Privacy Policy

Nature of provision of personal data

Where we need to collect personal data by law, or under the terms of a contract we have with you and you fail to provide that data when requested, we may not be able to perform the contract we have or are trying to enter into with you.

How we obtain your personal information

We collect personal information from you and others as necessary in the course of running our business.

Most of the personal data we process is provided directly to us by you for one of the following reasons:

• When you or your organisation makes an enquiry or uses any of our products or services
• When you or your organisation provides products or services to us
• When you communicate with us by phone, electronic messaging, in writing, or directly when you meet with our staff
• When you or your organisation browse our website, complete a form or communicate via the website or our other electronic services
• When you or your organisation participates in our marketing events, recruitment events or other promotional events
• When you agree to receive marketing communications from us
• When you or your organisation gives feedback (for example completing a survey)
• When provided by a publicly available source such as public lists of registers e.g. electoral register, Companies House and others

We also receive personal data indirectly, in the following scenarios:

• When provided by a third party organisation, such as an identity verification agency if you had applied for employment with us ; by an analytic provider such as Google if you use the internet; from payment providers if you bought something from us; by a delivery organisation if you took delivery from us; from a regulatory authority such as HMRC if you are employed by us
• When provided by our customer, such as a request for medical diagnosis or investigation where we provide a medical diagnosis report
• When you interact with our website or use our systems, we may automatically collect data about your access device and browsing session, using cookies and other technologies. We may also receive technical data about you if you visit other websites using our cookies

As part of Cyted’s corporate function, we process special category and criminal conviction data. We have an appropriate policy document that explains our safeguarding policy for special category and criminal conviction data.

Why we use your personal information

We will only process your personal data when we have a lawful basis to do so.

The lawful bases for processing are set out in Article 6 of the GDPR. At least one of these will apply whenever we process personal data:

1. Consent: we have your consent to process your personal data for a specific purpose. You are able to remove your consent at any time. You can do this by contacting: Data Protection Lead, Cyted UK Ltd, 2 Falcon Road, Hinchingbrooke, Huntingdon, Cambridgeshire, United Kingdom, PE29 6FG; email: dpo@cyted.ai
   
2. Contract: the processing is necessary as we have a contractual obligation
3. Legal obligation: the processing is necessary for compliance with a legal obligation
4. Vital interests: the processing is necessary for us to protect the vital interests of the data subject or of another natural person;
5. Public task: the processing is necessary for us to perform a task in the public interest or in the exercise of official authority vested in the controller;
6. Legitimate interests: the processing is necessary for our legitimate interests as controller or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which
   overrides those legitimate interests
   

In most cases, we do not rely on consent as a legal basis for processing your personal data with the exception in relation to sending direct marketing communications to you via email. You have the right to withdraw consent to marketing at any time by contacting us at the above address.

We will not use your personal data for making any automated decisions.

How we use your personal data

Cyted will only use your personal data fairly and where we have a lawful basis to do so. Most commonly, we will use your personal data in the following circumstances:

‍

Processing special category data

When we process special category data, we need to identify both a lawful basis for processing and a special category condition to ensure compliance with Article 9 GDPR. We consider Criminal offence information within special category data.

Recipients of personal data we process

Access to personal data is strictly controlled to maintain its privacy and security.

We may share personal data for the purposes mentioned in the above tables with the following recipients or categories of recipients:

• Our Staff – we share personal data with our staff involved with the delivery of our medical diagnosis services
• Our Healthcare professionals – we share personal data with our healthcare professionals involved with the delivery of our medical diagnosis services
• Our Customers – we share personal data with representatives of the medical organisation that commissioned our services
• Government and other regulatory bodies – we may be required to share personal data with regulators to comply with our legal, regulatory and statutory obligations such as the Care Quality Commission, Department of Work and Pensions, HMRC, Coroners Court
• Service providers – we may share personal data with service providers acting as processors who provide IT and system services
• Third parties – We may also be required to pass personal information to third parties acting as data processors of joint controllers such as law enforcement agencies, our insurers, our auditors, the courts and our professional adviser’s

These recipients or categories of recipients are only allowed to process personal data for specified purposes and where they are processing personal data on our behalf, they must do so in accordance with our instructions.

Also, we may share your personal data with other third parties in the context of a possible sale or restructuring of the business.

