Oxygens GDPR Statement

 

What is the GDPR?

The General Data Protection Regulations (GDPR) is effective since May 2018 and replaces the previous legislation about how data is secured and managed.  A key requirement under GDPR is an individual’s right to be informed regarding the collection and use of their personal data.

Oxygens is committed to protecting your confidentiality and respecting your privacy, and take our obligations under data protection legislation seriously.

What data do we hold?

Oxygens holds information about your personal information and health.  This may include your demographics such as name, address, date of birth, ethnicity and gender.  Medical information collected may include medical treatments including vaccinations, past medical history, health surveillance records, referral information, and specialist reports. We operate according to very strict internal guidelines, and always ensure that medical data is processed fairly, securely and lawfully.

Who do we collect data from?

Sources of data may include yourself or other medical service providers. We will seek your consent prior to requesting any data from your GP or any specialists involved in your care.

Why do we need the data?

We collect only the necessary and relevant personal and medical data to enable us to fulfill our obligations to you in the services we provide.  This includes for the purpose of supply of hyperbaric oxygen equipment and ensuring health & safety.

The data is also used to help Oxygens meet our legal obligations under the Health & Safety at Work Regulations.

Lawful Basis for processing the information

The main legal basis for processing your personal information is as below:

Article 6 (1) (f): processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

Article 9 (2) (a): the data subject has given explicit consent to the processing of those personal data for one or more specified purposes.

We hold and process your information in accordance with the Data Protection Act 2018 as amended by the GDPR, as explained above

We have a duty to:

– maintain full and accurate records of the care we provide to you,

– keep records about you confidential and secure,

 

– provide information in a format that is accessible to you.

Where do we store your data?

Your medical related data is stored in an electronic format on a highly secure database which can only be accessed with an authorized secure password by Oxygens personnel. Some data may be collected as a hard copy which is then scanned into the system.  All hard copy records are securely shredded and recycled by a reputable company, compliant with GDPR.

We keep minimal paper records, but any that we do, are kept locked in secure filing systems within the offices of Oxyegns.

The server is managed by an outside company, located within the UK, who have provided evidence of their GDPR compliance and the server is backed up regularly to a secure database network. 

Under Health and Safety at Work Regulations; data must be stored for a certain period. For example, data concerning the Control of Substances Hazardous to Health Regulations 2002 (COSHH) must be kept for 40 years.

As part of the essential data collection process we use Pandadoc, a secure web-based document management platform that allows users to create, send, track, and e-sign documents in a seamless and efficient way. 

All pandadoc collected data is encrypted at rest with AES-256 and sophisticated encryption keys management. Pandadoc is both HIPPA and GDPR compliant. Further details can be found at Pandadoc Security.

Our professional code

Anything that you tell or share with us about your health is confidential.  Our administration staff and consulting staff are aware of the strict guidelines related to your information.  What this means for you is that your health information remains confidential within the confines of Oxygens.

Communicating with you

We may connect with you in person, by telephone (work, home or mobile), by post (to your home address), by email (via a secure email address if you have provided us with one) or via text message for appointment confirmations.  If you would like to opt out of text message reminders, then please contact us at info@oxygens.co.uk. 

We may disclose data if necessary under the conditions listed below; if disclosure is necessary only minimum and relevant information will be released:

– we are legally obliged to do so;

– disclosure is made at your request or with your consent;

– in the event of a medical emergency;

– if necessary to prevent/control significant health and safety risks to yourself and/or others;

We will not share information about you with third parties without your consent unless the law allows us to.

Audits and reporting

As part of our continuous improvement process, we carry out audits of our records. The information taken is reported collectively, it is anonymised and no personal individual information is disclosed. If you have any concerns about this, please discuss with us.

Your rights

You have right to ask for a copy of the information we hold about you.  The request should be made in writing to info@oxygens.co.uk and should be responded to within 30 days, free of charge.

Concerns

If you have any questions or are concerned about how your personal data is collected or processed, please first raise your concerns with us directly on info@oxygens.co.uk

The right to complain

Oxygens employs a Data Protection Officer to check that we handle personal information in a way that meets data protection law.  If you are unhappy with the way in which we use your personal information please tell our Data Protection Officer at info@oxygens.co.uk.

 

You also have the right to complain about how we use your personal information to the Information Commissioner’s Office (ICO).  Details about this are on their website at www.ico.org.uk.