NCA Chinese Herbal Medicine Clinic Data Processing Agreement

This form describes how your personal data will be collected, processed and stored by NCA’s Chinese Herbal Medicine clinic. We ask you to read this so that you can give your informed consent to our use of your personal data.

HOW WE GATHER, USE & STORE DATA AT THE NCA CHINESE HERBAL MEDICINE CLINIC

This appendix was last reviewed in June 2023.

1. Introduction

The NCA Chinese Herbal Medicine Clinic needs to gather and use certain information about its patients.

This appendix to the main NCA policies (located at https://nca.ac.uk/the-college/college-policies/data-protection-policy) describes how this personal data will be collected, handled and stored.

1.1 Personal Data

NCA Chinese Herbal Medicine Clinic may hold data for the following purposes:

• Provision of direct healthcare
• Research (please see below)
• Newsletters
• Case histories (students, or teachers may draw from your patient information for their assignments, research or teaching, once all identifying details are removed)
• Contract administration

How We Obtain Your Personal Data

• Via your completion of a Chinese Herbal Medicine Patient Details and Informed Consent form;
• During a Chinese Herbal Medicine consultation (via an online video consultation);
• Via email, the use of online forms, or over the telephone;
• Exceptionally, by recording your online video consultation, if you give us permission to do so.

This includes the following information:

• name, address, date of birth, gender, contact details, GP name and address
• details of contact we have had with you, such as referrals and appointment requests
• health information including your previous medical history, lifestyle, dietary, supplement and medicine details, biochemical test results and clinic notes/recordings along with your herb prescriptions.

As this is a teaching clinic, students may draw from the information you give as a patient for their assignments and research, including MSc research projects, only once all identifying details are removed. During such research, your information may be viewed, again only once all identifying details are removed, by academic supervisors and assessors, who are under a duty of confidentiality. Research may be published in professional journals, though again, only once all identifying details are removed, so you will not be identifiable in any publications.

Our lawful basis for obtaining, storing and processing your health information is Condition (j) in Article 9 (2) of the General Data Protection Regulations (Archiving, research and statistics with a basis in law); and Condition (a) (Explicit consent) as given by you in the Chinese Herbal Medicine Patient Details and Informed Consent form. In completing this questionnaire, you are giving us permission to obtain, store and process your data as described in this document, for the purposes described above.

2. Responsibilities

Northern College of Acupuncture is the ICO (Information Commissioners Office) registered data controller for all personal data held by us.

3. Data Recording, Security and Storage

3.1 Data accuracy and relevance

NCA Chinese Herbal Medicine Clinic staff will ensure that any personal data we process is accurate, adequate, relevant and not excessive, given the purposes (above) for which it was obtained. We will not process personal data obtained for one purpose for any unconnected purpose unless the individual concerned has agreed to this or would otherwise reasonably expect this.

3.2 Data security

NCA Chinese Herbal Medicine Clinic will, as far as is reasonably possible, keep personal data secure against loss or misuse. Where other organisations process personal data as a service on our behalf, we will establish what, if any, additional specific data security arrangements need to be implemented in contracts with those third-party organisations.

All reasonable steps are taken to ensure staff and student NCA email accounts are secure and password protected.

3.3 Storing data securely

• In the case of historic data stored on printed paper, it is kept in a secure place where unauthorised personnel cannot access it. All historic Clinic paper records are archived in the locked attic room, with restricted access.
• Printed data will be put beyond use by shredding when we are no longer required to keep it. Digital data will be securely destroyed when we are no longer required to keep it.
• Digital records are stored on electronic portals which are only accessible to Herbs students and staff.
• Cloud services used to store personal data are compliant with GDPR principles.
• Data will be regularly backed up.
• All reasonable technical measures will be put in place to keep data secure.

3.4 Data retention

In accordance with the requirements of our professional body, the Register of Chinese Herbal Medicine (RCHM), the NCA Chinese Herbal Medicine Clinic will retain personal data for 8 years after the date of the last appointment with the clinic, or in the case of child patients, until that person’s 25th birthday. If a patient is age 17 at the time of the last appointment, the records will be kept until their 26th birthday.

The Office for Students (the regulatory body for all English higher education, which reports to Parliament through the Department for Education) requires that we retain all student assessments for 5 years and this includes some assessments where your information may be drawn on, again only once all identifying details are removed.

Exceptionally, we may wish to video a patient consultation, when the patient has given prior consent. Storage and use of any video will be in accordance with the consent given by the patient at the appointment which is being videoed.

4. Accountability and Transparency

NCA Chinese Herbal Medicine Clinic will ensure accountability and transparency in all our use of personal data.

We will regularly review our data processing activities and implement measures to ensure privacy by design including data minimisation, pseudonymisation, transparency and continuously improving security and enhanced privacy procedures.

5. Consent

NCA Chinese Herbal Medicine Clinic will ensure that consents are specific, informed and written in plain English such that individuals clearly understand why their information will be collected, who it will be shared with, and the possible consequences of them agreeing or refusing the proposed use of the data.

We will regularly review consents and seek to refresh them regularly or if anything changes.

6. Subject Access Requests

NCA Chinese Herbal Medicine Clinic will provide an individual with a copy of the information requested, free of charge. This will occur within one month of receipt. Any data being processed automatically can be provided when requested in a commonly used and machine-readable format.

If complying with the request is complex or numerous, the deadline can be extended by two months, but the individual will be informed within one month.

We can refuse to respond to certain requests, and can, in circumstances of the request being manifestly unfounded or excessive, charge a fee. If the request is for a large quantity of data, we can request the individual specify the information they are requesting.

Once a subject access request has been made, we will not change or amend any of the data that has been requested.

8. Transferring data internationally

We will not transfer personal data outside of the UK or the EEA unless by measures compliant with the General Data Protection Regulation.