How do we collect personal information?

We obtain personal information from you when you enquire about our services and activities as a potential client to one of our practitioners, register with us as a practitioner yourself, send or receive an email, make a donation to us, provide services to us, or otherwise provide us with your personal information.

We also gather general information about the use of our websites such as pages visited and areas that are of most interest to users. We use this information to improve our website and make it a better experience for everyone. For further information please see the cookies section below.

What personal information do we collect?

The personal information we collect might include name, address, email address, telephone numbers, date of birth, bank account details (for setting up regular direct debit or payment information) and your family relationships. Data Protection law recognises that certain categories of personal information are more sensitive. These are known as special categories of data and cover health information, race, religious beliefs and political opinions. We only collect special categories of data if there is a clear reason for doing so, such as where we need to ensure we provide the appropriate facilities or support.

Using our website

Cookies

A cookie is a small file which asks permission to be placed on your computer’s hard drive. Once you agree, the file is added, and the cookie helps analyse web traffic or lets you know when you visit a particular page on our site. Cookies allow web applications to respond to you as an individual. The web application can tailor its operations to your needs, likes and dislikes by gathering and remembering information about your preferences.

How we use cookies

We use traffic log cookies (Such as Google Analytics) to identify which pages are being used. This helps us analyse data about web page traffic and improve our website in order to tailor it to customer needs. We only use this information for statistical analysis purposes and then the data is removed from the system.

Overall, cookies help us provide you with a better website, by enabling us to monitor which pages you find useful and which you do not. A cookie in no way gives us access to your computer or any information about you, other than the data you choose to share with us.

You can choose to accept or decline cookies. Most web browsers automatically accept cookies, but you can usually modify your browser settings to decline cookies if you prefer, or to manage the types of cookies you will allow. This may, however, prevent you from taking full advantage of the website. As there are many different web browsers, please consult your own web browser settings to manage cookies. There are many online resources to tell you how to amend your browser’s cookie settings.

If at any time you change your mind about our use of cookies after accepting them, please consult your own web browser settings to manage cookies.

Cookies used on our websites

We use Google Analytics to monitor traffic levels, search queries and visits to this website. These cookies enable

us to determine whether you are a return visitor to the site, and to track the pages that you visit during your session. Third parties such as search engines, advertising organisations, and organisations whose content may have been embedded within website pages such as YouTube and social media networks may also use cookies over which we have no control. These are likely to be Statistics or Marketing cookies. You can amend the settings in your browser to limit third party tracking.

Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over external websites. Therefore, we cannot be held responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question. If you visit one of our pages that includes external content (e.g. YouTube), you may be presented with cookies from these websites; you should check these third party websites for more information about their cookies.

Why do we collect personal information?

We only collect the minimum amount of personal information required to fulfil the purpose for which it is collected. You may decide not to provide us with your information or to request that we stop processing your information at a later date, though this may affect your ability to participate in or benefit from some of the services offered by Brightstone Clinic. Personal information which we collect from you may be used in a number of ways including, but not limited to:

• Replying to an enquiry you have made via phone, text, email or post
• Sending you information about Brightstone Clinic, our services, practitioners and our events
• Creating a record of a donation you have made or processing a regular gift
• Reclaiming Gift Aid on donations from HM Revenue and Customs
• Registering you to participate in a fundraising activity
• Carrying out our obligations arising from any contracts entered into by you and us
• Seeking your views/comments on the services we provide or activities we undertake
• Notifying you of changes to our services, events or activities

Brightstone Clinic will only process your personal data where we have a legal basis for doing so as stipulated by current data protection and privacy legislation, namely:

• Where we have your explicit consent (see below)
• In order to comply with a legal obligation
• When performing official functions or tasks in the public interest
• If it is in your or somebody else's vital interests
• To fulfil contractual requirements
• When to do so is in our legitimate interests (see below)

Consent

Consent means offering you a real opportunity to state whether or not you wish to allow the processing of your personal information. When processing your information on the basis of consent, we will ensure you are fully aware of what you are consenting to and only use your information for that purpose. You can withdraw your consent at any time using the contact details above.

Legitimate Interests

Brightstone Clinic may undertake data processing in pursuit of our legitimate interests, where to do so will not infringe your rights or interests as the data subject. To ensure this is correctly assessed, we undertake a balancing exercise to ensure that our processing does not adversely impact you. In the case of the following data processing activities, we have determined that the processing of your information for these purposes is lawful and legitimate:

Sending communications to you via email or the post about our work

Recording your contact details to enable us to make appropriate referrals

or to be able to provide services to you

or to be able to receive services from you

You have the right to object to the processing of your personal information on the grounds of legitimate interests as detailed below in 'Right to object'.

Who do we share personal information with?

We will not share your information with third parties for marketing purposes and will not sell or rent your information to third parties.

How do we protect personal information?

We take appropriate physical, electronic and managerial measures to ensure that we keep your information secure, accurate and up to date, and that we only keep it as long as is reasonable and necessary.

How long do we keep personal information?

We review our retention periods for personal information on a regular basis. We are legally required to hold some types of information to fulfil our statutory obligations. We will hold your personal information on our systems for as long as is necessary for the original purpose, or as long as is set out in any relevant contract you hold with us.

What are your rights regarding your personal information?

Under the Data Protection Act 1998 and the General Data Protection Regulation, which came into force on May 25th 2018 you have the following rights:

The right to access your personal information

You may obtain a copy of the personal information we hold about you by submitting your request to the contact details above. We will reply within one month of receipt of your request unless there is a compelling reason to extend this response time. We may refuse a request in certain circumstances, in which our justification will be communicated to you.

The right to be informed

You have the right to be informed about the collection and use of your personal data by Brightstone Clinic.. Details of the types of information we collect, the purposes for which it is collected, who we share the information with and how long we retain it are detailed in this privacy policy which is updated periodically and always accessible via The Brightstone Clinic website.

The right to rectification

You have the right to have any inaccurate personal information that we may hold for you rectified (corrected) and to request that any incomplete information be completed. You can make your request using the contact details above. If we accept that your information should be rectified, we will do so within one month. In certain circumstances, we may refuse a request if we consider the request to be unfounded or excessively repetitive.

Right to erasure

You can request that the information we hold about you be deleted by contacting us using the details above and we will respond within one month. The right to erasure applies if:

• We no longer need your information for the purpose for which we collected it
• Our processing of your information is based on consent, and you withdraw that consent
• Processing of your information is based on legitimate interests, and you successfully object
• You object to the use of your personal information for direct marketing purposes
• Your information has been processed unlawfully
• We have a legal obligation to remove your personal information.

In certain circumstances, we may refuse a request for erasure if we consider the request to be unfounded or excessively repetitive, or if any of the specific provisions of the current data protection legislation apply.

Right to restrict processing

You can make a request for information we hold about you to be suppressed (to be stored but not used) in the following circumstances:

• You have contested the accuracy of the information we hold and we are investigating
• Your information has been unlawfully processed but you want to restrict it, not erase it
• You want us to keep your information after we need it in support of a legal dispute
• You have objected to our processing of your information and we are investigating.

You can make your request using the contact details above and we will respond within one month. In certain circumstances, we may refuse a request to restrict processing of your information if we consider the request to be unfounded or excessively repetitive.

Right to data portability

The right to data portability gives you the right to receive the personal information you have provided to us in a structured, commonly used and machine readable format. It also gives you the right to request that we transfer it directly to another controller. This only applies to information stored electronically, provided directly by you and which we process based on your consent.

Right to object

You have the right to object to the processing of your personal data in certain circumstances. In the case of direct marketing, this is an absolute right. In other circumstances, we may continue the processing if there is a compelling reason for doing so, or if we consider the request to be unfounded or excessively repetitive. You can make your request using the contact details above and we will respond within one month.

Rights related to automated decisions and profiling

Brightstone Clinic does not conduct any automated decision making or automated processing/profiling.

What should you do if you have a complaint?

If you have a complaint concerning Brightstone Clinic’s processing of your personal data, you can contact us using the information above. Data Protection legislation also gives you the right to lodge a complaint with a supervisory authority. More information can be found on the Information Commissioner’s Office website at www.ico.org.uk.

Brightstone Clinic is registered with the ICO and our Reference Number is CSN5922864.