Privacy notice

Ascenti will process two categories of personal information about you:

• Personal Data and
• Special Category Data (e.g. Health Data)

In this Privacy Notice we use the terms;

“Personal Data” for Personal Data
“Special Category Data” for Special Category Data
“Data” for both categories

This Privacy Notice applies to anyone whose data we process, including our service users and visitors to our website, but does not apply to:

• Our employees and prospective employees. Handling of their Personal Data is governed by our employee and recruitment privacy notices (our recruitment notice can be found here: www.ascenti.co.uk/recruitment-privacy-statement)
• Services we provide to others as a data processor of Personal Data which will be governed by a written agreement with the third party data controller and their own privacy policy.

We may change this Privacy Notice from time to time, so please check back regularly to keep informed of any updates. This version of the Privacy Notice (version 8) was updated on 4 July 2024.

Firstly, some information about us;

We are Ascenti Health (Company Number 04530716) and Ascenti Physio (Company Number 03225768) which are both companies under the Ascenti Group. Our registered office is Carnac House, Cams Hall Estate, Fareham, Hampshire, PO16 8UZ.

The Ascenti Group incorporates a number of companies. Advo Health Limited, Ascenti Health Limited, Lacoda Limited who trade as BWT Physio, Six Physio Limited and Purple Physio Limited.

Data Protection Officer: The DPO Centre Limited

Privacy queries: dpo@ascenti.co.uk
 

Ascenti is committed to protecting and respecting your privacy. Any decision we make regarding data will have considered the 6 principles for processing personal data contained in Data Protection Legislation.

Data Protection Legislation means the Data Protection Act 2018 (DPA 2018), United Kingdom General Data Protection Regulation (UK GDPR), the Privacy and Electronic Communications (EC Directive) Regulations 2003 and any legislation implemented in connection with the aforementioned legislation. Where data is processed by a controller or processor established in the European Union or comprises the data of people in the European Union, it also includes the EU General Data Protection Regulation (EU GDPR). This includes any replacement legislation coming into effect from time to time.

The Information Commissioner’s Office (ICO) is the UK supervisory authority for data protection issues. More information regarding processing principles, as well as information on our additional data protection obligations, can be found on the ICO website .

Personal Data means any information about you from which you can be identified. The data we collect depends on the nature of the services we are providing but can include:

• Basic details such as name, address and contact details;
• Details of contact we have had with you throughout your treatment with us;
• Professional information (such as job title, qualifications, previous experience and NI number);
• Details of the services you have accessed;
• Information you have provided to us or those working on our behalf during appointments or otherwise in the provision of our services, such as information about your health, mental health and lifestyle;
• Treatment notes and reports about your health/mental health and any treatment you have received;
• Your feedback and treatment outcome information;
• Information surrounding complaints and incidents which may have arisen;
• Recordings of inbound and outbound telephone calls;
• Recordings of video consultations;
• Information provided when using our digital services, including our online triage tools and our health applications (‘apps’);
• Details of visits to our website (including your IP address, login information, and other analytical information). Please refer to our Cookie Policy for more details; and,
• Any other Personal Data we collect in the course of providing our services or in the course of operating our business.

Your data may be collected:

• From you in person (e.g. at an appointment with one of our clinicians, or at an event);
• By telephone;
• By correspondence (including post, text, email or otherwise);
• Via our website or online portals (e.g. when submitting an enquiry on our contact form);
• Via CCTV footage collected by us and/or our buildings’ landlords;
• Via our digital services such as our online triage tools, health applications and video-calls;
• From third parties, such as:
  • Instructions received from your solicitor, or another instructing party;
  • Your doctor, or other previous healthcare providers;
  • Your employer;
  • Other companies who have obtained your permission to share information about you, have an identified lawful basis for doing so and who are responsible for the costs of the treatment.

In general we use your data to provide our services to you, including the following specific purposes:

• Responding to your initial queries and requests for further information about Ascenti, including quotes;
• Sending you your service related information;
• Supporting you through your treatment journey, including telephone support;
• Decision making by the healthcare professionals involved in your treatment;
• Record keeping and administration purposes;
• Quality, risk management and training purposes;
• Compilation of statistical data (Personal Data will not be published or passed on without consent);
• We want to hear what you think and your contact information may be used to provide an option to complete a satisfaction survey;
• To facilitate marketing and business development; only with your consent.
• To allow the billing of services provided and to obtain payment;
• To process and respond to any complaints, concerns, incidents or safeguarding issues;
• To investigate/ provide feedback to relevant persons and to use our lessons learned to improve our processes;
• To share job opportunities with those that show an interest via career alerts, to identify suitable candidates for our graduate scheme and to drive recruitment;
• For training purposes, where relevant;
• To comply with any other legal, professional or regulatory obligations imposed on us; and,
• To audit our services and the use of our websites.

