Privacy

SM Medispa Ltd trading as The Canmore Clinic takes great care to protect the personal data we hold for you in line with the requirements of the General Data Protection Regulation (GDPR).

The purpose of collecting and storing personal data about you is to ensure we can:

Provide appropriate, safe and effective aesthetic care, treatment and advice for you
Fulfil any contracts we hold in relation to your care
For business administration of your care

Types of Personal Data Held for Our Patients

The personal data we process includes:

Name, address, date of birth
Unique identification number
Email address
Phone numbers
Occupation
Medical history
Photographs
Family group
Financial information
Credit card receipts
Correspondence
Details of any complaints received

We keep an inventory of personal data we hold on our patients and this is available on request.

Disclosure to Third Parties

The information we collect and store will not be disclosed to anyone who does not need to see it. We will only share data securely and when necessary, including with:

Regulatory authorities such as the General Medical Council or Scottish Regulatory Authorities
Insurance companies
Loss assessors
Fraud prevention agencies
In the event of a future sale of the practice

We may also share personal data if it is in a patient’s best interest or if we believe an individual is at risk of harm or abuse.

Personal Privacy Rights

Under the GDPR you have the right to:

Access and request copies of your records
Have inaccuracies corrected
Request erasure of your data in some cases
Object to direct marketing
Restrict processing, including automated decisions
Request data portability to another clinic

Requests should be made to the nurse responsible for your care.

Legal Basis for Processing Your Data

The GDPR requires us to state the legal basis for processing:

We hold patient data as a Legitimate Interest – it is required to deliver effective care
We hold staff data due to Legal Obligation
We hold supplier data to fulfil contractual agreements

Automated Decision-Making

You will always be asked to opt in to any processes involving automated decision-making.

Consent

We will obtain your opt-in consent for direct marketing and for treatment:

New patients provide consent on first attendance
Existing patients will be asked at their next appointment
Consent is refreshed annually

Withdrawal of Consent

You may withdraw consent at any time after opting in.

Retention Period

We retain medical records for 10 years.

Complaints

If you wish to complain about how we process your data, please contact Miranda Philip. All complaints are handled in line with our practice complaints policy.

This Privacy Notice was implemented on: 1st October 2023
Review due: 1st October 2024 or sooner if regulations change.

Who We Are

Our website address is: https://thecanmoreclinic.com

What Personal Data We Collect Through the Website

Comments

When visitors leave comments, we collect the data shown in the form, IP address, and browser user agent to help detect spam.

An anonymised string from your email (a hash) may be sent to Gravatar to check if you use the service. Their policy is at automattic.com/privacy.

Media

Do not upload images with embedded location data (EXIF GPS). Visitors can download this data.

Contact Forms

Cookies

Cookies may store your name, email and site info for your convenience when commenting. Login cookies last two days. Screen options cookies last a year. \’Remember Me\’ extends login to two weeks.

Cookies for editing/publishing include post ID only and expire after one day.

Embedded Content

Articles may include embedded content (e.g. videos, images) from other sites which may track your interaction as if you visited the source site directly.

Analytics

How Long We Retain Your Data

Comments and metadata are retained indefinitely. Registered user data is editable by the user and administrators.

Your Rights Over Your Data

You can request a copy of your data or ask us to erase it. This excludes data we must keep for legal or security purposes.

Where We Send Your Data

Visitor comments may be checked through automated spam detection services.

Blog

Regulated by