Dr Ito Clinic
Privacy Notice, 17 June 2019
This notice sets out what, how and why we collect data and how we process data. This includes thelegal basis for processing information and what your rights are. We take our responsibilities very
seriously and we committed to complying with the Data Protection Act 2018. We are the Data
Controller which means we determine how we process the data. We process data on the legal basisof:
1. Legal obligation
2. Legitimate interest
Dr Ito clinic is owned and run by Dr Ito. We are a small clinic with less than 6 staff involved in theoperation of the clinic. We provide healthcare services regulated by the Care Quality Commission.
Because we provide service to Japanese speaking patients we hold records of information in Englishand Japanese.
We only ask for data when there is a specific purpose for the data. This notice refers to the different
types of data which includes data about patients we provide a service to, staff we employ andpeople who we contract with or share data with to help deliver our services.
To comply with the Data Protection Act 2018 (DPA) we must comply with the following principles
when collecting and processing personal information:
1. used lawfully, fairly and in a transparent way;
2. collected only for valid purposes that we have clearly explained to you and not used in any
way that is incompatible with those purposes;
3. relevant to the purposes we have told you about and limited only to those purposes;
4. accurate and kept up to date;
5. kept only for as long as necessary for the purposes we have told you about; and6. kept securely.
The type of information we collect is as follows:• Personal identifiers such as name, address, date of birth• Contact details including phone number and email address, where applicable.
• Financial information such as your payment card details• Your healthcare insurer or employer details where direct settlement / cashless medical
service is arranged• Support contact details: of your family, relatives and carers• Notes and reports about your health, treatment and care and results of investigations andtests• Any relevant information from other health and social care professionals, who are, or havebeen, involved in your care
• Details about you such as racial or ethnic origin, gender, occupation, lifestyle and social
circumstances, religion or similar belief• To investigate complaints, incidents or legal claims••

To prepare statistics on our performance in order to manage, improve and extend theservices we are able to provide to you
We might occasionally use your anonymised information for research with your explicit
consent

We can only use your data for proper reasons which are:
• For the purposes of delivering health care to patients• For research, with the proper permissions• For service planning and improvement purposes• For regulatory and public health purposes• For employment purposes
We will collect and record information about you from a variety of sources including:
1. from you directly ahead of your appointment and during the consultation and treatment
2. from anyone who has the authority to act on your behalf such as a power of attorney ordeputy
3. from healthcare professionals such as your GP, an organisation who refers you to us
There may be situations where we need to share your personal information with other individuals
and organisations outside of our service, for example if someone’s health or safety is at risk or if
we are required to by law. These may include:• Healthcare and social organisations: Where it is lawful and necessary to do so, we will share
information about you with other healthcare providers such as your GP, hospital staff. We
do seek your consent.
• Our regulators: We may share your personal data with these public bodies when we arerequired to do so by law.
• Police forces and other law enforcement agencies: In limited circumstances, we may berequired to share your personal data with the police if required for the purposes of criminal
investigations and law enforcement.
• IT support and other service suppliers: We might use external IT providers who may haveaccess to your personal data from time to time as is necessary to perform their services.
Our website does not collect any personal data from you.
How long we keep data
If we collect your personal information, the length of time we retain it is determined by several
factors including the purpose for which we use that information and our obligations under otherlaw.
For healthcare purposes, these records need to be kept for long periods of time. These periods areguided by the NHS Digital retention schedule for 2016.
We may need your personal information to establish, bring or defend legal claims. For this purpose,
we may retain your personal information after the date it is no longer needed by us for any of thepurposes listed under How we use your information above. The only exceptions to this are where:• the law requires us to hold your personal information for a longer period, or delete itsooner;• you exercise your right to have the information erased (where it applies) and we do notneed to hold it in connection with any of the reasons permitted or required under the law
Under certain circumstances you have the following rights regarding your personal information:

••
•
•••
•
•

Right to be informed -to be advised how your information is collected and used
Right of access –to request access to your personal information and information about how
we process it
Right to rectification –to have your personal information corrected if it is inaccurate and tohave incomplete personal information completed
Right to erasure (also known as the Right to be Forgotten) – to have your personal
information erased.
Right to restriction of processing – to restrict processing of your personal information
Right to data portability – to electronically move, copy or transfer your personal information
in a standard form
Right to object – to object to the processing of your personal information
Rights with regards to automated individual decision making, including profiling –rights
relating to automated decision making, including profiling

If you wish to exercise any of these rights please contact Kayo Koitabashi.
Complaints
You have the right to complain to the Information Commissioner’s Office (the “ICO”) if you are notsatisfied with the way we use your information, however we encourage you to contact us in the firstplace and we will endeavour to answer any questions and resolve any issues you have.
You can contact the ICO by writing to Information Commissioner’s Office, Wycliffe House, Water
Lane, Wilmslow, Cheshire, SK9 5AF.

For people we employ and job applicants
We hold and process data on current and former employees and apply the same principles andresponsibilities to this data. We use the same guidance for the retention of data as described above.
Data we may collect and process is:• Personal identifiers such as name, address, date of birth, National Insurance number, copiesof your passport/visa, professional registrations.
• Contact details including phone number and email address.
• Financial information such as your bank account details.
• Family and circumstances details such as emergency contact• Education and work history such as qualifications and skills• Information about your job and contract such as hours, dates, leave taken, salary• Information about your job performance such as performance appraisals and any
disciplinary/grievance procedures• Visual images such as photographs
Health and other special category information we may collect:• Details of any periods of leave related to health or family leave etc.
• Any health disabilities• Any offences and alleged offences, criminal proceedings, outcomes and sentences• Your fitness to practice in professions that are regulated• Details about you such as racial or ethnic origin, gender, sexual orientation, lifestyle andsocial circumstances, religion or similar belief, Trade union affiliations
We process some of your data
• For the performance of a contract of employment with you••To comply with a relevant legal obligation
In Dr Ito Clinic’s legitimate interest

We process some special category data for the performance of our obligations in relation toemployment.
Exceptionally we may process and share information about you in your vital interest, for example ina medical emergency.
We will collect and record information about you from a variety of sources including:• from you directly ahead of your employment and during the course of your job application• from you when you commence employment with us• from you during the course of your employment
Data we receive from third parties about you may include:• Referees• Organisations you have named as part of your application• HMRC• Pension scheme providers• DBS
Who we share your information with and why• Your manager in order to facilitate performance management• HMRC in order to meet our statutory obligation• Pension scheme providers in order to enrol you in a pension scheme and ensure
contributions are correct• DBS and its umbrella body when we need to perform criminal record check• The Home Office in connection with UK visas and immigration• When necessary the police or other law enforcement agencies• When necessary internal and external auditors• When necessary to third parties requesting a reference with your consent