We rely on the following legal reasons for processing your Personal Data:

• Contractual necessity: We will process your Personal Data when it is necessary to perform a contract you have entered into, or in order to take steps at your request prior to entry into a contract.
• Legal obligation: We will process your Personal Data when it is necessary to comply with a legal or regulatory obligation (e.g. identity checks, external auditing)
• Consent: Where we require consent to process your Personal Data we will specifically request this from you (verbally or in writing) and provide information on the purpose of that processing. If you have given consent, you can change your mind at any time and withdraw it by contacting us.
• Legitimate interests: We will process your Personal Data when we, or a third party, have a legitimate interest in processing it (e.g. responding to complaints, ensuring our business policies are adhered to, or improving our business by monitoring and recording information relating to our services). We only process for this reason if the legitimate interest is not overridden by your own interests or fundamental rights or freedoms. Please contact us if you would like more information on our, or a third party’s, legitimate interests and the balancing test we use to ensure processing is lawful.
• Vital interests: In rare instances, we may need to process your data to protect your vital interests, for example, if you are taken ill whilst at one of our clinics.

As a provider of healthcare services and assessments, our clinicians are under a legal requirement to document your treatment. These treatment notes will necessarily include data pertaining to your health which is defined as ‘special category data’. Further to the legal grounds for processing above we will process this data special category data on the basis:

• That it is necessary for medical diagnosis and the provision of health care services - processing of this data will be done by professionals under a common law and contractual duty of confidentiality; or
• Consent to process your health data, for example where our digital services such as our online triage tools and health applications (‘apps’) use your health data to make automated decisions based upon health data you provide. If you have given consent, you can change your mind at any time and withdraw it by contacting us.

In certain circumstances where we need to process ‘special category data’ in the context of our services but outside the scope of our services, for example, in order for us to audit the quality of our service, for the establishment, exercise or defence of legal claims or in the public interest in the area of public health, such as protecting against cross-border threats to health or ensuring high standards of quality and safety of health care.

Our use of automated decision making: Our digital services such as our online triage tools and health applications (‘apps’) are programmed to make automated decisions based upon personal and health data you provide. This automated decision making allows us to recommend treatment that we consider is most likely to benefit you based on the information that you provide. These decisions about your treatment are based upon clinically developed algorithms. The data you provide will determine the type of treatment that is recommended. The benefit of automated decision making is to provide innovative and accessible healthcare services to users. The algorithms informing automated decision making are reviewed at least annually, and we may look at your personal and health data in different ways to help us understand more about you and people like you with similar or differing health presentations (we call this ‘profiling’). Profiling helps us to evaluate and improve our services and the clinical algorithms we use, which we can then use as factors within in our automated decision-making process. You have rights relating to automated decision making and profiling, please see the ‘your rights’ section below.

We will only use your Personal Data for the purpose, or purposes, for which we have obtained it. If we reasonably consider that we need to use it for another reason we will only do so if that reason is compatible with the original purpose. If we need to use your Personal Data for an unrelated purpose, we will inform you and explain the legal basis which allows us to do so.

We may process your data without your knowledge or consent where this is required by law.

Please contact our DPO using the details above if you would like further information on the exact lawful basis for any specific data processing activity.

We will share your data with carefully selected third parties when:

• You specifically request it, or a disclosure is required in order for us to provide our services and/or fulfil our contractual obligations to you;
• We are under a legal or regulatory duty to disclose your information; or,
• As a result of any changes in business ownership or organisation.

Ascenti may share your personal information, where required and to the extent permitted and on which we have a lawful basis, with:

• Any member of our group (e.g. our holding company).
• Any 3rd party who provides your treatment (where we do, we will ensure that they process information in accordance with our confidentiality and security requirements).
• Any application utilised for the provision of services (e.g., online triage and health applications) such as Physitrack,
• Solicitors, Insurers, or any other instructing party;
• Third party NHS providers to support your health and care arrangements, including referrals, pathology and other results within NHS services;
• Integrated Care Initiatives with the NHS (e.g. EMIS Health);
• Our auditors and external accreditation bodies;
• Law enforcement agencies and regulators (e.g. CQC);
• Parties contracted to provide accounting / finance service, including, for example, our auditors and advisors;
• Public bodies;
• Our external service suppliers who provide business support services (including IT, security, building maintenance, archiving, data storage, sales and marketing, communication platforms and workflow management);
• Analytics and search engine providers who assist in improving our website; and,
• Any other third party you may ask us to share your data with.

