Hand Surgery Solutions Privacy Policy
At Hand Surgery Solutions, we value your privacy and strive to protect your personal data. This Privacy Policy will explain how we collect, use, disclose, and safeguard your data when you visit our website.
1. Personal Data We Collect
When you visit or use our website, we may collect the following information:
Personal identification information: name, email address, phone number, etc.
Transaction data, including details about payments and purchases.
Technical data: IP address, browser type, and version, time zone setting and location, operating system, and other technology on the devices you use to access our site.
Health and clinical data: information relating to your medical history, diagnosis, treatment, test results and correspondence, where you are a patient of the practice.
Marketing and communications data: your preferences in receiving marketing communications from us and our third parties.
2. How We Use Your Data
We use the data we collect to:
Process your orders and manage your account.
Send you newsletters and promotional offers, only if you have consented to receive such information.
Improve our website and services.
Comply with legal obligations and prevent fraud.
3. Disclosure of Your Data
We will not sell, trade or rent your personal data. We share your data only where it is necessary to provide your care or run the practice — for example with our practice management provider (Carebit), our billing provider, your insurer where you are insured, and other clinicians involved in your care such as your GP, hospitals or physiotherapists. All such parties are required to keep your information confidential and to use it only for the purposes we specify. We may also disclose data where we are required to do so by law or by a regulator.
4. Special Category (Health) Data
As a healthcare provider, we process information about your health. Under UK GDPR this is “special category” data and receives additional protection.
We process this data on the basis of Article 9(2)(h) of the UK GDPR — the provision of health care and treatment, and the management of health care services — and under the common law duty of confidentiality owed to you by clinicians. Where we rely on your consent for a specific purpose, you may withdraw that consent at any time.
Everyone with access to your health information is bound by a duty of confidentiality.
5. Patient Portal (Carebit)
We use Carebit, a secure cloud-based practice management platform, to manage your care and to provide you with a patient portal.
Through the Carebit patient portal, you can securely access your clinical notes, letters and test results online, as well as manage your appointments and contact details. Access is protected by your own login credentials, and the information held there is encrypted.
Carebit processes your personal data — including health information — on our behalf and under our instruction. We remain responsible for your data as the data controller, and Carebit acts as our data processor under a written agreement that requires them to keep your information confidential and secure. Carebit is registered with the Information Commissioner’s Office (ICO) and does not use your data for its own purposes.
We control what is shared with you through the portal. If you have any questions about accessing your records, please contact us using the details below.
6. Billing and Payments
We use a third-party billing provider Civica, to process invoices and payments relating to your treatment.
To do this, we share the personal data necessary for billing — such as your name, contact details, invoice details and, where applicable, your insurer and policy information — with our billing provider. This data is used solely for the purpose of raising, issuing and reconciling invoices and processing payments.
Our billing provider does not share your personal data with any other party, and does not use it for marketing or any purpose other than billing. They retain billing records for seven years, in line with financial and tax record-keeping requirements, after which the records are securely deleted.
This retention period applies to billing records only. Your clinical records are retained separately and for a longer period, in line with professional and regulatory requirements for medical records.
7. Cookies
Our website uses cookies to:
Understand and save user’s preferences for future visits.
Aggregate data about site traffic and site interactions to offer better site experiences in the future.
If you disable cookies, some features will be disabled but it shouldn’t affect your user experience.
8. Data Security
We implement various security measures to maintain the safety of your personal information. This includes using SSL technology and conducting regular malware scanning. Your personal data is stored in secured networks and is accessible by a limited number of people who have special access rights and are required to keep the information confidential.
9. Third-Party Links
Our website may contain links to third-party websites. These third-party sites have separate and independent privacy policies. We have no responsibility or liability for the content and activities of these linked sites.
10. Your Data Rights
Under UK data protection law you have a number of rights over your personal data. You can:
Access your data — request a copy of the personal data we hold about you, including your clinical records. Many of your records are already available to you directly through the Carebit patient portal.
Correct your data — ask us to correct information that is inaccurate or incomplete. Where a clinical record is disputed, we may add a note recording your view rather than altering the original entry, as clinical records must remain an accurate account of your care at the time it was given.
Request deletion — ask us to delete your data. This right is limited: we are required to retain clinical and billing records for set periods under professional, regulatory and legal obligations, and we cannot delete them on request during that time.
Restrict processing — ask us to limit how we use your data in certain circumstances, for example while we are investigating a concern you have raised about its accuracy.
Object to processing — object to our use of your data in certain circumstances. You can object to receiving marketing communications from us at any time, and we will always act on this.
Data portability — where applicable, receive certain data in a portable format or have it transferred to another provider. This right does not apply to all of the data we hold, as most of your clinical information is processed for healthcare purposes rather than on the basis of consent or contract.
Withdraw consent — where we rely on your consent, you may withdraw it at any time. This will not affect the lawfulness of any processing carried out before you withdrew it, and it will not affect processing we carry out on another lawful basis, such as the provision of your care.
Rights relating to automated decisions — we do not make decisions about your care using automated processing alone.
To exercise any of these rights, please contact us using the details in the Contact Us section below. We will respond within one month. If your request is complex or you have made several requests, we may extend this by up to two further months, and we will tell you if that is the case. There is normally no charge.
Complaints
If you have a concern about how we handle your personal data, please raise it with us first so we have the opportunity to put things right.
You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator:
Information Commissioner’s Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk/make-a-complaint
Complaining to the ICO does not affect your right to seek a legal remedy.
11. Changes to This Policy
We may update our Privacy Policy from time to time. Any changes will be posted on this page, so please review it periodically.
12. Contact Us
If there are any questions regarding this privacy policy, you may contact us using the information below:
