Recording customer details: how we use your information for NHS Test and Trace
By maintaining records of visitors, and sharing these with NHS Test and Trace where requested, I can help to identify people who may
have been exposed to the coronavirus.
As the data controllers for the collection of your personal data, I will be responsible for compliance with data protection legislation
for the period of time it holds the information. When that information is requested by the NHS Test and Trace service, the service
would at this point be responsible for compliance with data protection legislation for that period of time.
To support NHS Test and Trace (which is part of the Department for Health and Social Care) in England, I have been mandated by law
to collect and keep a limited record of visitors who come onto the premises for the purpose of contact tracing.
As a customer/visitor of [Balanced Approach Acupuncture) you will be asked to provide some basic information and contact details.
The following information will be collected:
The NHS Test and Trace service as part of safeguarding your personal data, has in place technical, organisational and administrative
security measures to protect your personal information that it receives from the venue/establishment, that it holds from loss, misuse,
and unauthorised access, disclosure, alteration and destruction.
In addition, if you only interact with one member of staff during your visit, the name of the assigned staff member will be recorded
alongside your information.
NHS Test and Trace have asked me to retain this information for 21 days from the date of your visit, to enable contact tracing to
be carried out by NHS Test and Trace during that period. I will only share information with NHS Test and Trace if it is specifically
requested by them.
For example, if another customer at the venue reported symptoms and subsequently tested positive, NHS Test and Trace can request the
log of customer details for a particular time period (for example, this may be all customers who visited on a particular day or time-band,
or over a 2-day period).
I will require you to pre-book appointments for visits and to complete a form on arrival.
Under government guidance, the information we collect may include information which we would not ordinarily collect from you and which
we therefore collect only for the purpose of contact tracing. Information of this type will not be used for other purposes, and NHS
Test and Trace will not disclose this information to any third party unless required to do so by law (for example, as a result of
receiving a court order).
In addition, where the information is only collected for the purpose of contact tracing, it will be destroyed by us 21 days after
the date of your visit.
However, the government guidance may also cover information that we would usually collect and hold onto as part of our ordinary dealings
with you (perhaps, for example, your name, date of birth and phone number). Where this is the case, this information only will continue
to be held after 21 days and we will use it as we usually would, unless and until you tell us not to.
Your information will always be stored and used in compliance with the relevant data protection legislation.
The use of your information is covered by the General Data Protection Regulations Article 6 (1) (c) a legal obligation to which
we as a venue/establishment are subject to. The legal obligation to which were subject, means that were mandated by law, by a set
of new regulations from the government, to co-operate with the NHS Test and Trace service, in order to help maintain a safe operating
environment and to help fight any local outbreak of corona virus. [Venue/establishment, please add text on whether or not you transfer
personal data outside the UK, the EU or to anywhere else (if known).]
By law, you have a number of rights as a data subject, such as the right to be informed, the right to access information held about
you and the right to rectification of any inaccurate data that we hold about you.
You have the right to object to processing of personal data about you on grounds relating to your particular situation (also again
this right is not absolute).
You have the right to request that we restrict processing of personal data about you that we hold in certain circumstances.
You have the right to request that we erase personal data about you that we hold (although this is not an absolute right).
This privacy notice was last updated on 16 September 2020.
If you are still not satisfied, you can complain to the Information Commissioners Office. Their website address is www.ico.org.uk.
We keep our privacy notice under regular review, and we will make new versions available on our privacy notice page on www.balancedapproachacupuncture.co.uk
If you are unhappy or wish to complain about how your information is used, you should contact me in the first instance to resolve
your issue.