Where our professional duties of confidence as medical clinicians require that we seek your consent before sharing your Personal Data with a third party, we will do so. Such consent has a different legal basis to consent for the purposes of EU/UK privacy law and seeking consent further to our professional duties will not therefore affect the basis of processing in privacy law. The processing under privacy EU/UK privacy law will be on the bases as set out above.

Ascenti will not typically transfer any of your data outside of the UK or EEA.

If we do have occasions to transfer your data outside of the UK or EEA to countries not deemed by the ICO (and/or European Commission as relevant) to provide an adequate level of personal information protection, the transfer will be based on safeguards that allow us to conduct the transfer in accordance with the data protection legislation, such as the specific contracts approved by the ICO (or European Commission as relevant) providing adequate protection of personal information.

Ascenti has in place physical, electronic and operational procedures intended to safeguard and secure the information we collect. These measures are updated as necessary and audited on a regular basis.

How long we retain your data for will vary from matter to matter but will be determined in accordance will the following criteria:

• The length of time necessary to complete our contract with you;
• Any time limits for establishing or defending legal claims or responding to complaints/incidents;
• Any period necessary to comply with our legal obligations under EU/UK law; and,
• Any periods for retention that is recommended by regulators or professional bodies.

Ascenti provide healthcare services; as such there is a legal and regulatory obligation for records to be kept for a minimum period of time. We will typically keep your data processed in connection with these services for a period of 10 years, after which time it will be destroyed, if it is no longer required for the lawful purposes for which it was obtained. Closed files are archived after 6 months resulting in restricted access and additional security.

You have the right to obtain confirmation from us as to whether we are processing your Personal Data and, if we are, to request a copy of the Personal Data we hold about you. This is known as a ‘subject access request’.

If you wish to make a subject access request, please request this at SAR@ascenti.co.uk 

For all other types of data subject rights requests (below), please email dpo@ascenti.co.uk

You also have the right to ask that we update any information we hold about you that may be incorrect. It is important that the information we hold about you is accurate and up to date. If any of your personal information changes please let us know.

In certain circumstances you have the right to request that we restrict the way in which we process your data, or that we erase all personal information that we hold about you.

You have the right to object to certain types of processing.

We will try our best to comply with any request to restrict, object or erase your data, however processing of some data may still be required for legitimate business purposes or to comply with legal obligations. Please note that if you want us to restrict or stop processing your data this may prevent us from providing our services to you.

You have the right to request that we send a copy of your data, that you have provided to us, to another organisation for your own purposes (e.g. if you wish to change service provider). This data must be provided in a structured and usable format. This right only applies to Personal Data processed by way of consent or in pursuant to our contract with you. If you wish us to transfer your Personal Data in accordance with this right please let us know.

You will not have to pay a fee to access your Personal Data or to exercise any of your other rights. However we may charge a reasonable fee should your request be clearly unfounded, repetitive or excessive. In order to prevent unauthorised access to information we may ask for proof of identity. We will do our best to respond to your request within one month, however if that is not possible due to the number or complexity of requests we will notify you and keep you updated.

As part of the processing of your personal and health data, decisions may be made by automated means using clinical algorithms. An automated decision is one that is made by our systems rather than a person. Under data protection laws, you have the right to:

• Express your concerns and object to a decision taken by purely automated means; and
• Request that a person review that decision.

If you would like us to review a decision we have made about you, such as a recommendation for a treatment pathway, please contact us.

Where you have used our digital services such as our online triage tools and health applications (‘apps’) and we have used your personal and health data to create a profile of you, your right to request a copy of the Personal Data that we hold about you includes not only the Personal Data used to create the profile but also the information on that profile itself. Where there are any inaccuracies in the profile (or the information that we have used to create that profile) you have the right to ask that we update the profile or any information we hold about you that is incorrect.

For further information on your rights, please visit https://ico.org.uk/for-organisations/data-protection-reform/overview-of-the-gdpr/individuals-rights/ 

If you wish to raise a query on how we have handled your Personal Data you can contact our Data Protection Officer using the details above.

You have the right to raise a concern at any time to the Information Commissioner’s Office (“ICO”) who is the UK supervisory authority for data protection issues. However, we hope that you would consider raising any concern you have with us first. Your satisfaction is extremely important to us, and we will always do our very best to solve any problems you may have. For more information on submitting a concern to the ICO, or the data protection regime in general, please visit the ICO’s website.