Privacy Policy
& Data Protection Policy

1) Introduction

Reclaim Mobility Limited is committed to maintaining the privacy and security of personal data. This document outlines how we handle personal data, including its collection, storage, sharing, and disposal. We adhere to all data protection laws, including GDPR, and have implemented measures to ensure that data is managed responsibly at every stage.

2) Who we are

Reclaim Mobility Limited is a community healthcare rehabilitation provider offering physiotherapy, occupational therapy, speech and language therapy, clinical psychology, and rehabilitation services.

Contact details
Phone: 07754 513697
Email: enquiries@reclaimmobility.co.uk

3) What information we collect and why

We collect and process personal information to provide safe and effective healthcare services. This includes:

• General Information: Name, contact details, address, emergency contact details.
• Health Information (Special Category Data): Medical history, treatment records, allergies, medications, risk factors.
• Operational Information: Appointment history, progress reports, photographs/videos (with consent), complaints or compliments.
• Legal and Compliance Information: Consent records for treatment and data sharing, professional compliance records (e.g., HCPC, GDPR).

4) How We Process and Store Personal Data

We process personal data in compliance with GDPR principles, ensuring that data is:

• Collected lawfully, fairly, and transparently.
• Stored securely using encrypted systems such as Cliniko and Microsoft SharePoint.
• Used for specified purposes related to the services we provide.

Data storage and security measures

• Personal data is stored in secure, encrypted online systems, including Cliniko and Microsoft SharePoint.
• Paper records are no longer routinely used but in the event of business continuity planning in unforeseen events they would be stored in locked, secure locations and shredded when no longer needed.
• Personal data stored on digital devices must be encrypted and password-protected.

Data sharing with third parties

• We only share data with third parties when necessary for healthcare services, legal requirements, or compliance.
• Personal data is transferred securely, using encrypted platforms or password-protected files.

5) Secure data handling and management for staff and associates

All employees, associates, and contractors must follow the guidelines below for handling personal data securely:

a) Uploading data to secure systems

• Personal data must only be uploaded to approved, secure systems (Cliniko, Microsoft SharePoint).
• Do not upload data to personal or unapproved systems.

b) Avoid storing data on USBs or personal devices

• Personal data must not be saved on USB drives or personal computers. If storage on personal devices is necessary, devices must be encrypted, password-protected, and approved by Reclaim Mobility’s director.

c) Secure your personal devices

• Password-protect all devices used to handle personal data.
• Use multi-factor authentication (MFA) where possible.
• Encrypt devices where possible (laptops, tablets, mobile devices) to ensure data is protected if lost or stolen.

d) Offline data handling

• Data should not be saved locally on personal devices. It must be uploaded to secure systems immediately.
• Paper records must be securely stored in locked cabinets and shredded when no longer needed.

e) Secure data sharing

• Personal data must be shared securely using company email or password-protected documents/links.
• Never share personal data via unsecured methods (e.g. social media platforms).

f) Data access and permissions

• Personal data access is granted on a need-to-know basis and regularly reviewed to ensure compliance.

g) Reporting security issues

• Report any security incidents (e.g., lost or stolen devices, data breach suspicions) immediately to the Data Protection Officer Nicola Rickards.

6) Data Breach Management

In the event of a data breach, Reclaim Mobility follows a clear protocol:

• Immediate Action: If a breach occurs, employees must report it to the Data Protection Officer (DPO) immediately. A full assessment of the breach will be conducted to understand its scope.
• Containment: We will take steps to mitigate the impact, such as securing compromised systems and preventing further unauthorised access.
• Notification: If the breach poses a risk to individuals' rights and freedoms, we will notify affected individuals within 72 hours of discovery.
• Documentation: All data breaches will be documented, and corrective actions will be implemented to prevent recurrence.

7) Data retention and disposal

Reclaim Mobility adheres to strict data retention policies to ensure that personal data is kept only for as long as necessary:

• Adults: Minimum of 8 years after the last treatment session.
• Children & Young People: Until the patient turns 25 or eight years after last contact (whichever is longer).
• Medico-Legal Cases: Up to 20 years, depending on legal requirements.

After the retention period, data is securely deleted or anonymised to prevent unauthorised access.

When working with organisations, sensitive data will be disposed of as outlined in contract specific terms e.g. on cessation of the project.

8) Consent

• Documentation: Consent for data collection and sharing is recorded using signed consent forms, digital logs, or verbal consent when appropriate.
• Withdrawal: Individuals can withdraw consent at any time by contacting us. Once consent is withdrawn, we will stop processing the data unless required to retain it for legal reasons.

9) Individual rights under GDPR

Under GDPR, individuals have the following rights:

• Right to Access: Request copies of data.
• Right to Rectification: Correct inaccurate information.
• Right to Erasure: Request deletion of data.
• Right to Restrict Processing: Limit how we use data.
• Right to Object: Object to data use in certain circumstances.
• Right to Data Portability: Request data transfer.
• Right to Withdraw Consent: Where consent is the basis for processing.

Requests can be made via enquiries@reclaimmobility.co.uk, and we will respond within one month.

11) Complaints

If you have concerns about how we handle data, please contact:

Nicola Rickards (Clinical Director)
07754 513697
Nicola@reclaimmobility.co.uk

If unresolved, you may contact the Information Commissioner’s Office (ICO):
ICO Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: www.ico.org.uk/make-a-complaint

12) Policy Updates

This policy is reviewed annually and may be updated as necessary. Last updated: 8 May 2024