Privacy Policy

OXFORD BRAIN AND MIND PRIVACY POLICY

This document provides information how Oxford Brain and Mind handles your personal information. Oxford Brain and Mind is a private medical provider specialising in psychiatric care on an outpatient basis and of psychological and neuropsychological assessments. The information that we hold is confidential and often sensitive in nature. Any personal information we hold about you is stored and processed under our data protection policy, in line with General Data Protection Regulation (Regulation (EU) 2016/679). We are committed to protecting your privacy at all times. Our privacy policy will be updated from time to time and up to date version of the privacy policy can be found at https://oxbam.co.uk/privacy

In this privacy policy “we”, “us” or “our” means Oxford Brain and Mind Ltd

Scope of our privacy policy

This privacy policy applies to anyone who interacts with us about our service in any way such as by email, or by phone and the policy describes how we handle your personal information, regardless of the way you contact us (by email, through our website or by phone). If you have any questions about this, please contact us using the postal or email address provided at the end of this privacy policy.

What information will we collect about you?

At initial contact we will ask for some personal information about you. This may include:

• Name
• Postal address
• Email address
• Telephone number
• Date of birth
• GP details
• Health insurance details (where applicable)
• NHS number
• If you are here for psychological assessment related to aviation then we may ask information from your current employer, information from your medical team at your employment, any relevant legal information and your current licencing status (if applicable).

Special category data

• We may process special category data about you when it is necessary to do so (i) for the purposes of preventative or occupational health, (ii) for the assessment of the working capacity of the employee, (iii) medical diagnosis, (iv) the provision of health,  social care or treatment, or (v) the management of health or social care systems and services.
• The special category data which we will need to process are racial or ethnic origin, the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.
• By providing us with special category data you confirm that you specifically consent to our processing of that data.

We may also ask for additional information, such as the difficulties currently  experienced by you, your family and details about your past medical history and any concerns and risks – this is classed as sensitive information and is necessary to enable us to offer the service you have sought from us. We may also contact your employer, if your employer has referred you for psychological assessment related to aviation filed.

We collect information about you when you complete the contact form on our web page. The contact form asks for your name, email address, telephone number and the reason for your enquiry. We need this information in order to respond appropriately to your enquiry. If you contact us by telephone or direct email, a record will be kept of that correspondence or conversation.

If our services are commissioned for you by third parties (your GP, local authorities, clinical commissioning groups, etc.) they will provide us with a variety of information, including your name, postal address, telephone number, email address and medical/educational history.

How do we use the information we collect about you?

We will use your personal information to provide the services you have requested from us. Collecting this data helps us to:

• Communicate with you so that we can inform you or remind you about your appointments with us (including by email, in writing or by text message)
• Deliver the correct service to you
• Conduct a thorough and appropriate assessment
• Invoice you/your insurance company for the services we provide (the electronic accounts package that we use keeps financial data/invoices indefinitely. We will manually delete the records after the period of 7 years required by HMRC)
• Communicate (when necessary and agreed with you) with relevant third parties to support your treatment and manage risk

Your information is shared with the appropriate staff members working with us and they understand their legal responsibility to maintain confidentiality and follow practice procedures to ensure this. We may also share your information with your GP, employer, Social Services, or other professionals. We will also share your personal information that we have about you to other service providers that we will refer to for further assessment and management of your condition. We will also pass your personal data to your health insurer (if applicable) if they are covering your appointments/ assessment expenses under a policy of insurance. If your health insurer is covering the cost of your appointments/assessments, we may need to share with them some of your personal data. We will ask for your consent to do this.

There may be instances when we need to share information such as, when there is a legal obligation for us to do so or when the information concerns risk of harm to the patient, or risk of harm to other. We will discuss such a proposed disclosure with you unless we believe that to do so could increase the level of risk to you or someone else.

We will not share your personal information with third-parties for marketing purposes.

Where do we keep the information?

• Paper-based patient records and notes are kept to a minimum and stored in a locked filing cabinet.
• Patient information is stored in our clinical software system, Cliniko. This is a secure password-protected database, which is compliant with General Data Protection Regulations.
• Access to your personal information is restricted on a ‘need-to-know’ basis only i.e. for those concerned directly with your care and with your account.
• Sensitive personal information will only be sent to patients by email if they have given prior consent for us to do so. Any computers or mobile devices containing personal information are password protected or protected with a passcode/thumbprint scanner.
• Data is backed up regularly.
• The data we retain is stored and processed in the UK, the EEA and elsewhere in the world where we and our third-party providers maintain facilities. By providing us with your personal information, you consent to the disclosure to these overseas third parties.

