and assessment, ensuring that our cybersecurity measures meet and exceed the essential security requirements.

What does this mean in practice?

• Improved Protection: Our systems are more robustly protected against common cyber threats.
• Heightened Security Measures: We have implemented strong security measures to protect against cyber-attacks.
• Commitment to Best Practices: Our commitment to best practices in cybersecurity is affirmed by this certification.
• Supplier and partner confidence: Current and future suppliers have confidence in our CE+ certification, knowing that we have strengthened our systems to meet and exceed industry standards in cybersecurity.

Who will your information and data be shared with?

To enable us to fulfil our duties and ensure that the best care possible is provide we will need to share information about you with others. We may need to share your information with a range of other parties including Health and Social care organisations and regulatory bodies. You may be contacted by any one of these organisations for a specific reason, the organisation will have a duty to be able to tell you why they are contacting you.

Where appropriate and in accordance with local laws and requirements, we may share your personal data, in various ways and for various reasons, with the following categories of organisations:

• Regulators – RQIA, MHRA
• Commissioning bodies – NHS, HSE
• Government agencies – DVLA, HMRC, PSNI
• National databases -e.g. PHIN, NHS England Breast Implant Registry
• Kingsbridge Healthcare Group employees and associates (see below)
• External companies necessary for the delivery of health assessment, treatment and care such as laboratories for blood or tissue testing and blood banks
• Other third-party service providers who perform functions and tasks on our behalf (including debt collection, external consultants, transcription services, business associates and professional advisers such as lawyers, auditors and accountants, technical support functions and IT consultants)
• Card payment processing
• Third-party outsourced IT and document storage providers

We will share your medical information with those involved in your health assessment, care or treatment (such as doctors, nurses and physiotherapists) for medical purposes (including the provision of health assessments).  Some of our nursing staff and the resident doctors in our hospitals are provided by specialist staffing agencies.  Consultants (such as surgeons, anaesthetists and radiologists) and their medical secretaries (not employees of KPHG).  We try to ensure there is a single patient record for each patient who is seen at one of our facilities, whether as an inpatient, outpatient or day case and we ask consultants working at our facilities to ensure a copy of their records, including consultation records, is included in each patient's records at the hospital.

We may also share relevant parts of your medical information with your GP, dentist, NHS hospitals, other private hospitals and the organisation paying for your treatment (for example your insurance company, embassy, employer or NHS commissioner).   For our health assessment clients who come to us through their employer's health assessment benefit scheme, please be assured that we will not share your medical information with your employer. 

We may share information about you with anyone you have asked us to communicate with or whose details you have provided as an emergency contact (such as your next of kin).

Where sharing patient information is shared with other organisations, an information sharing agreement will be drawn up to ensure that all information that is shared is done so in a way which complies with all relevant legislation. 

Where you have provided us with consent?

You may choose to opt in to receiving information about other services the Kingsbridge Healthcare Group offers by post or email.

In this case, your consent or decision to opt in is entirely voluntary.  Should you decide not to consent or opt in or should you change your mind at any time, you do not need to give a reason and your medical care and legal rights will not be affected.  You can opt-out by clicking on the 'unsubscribe' button in all our marketing communications. 

Apart from this limited instance, we do not hold or share information about you based on (or at least solely on) consent.

Where and for how long does Kingsbridge Healthcare Group store information about me?

The information about you that we hold and use is held securely and stored in paper format and on our secure servers. 

We retain your records for certain periods (depending on the particular type of record) under our retention of records policy.  This is to ensure that information is properly managed and is available whenever and wherever there is a justified need for that information, including to support patient care and continuity of care; to support evidence-based clinical practice and to assist clinical and other audits; to support our legitimate interests, and to meet legal requirements.  Your records may be transferred to an off-site storage provider. Your records may not be retained in hard copy form where a digital copy exists. 

If you would like more detailed information on this, please contact our Data Protection Officer (contact details below).

International Transfers

We (or third parties acting on our behalf) may transfer, store or process information about you in countries outside the EEA. Where this is the case we take the required steps to ensure that your personal information is protected.

What rights do I have?

Under certain circumstances, you have rights under data protection laws in relation to any personal information that we hold about you.

