PLEASE READ THIS STATEMENT CAREFULLY TO UNDERSTAND HOW OND, USES AND STORES YOUR PERSONAL DATA.

Privacy Policy for the Omnia Neuro Discovery (“OND”)

This notice applies to our clients who are being treated by us under the OND Programme.

We may update this notice at any time but if we do so, we will provide you with an updated version of this notice available on our website as soon as reasonably practical. It is important that you read and retain this notice so that you are aware of how and why we are using such information and what your rights are under data protection legislation.

We may collect, store and use the following categories of personal information about you:

• Personal contact details such as name, title, address, telephone numbers and personal email addresses, contact preferences.
• Date of birth.
• Marital status and dependants.
• Next of kin and emergency contact details.
• National insurance number and NHS number.
• Bank or credit card details or other payment information.
• Identification information contained within your passport and/or driving licence or proof of address.
• Online identifiers or social media identifiers.
• Information about your status, nationality and residency.
• We may also handle the following special categories of sensitive personal information:

Information about your race or ethnicity, religious, philosophical and moral beliefs, sexual life, sexual orientation and political opinions.  

• Trade union membership.
  Information about your physical and mental health, including any medical conditions.
• Identification information containing biometric data such as a passport.

How we collect your personal information

As part of your treatment, and whilst taking initial details from you to ascertain whether you are suitable for treatment, we may collect personal information directly provided by you. We may collect, store and use your personal information during your time in our care. We may also collect, your personal information from third parties such as the NHS, commissioning authorities or through your private medical insurer (and for funding and/or payment for services received).

How we will use your personal information
In most cases, OND will use your personal information to provide you with treatment. In rare cases, we may need to use your personal information to protect your (or someone else’s) interests or if it is in the public interest for us to do so.

We may share this personal information with OND employees and Consultants but it will always use it in accordance with this Privacy Notice. We may also combine it with other information to provide and improve our services.

We will only use your personal information when the law allows us to. We will use your personal information in the following circumstances:

• Where you have provided us with your consent
• Where we need to comply with a legal obligation
• Where it is necessary for legitimate interests pursued by us or a third party and your interests and fundamental rights do not override those interests.
• We may also use your personal information in the following situations, which are likely to be rare:

Where we need to protect your interests (or someone else’s interests.)Where it is needed in the public interest or for official purposes.
Some of the above grounds may overlap and there may be several grounds that justify our use of your information.

The situations in which we will use your personal information include:

• Provide services to you.
• Facilitate settling of any applicable fees.
• Helping us develop, operate, deliver, and improve the quality of the care we provide or, more generally, the type of services that we offer.
• Sending important notices to you or to those acting on your behalf, such as updates to your care and/or treatment plans or changes to our terms, conditions and policies.
• For security and health and safety purposes, such as use of our CCTV systems.
• For internal purposes such as auditing, data analysis, and research to improve our services and our communication with you.
• To test our computer systems to improve our services to you such as the software we use to store your health, social and care records to improve our services. If you do not wish for your information to be used for these purposes, you can let us know.

We process sensitive personal information for the following purposes:

• To provide you with physical or mental health care, social care or treatment
• Safeguarding reasons.
  For legal reasons, for example, to comply with health and safety obligations or to respond to requests for information from the police.
• We will not sell, share or give information to any third parties for marketing purposes.

What happens if you fail to provide personal information
The personal information we collect is stored in a variety of paper and electronic forms. Regardless, we have appropriate and adequate technical and administrative processes in place to make sure that all your information is kept secure.

How changes of purpose will be managed
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated purpose, we will publish an updated Privacy Notice on our website.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Why might we share your personal information with third parties
We will only share your personal information with third parties where required by law, where it is necessary to be able to provide you with the health, social care or treatment you require, to protect your interests (or someone else’s interests) or where we have another legitimate interest in doing so.

What type of third parties service providers’ process your personal information
“Third parties” includes but is not limited to third-party service providers (including IT software providers).

When we use third party service provider to process personal data on our behalf, we require them to commit to compliance with relevant data protection legislation.

Commissioning authorities: If our services are commissioned for you by third parties (your GP, local authorities, provider trusts, local systems, private medical insurers etc.) we may be required to provide some information about you to them including your name and contact details such as: postal address, telephone number, email address and physical or mental health history for the purposes outlined above.

How we may share your personal information with third parties
We may also share your personal data with other third parties.

Sale or restructuring. We may need to share your personal information if a sale or restructuring of all or part of OND. In this situation we will, so far as possible, share anonymised data with the other parties before the transaction completes. Once the transaction is completed, we will share your personal data with the other parties if and to the extent required under the terms of the transaction.

Request from a regulator or otherwise to comply with the law. We may also share your personal information: (i) with a regulator; (ii) to comply with the law; or (iii) in other circumstances when we are legally permitted to do so. This may include making returns to HMRC and disclosures to any other regulatory bodies which have authority over OND, our professional advisers (such as lawyers, auditors, immigration advisors etc.), disclosures to shareholders such as directors’ remuneration reporting requirements and to such third parties as we reasonably consider necessary in order to prevent crime.

How long will we use your information
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other mean, and the applicable legal requirements.

In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you. Once you are no longer a client we will retain and securely destroy your personal information in accordance with our retention policy, applicable laws and regulations.

How we store your personal information
The personal information we collect is stored in a variety of paper and electronic forms. Regardless, we have appropriate and adequate technical and administrative processes in place to make sure that all your information is kept secure.

Protection of your personal information
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those of our employees, workers or contractors and other third parties who need to access it to provide services to you. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Accuracy of personal information
If any of your information changes please let us know so that we can update our records.

Access to personal information
You are entitled to see what personal information we hold about you at any time. This Privacy Notice outlines the information we hold about you and why. If you wish to access your personal information, please contact us at info@omnianeurodiscovery.com

We are not required to process any request for access which is frivolous or vexatious, jeopardizes or otherwise affects the privacy of others, are impractical,

or for which access is not otherwise required by law. We will let you know in writing if any of these circumstances apply to your request.

Data portability
You may have a right to data portability under the UK GDPR (General Data Protection Regulation.)

The right to data portability allows you to obtain and reuse a copy of your personal data for:

your own purposes; or
for us to send the information to a new provider on your behalf (where technically feasible).
It allows you to move data, copy data and transfer data.

The right to data portability ensures that it is done in a safe and secure way without affecting its usability. However, it will only apply to information concerning you which you have provided to us and where it is held electronically (so does not include paper records).

This may include data such as:

• Username
• Email address
• Website or search usage history
• Traffic and location data

You can make a data portability request verbally or in writing when we are processing your information:

By automated means and rely on your consent to use your personal data; or
When we use your data as part of a contract you have with us.
We will ensure that we provide your information in a ‘structured’, ‘commonly used’ and ‘machine-readable’ format.

You can find further information on the Information Commissioner’s Office website: https://ico.org.uk/your-data-matters/your-right-to-data-portability/

If you would like to make a data portability request please email info@omnianeurodiscovery.com. Please note that as part of the process we may be required to verify your identity.

We will aim to respond to your request within a month but may respond within a further two months if the request is complex or we have received a number of requests from you.

Additional rights
You may also have the right to:

Object to processing of personal data that is likely to cause, or is causing, damage or distress
Prevent processing for the purposes of direct marketing
Object to decisions being taken by automated means
In certain circumstances, have inaccurate personal data rectified, blocked, erased or destroyed
Data portability
If you believe you have any of these additional rights or you wish to exercise them, please let us know.