If you contact us via the website contact form or directly by phone or email, we will keep the information in an online filing system which is compliant with General Data Protection Regulations.

How can I see all the information you have about me?

You have a right to access the information that we hold about you and to receive a copy. You should submit your request in writing or by email. We will aim to provide the relevant data within 30 days and this may be subject to a small admin fee.

You can also request us to

• Correct any information that you believe is inaccurate or incomplete. If we have disclosed that information to a third party, we will let them know about the change.
• Erase information we hold although you should be aware that, for legal reasons, we may be unable to erase certain information for example, information about your medical treatment
• Stop using your information – for example, sending you reminders for appointments
• Supply your information electronically to another health professional

Consent
By consenting to this privacy notice you are giving us the permission to process your personal data specifically for the purpose outlined. Consent is required for Oxford Brain and Mind to process both types of data but it may be explicitly given. Where we are asking you for special category personal data as set out above, we will always tell you why and how the information will be used.  You can withdraw consent at any time by using the postal or email address provided at the end of this Privacy Notice.

How long will we keep your information?

We will process your personal data during the period of any service you receive from us and will continue to store only the personal data needed as set out in our data retention policy which is in accordance with the guidance provided by the British Medical Association. At the end of the relevant data retention period, all personal data relating to you will be deleted, unless otherwise required to be retained by us to meet our future obligations to you, such as erasure details. If you would like more information about how long we will keep your personal data, please contact us using the contact details at the end of this privacy policy.

Changes to this privacy policy

We keep this privacy policy under regular review and we will make any updates necessary on this web page. This privacy policy was last updated on 24^th December 2021.

Security and confidentiality

Unfortunately, email systems and use of the internet may be unsecure and you understand and acknowledge that you are accepting the inherent privacy risks associated with the use of email and the internet in relation to our services and the transfer of personal data. We put the security of our patients and clients and their personal data and information as a high priority.

How to contact us

Please contact us if you have any questions about this privacy policy, about the information we hold about you, or if you wish to make a complaint:

• Email –  connect@oxbam.co.uk
• Post – 107 Percy Street, Oxford, OX4 3AD
• You also have a right to make a complaint to the Information Commissioner’s Office (ICO) by Post: Wycliffe House, Water Lane, Wilmslow, SK9 5AF,  Telephone: +44 (0) 303 123 1113, website: https://ico.org.uk

What happens in the event of a data breach?

To prevent unauthorised disclosure or access to your information, we have implemented strong physical and electronic security safeguards. In the unlikely event of a data protection we will notify the Information Commissioner’s Office (ICO) so that their procedures can be followed. Breaches which carry any risk to data subjects must be reported to the ICO within 72 hours, together with a summary of the nature of the breach, the steps taken to reduce the risk to data subjects and measures to prevent the breach from happening again. We will also notify all individuals whose data may have been accessed to alert them to the breach and any potential risks.

Cookies

What is a cookie?

Cookies are small text files which are placed on your computer by websites you visit. They are widely used in order to ensure websites work efficiently, alongside providing insight about the volume of visitors to the website and how visitors move around the website. Cookies are sent automatically by websites as they are viewed, but in order to protect a user’s privacy, a computer will only permit a website to access the cookies it has sent, and not the cookies sent by other sites. Users can also adjust the settings on their computer to restrict the number of cookies that it accepts, or notify them each time a cookie is sent. For further information about cookies please visit www.aboutcookies.org

What sort of cookies do we use on our website?

There are a number of Cookies that are stored when you visit our website. These are used by us to monitor the performance of the website.

We use Google Analytics, a popular web analytic service, to analyse how users use the site. It counts numbers of visitors and tells us things about their behaviour overall, such as typical length of stay on the site or average number of pages a user views. We do not directly control these cookies. You can check Googles Analytics privacy policy here for more information: https://policies.google.com/privacy

Can I browse your website without receiving any cookies?

Cookies don’t stay around forever and your web browser will eventually delete them. When a website stores a cookie, it states how long the cookie should stay on the computer for – this can be for the current visit only or for a period of time, for example one week.

You can choose to delete our, or any websites’ cookies from your web browser at any time (for help on how to do this, go to www.aboutcookies.org. You can also set your web browser to not accept any cookies if you wish.

Please note that we only use cookies for the purpose of enhancing your online experience and no personal data is collected from you through this process.