From the 25th May 2018, the EU General Data Protection Regulation (GDPR) comes into force.

• GDPR is designed to harmonise data privacy laws across Europe and enhance the protection of your personal data.
• Personal data is any information concerning a living person which is not already available in the public domain.

This page summarises what personal information we gather, why we gather it, and your rights over this data. It was last updated on Thursday 24th May 2018.

Indigo Spring diagnoses and treats health conditions and provides massage and other complementary therapies.

We are a full member of the Federation of Holistic Therapists (FHT) and abide by the FHT Code of Conduct in Professional Practice.

In order to provide tailored, safe, effective treatment and evaluate your treatment progress, we keep full and accurate records of all clients including:

• contact details,
• medical history,
• current health and medical status,
• current and previous treatment details,
• records of all treatment sessions.

We will ask for this information at your initial consultation on the legal basis of legitimate interest. When you sign our consent form at the initial consultation, you agree to keep us updated as to any changes in your health or medical condition on the same legal basis. You can refuse to provide this information, but we will be unable to treat you unless the information has been provided.

Any additional personal information you choose to give us is on the legal basis of consent, and you may ask us not to make a written notes of this additional information.

All information that you give us during any consultations, whether or not it is recorded, is considered private and confidential. We will not share any of this information without your express permission except where there is a risk of death or serious harm to you, us or others. In these cases, information will only be disclosed to the relevant and proper authorities (e.g. police, doctors, court, social services).

Children under the age of 16 will only be treated with the written consent of a parent or legal guardian. This written consent includes the consent to process the child’s personal data.

Your client notes are kept on paper only in secure premises and only accessed by your therapist.

Brief details including:

• Your name,
• Email address,
• Phone number,
• Treatment type,
• Appointment dates and times,
• Membership level

are kept digitally in a password protected format using Google Calendar and Google Drive.

No medical, health information or other special or sensitive data (e.g. racial or ethnic origin) is kept digitally.

We analyse data kept digitally to better understand our customer base and make informed decisions on how best to improve marketing, customer service and our professional development.

In accordance with the FHT Professional Code of Conduct and our Insurance conditions, we are obliged to hold your data for a minimum of 10 years after the date of your last appointment. In cases where there is a legitimate cause for concern (e.g. an adverse reaction to treatment) then records may be kept indefinitely. If you are below the age of 18, your records will be kept for at least 10 years after you reach the age of 18.

You may ask us to delete your records after this 10 year period and they will be disposed of securely in a manner that preserves confidentiality.

Contact details provided by you, such as:

• Telephone numbers,
• Email addresses,
• Postal addresses,
• Social Media identities (e.g. Facebook Messenger),

may be used to remind you of future appointments and provide reports or other information concerning your treatment.

For marketing purposes, we may also use these details to respond to your enquiries including making telephone contact or sending information electronically which we believe may be of interest to you. We will not sell or broker your data to third parties.

By providing these contact details to us and signing our consultation form, you consent to us maintaining a marketing dialogue with you unless you choose to opt out (which you can do at any time by contacting us by email, phone or post).

Note that some basic personal data may be collected about you through your use of our website including completion of online forms. This may include personally identifying information such as your Internet Protocol (IP) address. Our website uses cookies, which are strings of information stored by the website on your computer, which your computer provides to the website each time you access it. These cookies help us identify and track visitors and your website access preferences. You can set your browser to refuse cookies before using our website if you do not wish these cookies to be placed on your computer.

You have the following rights in regard to your personal data:

The right to know how your information will be held and used (this notice)

The right to access your personal information:

• You can request a copy of all the information we hold about you via the contact details above.
• For information held on paper, we will provide a scanned copy to you via email or post.
• For information kept digitally, we will provide screenshots or a digital text file via email.
• We will provide the information within one month of your formal request.

The right to correct or remove information that is inaccurate:

• Please contact us or discuss the changes directly with your therapist who will update your information.

The right to erasure of any information held about you:

• Subject to our professional and insurance obligations, we will securely delete your data upon request.

The right to restrict processing of personal data, or object to its use:

• You may contact us to remove your consent or limit how we use your data for marketing purposes.

The right to complain about the processing of your personal data:

• Please contact us in the first instance and we will try to resolve any situation quickly and to your satisfaction.
• You may also complain to the Information Commissioner’s Office (ICO) at www.ico.org.uk.

Full details of your rights can be found at https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/

Please note that we have the following rights in regard to your personal data:

• If you don’t agree to us keeping records about you and your treatments, or you don’t allow us to use the information in the way we need to for your treatment then we may not be able to treat you.
• We are obliged to keep your records of treatment for a certain period of time and this may mean that even if you ask us to erase them, we may have to keep them until the mandatory retention period has passed.
• We can move your data between our computers and IT Systems provided that your details are protected from being seen by others without your permission.

You can contact us to exercise any of your rights by telephone (+44 118 332 0300), or email at [email protected].

When you make a request we will need to verify your identity to ensure that your data is not disclosed to the wrong person.

We will accept the following forms of identification (a minimum of one original photographic ID in addition to a supporting document):

• Driving Licence,
• Passport,
• Birth Certificate,
• Utility Bill or Bank Statement not older than three months.

Please note that we cannot accept photocopies of these identification items.

We will respond to any legitimate request within 30 days.

In the rare event that you wish to make a complaint about how your personal data is being processed by us, you have the right to complain to us directly using any of the contact methods above.

If we fail to respond within 30 days, you have the right to complain to the Information Commissioner’s Office (ICO).

The ICO Contact Details are:

The ICO, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
Telephone +44 (0) 303 123 1113
https://ico.org.uk