You will not have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request is clearly unfounded, repetitive or excessive. Alternatively, we could refuse to comply with your request in these circumstances.

We may need to request specific information from you to help us confirm your identity and ensure your right to access your personal information (or to exercise any of your other rights). This is a security measure to ensure that personal data is not disclosed to any person who has no right to receive it. We may also contact you to ask you for further information in relation to your request to speed up our response.

We try to respond to all requests within one month. Occasionally it could take us longer than a month if your request is particularly complex or you have made a number of requests. In this case, we will notify you and keep you updated.

If you wish to exercise any of the rights set out below, please contact the DPO using the contact details set out below. Details of your rights are set out below.

The right to access your personal information:

You have the right to ask us to confirm what information we hold about you at any time, and you may ask us to modify, update or delete such information. At this point we may comply with your request or, additionally do one of the following:

• You may be asked you to verify your identity, or we may ask you for more information about your request
• Where we are legally permitted or obliged to do so, we may decline your request, if this is the case you will receive an explanation why if we do so

The right to request correction of your personal information:

We take reasonable steps to ensure that the personal information we hold about you is accurate and complete. However, if you do not believe this is the case, you can ask us to update or amend it.

The right to request erasure of your personal information:

In some circumstances, you have the right to request the erasure of the personal information that we hold about you.  This is also known as the 'right to be forgotten'.  However, there are exceptions to this right and in certain circumstances we can refuse to delete the information in question. In particular, for example, we do not have to comply with your request if it is necessary to keep your information in order to perform tasks which are in the public interest, including public health, or for the purposes of establishing, exercise or defending legal claims.

The right to object to the processing of your personal information:

In some circumstances, you have the right to object to the processing of your personal information. However, there are exceptions to this right and we do not have to "pause" the processing of your information where, in particular, if it is necessary to keep your information in order to perform tasks which are in the public interest, including public health, or for the purposes of establishing, exercise or defending legal claims.

The right to request a transfer of your personal information:

In some circumstances, we must transfer personal information that you have provided to us to you or (if this is technically feasible) another individual/ organisation of your choice. The information must be transferred in an electronic format.

The right to object to marketing:

You can ask us to stop sending you marketing messages at any time and we must comply with your request. You can do this by contacting the DPO.

The right not to be subject to automatic decisions (i.e. decisions that are made about you by computer alone):

You have a right to not be subject to automatic decisions (i.e. decisions that are made about you by computer alone) that have a legal or other significant effect on you.

The right to withdraw your consent:

You have the right to withdraw your consent where we rely upon this as a legal ground for processing your information. You can do this by contacting our DPO.

The right to complain to the Information Commissioner's Office:

You have the right to complain to the Information Commissioner's Office if you are unhappy with the way that we have dealt with a request from you to exercise any of these rights, or if you think we have not complied with our legal obligations under data protection law.

Making a complaint will not affect any other legal rights or remedies that you have.

More information can be found on the Information Commissioner's Office website: https://ico.org.uk/ and the Information Commissioner's Office can be contacted by post, phone, fax or email as follows:

Information Commissioner's Office
Wycliffe House, Water Lane
Wilmslow, Cheshire
SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 9 (if you prefer to use a national rate number)

Fax: 01625 524 510

Email: casework@ico.org.uk

Contacting the Kingsbridge Healthcare Group and the Data Protection Officer

For further questions or to exercise any rights set out in this Privacy Notice, please contact Kingsbridge Healthcare Group’s Data Protection Officer:

Data Protection Officer
Kingsbridge Healthcare Group Admin Centre
Danesfort Building, 221 Stranmillis Rd
Belfast, BT9 5UB

Email: dpo@kingsbridgehealthcaregroup.com

Changes to the Kingsbridge Healthcare Group Privacy Policy:

Any changes to this Privacy Policy will be posted on our website (https://kingsbridgeprivatehospital.com/privacy-policy) so you are always aware of what information we collect, how we use it, and under what circumstances, if any, we disclose it. If at any time we decide to use Personal Data in a manner significantly different from that stated in this Privacy Policy, or otherwise disclosed to you at the time it was collected, we will notify you by email, and you will have a choice as to whether or not we use your information in the new manner.