Finishing Touch Clinic - GDPR Compliance Policy

At Finishing Touch Clinic, we are fully committed to complying with the General Data Protection Regulation (GDPR). This policy explains how we meet the requirements of the GDPR to protect your personal data.

1. Lawful Basis for Processing

We process personal data based on the following legal grounds:

• Consent: Where explicit consent has been provided (e.g., for marketing).
• Contract: Processing is necessary for delivering our services (e.g., booking appointments).

2. Data Collection and Minimization

We only collect data necessary for the intended purpose. This includes contact information for appointments, medical data for treatments, and consent for marketing communications.

3. Rights of Individuals

Under GDPR, you have the following rights:

• Right to Access: You can request access to your personal data.
• Right to Rectification: You can request corrections of inaccurate or incomplete data.
• Right to Erasure: You can request the deletion of your personal data when it is no longer necessary.
• Right to Data Portability: You can request that we transfer your data to another service provider.
• Right to Object: You can object to certain types of data processing, including for marketing purposes.

4. Data Security and Confidentiality

We implement appropriate security measures to protect personal data, including:

• Encryption: Sensitive data is encrypted.
• Access Control: Only authorized personnel have access to personal data.
• Regular Audits: Our systems and procedures are regularly reviewed for compliance and security.

5. Data Breach Procedures

In the event of a data breach, we will notify the relevant supervisory authority (the ICO) within 72 hours if the breach poses a risk to individuals' rights. If the breach is high risk, affected individuals will be informed directly.

6. Data Sharing and Processors
We ensure that all third-party processors, such as booking systems or marketing platforms, comply with GDPR regulations. Data processing agreements are in place with these providers to ensure your data is protected.

7. Data Retention
We maintain a strict data retention policy. Personal data will only be kept as long as necessary for the purpose for which it was collected, after which it will be securely deleted.

8. Data Protection Officer (DPO)
Due to the nature of our business, we are not required to appoint a Data Protection Officer (DPO). However, we ensure that someone in our organization is responsible for overseeing GDPR compliance.

9. Your Rights and Complaints
If you believe your data has been handled in a way that does not comply with GDPR, you have the right to lodge a complaint with the Information Commissioner's Office (ICO).

For any inquiries regarding GDPR compliance, please contact us:

Finishing Touch Clinic
Email: info@finishingtouchclinic.co.uk
Phone: 01207 580880
Address: 57 Medomsley Road, Consett, Co Durham DH8 5HQ