Transfer to third countries

If our recipients are based outside the European Economic Area (EEA) or the United Kingdom (UK) the processing of your personal data will involve a transfer of data outside the EEA or the UK. Whenever we transfer your personal data outside the EEA, we will ensure that a similar degree of protection of personal data is given by ensuring at least one of these safeguards is in place:

• Countries are deemed adequate by EU Commission- We will only transfer your personal data to countries that have been deemed to provide an adequate level of protection for personal data by the European Commission.
• Use model contracts – We may use model contracts approved by the European Commission which give the same protection to personal data as afforded within EEA.

How long we keep your personal data

We will only retain your personal data for as long as it is necessary for the purposes we collected it for, which will include the purposes of meeting any legal, regulatory, accounting or reporting requirements. For further information about how long we hold personal data see our retention schedule that is available on request from our Data Protection Lead.

Your data protection rights

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

• Your right of access- You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process. This right is commonly known as a “data subject access request” or “DSAR”.
• Your right to rectification- You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
• Your right to erasure- You have the right to ask us to erase your personal information in certain circumstances.
• Your right to restriction of processing- You have the right to ask us to restrict the processing of your information in certain circumstances.
• Your right to object to processing- You have the right to object to processing in certain circumstances.
• Your right to data portability- This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under, or in talks about entering into a contract and the processing is automated.

Making an information request to us

You can make a request to exercise your privacy rights by contacting us at the address above. To respond we will need information from you to deal with the request such as to locate the information you are looking for. We will set up an electronic case file containing the details of your request. This normally will include your contact details and any other information that you have given us. If you are making a request about your personal data , or are acting on behalf of someone making a request, then we will ask for information to satisfy us of your identity.

You are not required to pay any charge for exercising your rights however we may charge a reasonable fee if your request for access is repeated and/or unfounded or excessive. We have one month to respond to you.

Your right to complain to a supervisory authority

If you have concerns about the way we handle your personal data, you can contact the ICO or raise a complaint. We would, however, appreciate the chance to deal with your concerns before you approach the Information Commissioner’s Office so please contact us in the first instance.

If you remain dissatisfied, you have the right to make a compliant about the way we process your personal information by contacting the ICO.

• by phone on +44 303 123 1113
• by writing to Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF
• via their website at http://www.ico.org.uk/concerns

Changes to this policy

We may change our privacy policy from time to time. If or when changes are made, we'll include them here, so be sure to check back occasionally.

Other third party links

Our website may, from time to time, contain links to and from third-party websites, including those of our partner networks and affiliates. If you follow a link to any of these websites, please note that these websites may have their own privacy policies. We don’t accept any responsibility or liability for these policies. Please check these policies before you submit any personal data to these websites.

Security and safe storage of your personal information

The security of your personal information is very important to us and we take this matter very seriously. We’ll use appropriate procedures and security features to process and protect your information. We have in place a robust framework to ensure the security of your information.

We may monitor the use and content of emails, calls and secure messages sent from and received by us so that we can, for instance, identify and take legal action against unlawful or improper use of our systems. The main examples of unlawful or improper use are attempting to impersonate Cyted, the transmission of computer viruses and attempts to prevent this website or its services from working.

Further processing

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. If we need to use your personal information for an unrelated or new purpose, we will notify you and we will explain the legal basis which allows us to do so.

The NHS National Opt-Out

How the NHS and care services use your information

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

• improving the quality and standards of care provided
• research into the development of new treatments
• preventing illness and diseases
• monitoring safety
• planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visithttps://www.nhs.uk/your-nhs-data-matters. On this web page you will:

• See what is meant by confidential patient information
• Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• Find out more about the benefits of sharing data
• Understand more about who uses the data
• Find out how your data is protected
• Be able to access the system to view, set or change your opt-out setting
• Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
• See the situations where the opt-out will not apply

You can also find out more about how patient information is used at:
https://www.hra.nhs.uk/information-about-patients/(which covers health and care research); and
https://understandingpatientdata.org.uk/introducing-patient-data(which covers how and why patient information is used, the safeguards and how decisions are made).

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Health and care organisations have until 2020 to put systems and processes in place so they can be compliant with the national data opt-out and apply your choice to any confidential patient information they use or share for purposes beyond your individual care. Cyted Ltd is currently compliant with the national data opt-out policy.

Our Cookie Policy

For Full details on our Cookie Policy please visit the Cookie Policy page

‍