Home Digital Health Privacy Policy for Centric Health Digital Services.

WHAT IS A PRIVACY NOTICE? 

This privacy notice is specific to Centric Health Digital Health services including escalating to a Centric Health GP This service is provided by Centric Health who will act as an independent data Controller. A ‘privacy notice’ lets you know what happens to any personal data that you may give us or that we may collect from you or about you (as a patient, family member, carer or visitor). This notice is issued on behalf of Centric Health. This statement covers the information we hold about you, your family and other individuals who may use these services. 

WHO ARE WE AND WHAT DO WE DO?  

Centric Health is a high-quality Primary Care group with a growing network of family GP practices and patients across Ireland. The company was founded in 2004 by two doctors, Dr Maurice Cox (CEO) and Dr Ray Power (Medical Director). Centric Health is the leading provider of primary care GP services in Ireland with over 70 locations. General Practice is a mission-critical element of healthcare, acting as a gatekeeper to the broader healthcare system and managing patients' long-term health. Centric Health's platform allows it to leverage technology and provide best-in-class care, clinical outcomes, and patient satisfaction. 

We are proud to say that we now have over 400 clinical staff working to support our patient's needs across our practices. 

Centric Health Privacy Notice is available here: https://www.centricgp.ie/privacy-statement/ 

Centric Health is the noted Data Controller. 

WHY HAVE WE ISSUED THIS PRIVACY NOTICE FOR OUR PATIENTS, FAMILIES AND OTHERS 

We are committed to being open about the information we collect about you, how we use this information, with whom we share it, and how we store and secure it. We recognise the importance of protecting personal and confidential information in all that we do, and take care to meet our legal and other duties, including compliance with relevant law, regulations and guidance 

Under the General Data Protection Regulation (GDPR) Centric Health has a legal duty to ensure patient data, supplied as part of the patient process within Centric Health, is kept secure and safe. 

Personal data will be obtained in a lawful, fair and transparent manner for a specified purpose and will not be disclosed to any third party, except in a manner compatible with that purpose. 

“Personal data” means data relating to a living individual who is or can be identified either from the data or from the data in conjunction with other information that is in, or is likely to come into, the possession of the data controller (“Centric Health”); 

 

 

All medical information is seen as “sensitive personal information” and we will endeavour to ensure your information is treated with the utmost respect and confidentiality. 

WHO CONTROLS THE USE OF YOUR PERSONAL DATA? 

Centric Health, whose registered address is Centric Health, Floor 7, RSA House, Dundrum Town Centre, Sandyford Road, Dundrum, Dublin 16, D16 FC92. 

  

MANAGING YOUR INFORMATION 

  • To provide this “Centric Health Digital Health” and additional services including escalation to a Centric Health GP, Centric Health will need to collect and keep information about you and your health on our system
  • We will only ask for and keep information that is necessary. We will attempt to keep it as accurate and up to- date as We will explain the need for any information we ask for. 
  • Please inform us about any relevant changes that we should know about, such as change of address, phone numbers, family circumstances, any new treatments or investigations being carried out that we are not aware of. 
  • All persons working in “Centric Health Digital Health” and additional services including escalation to a Centric Health GP (not already covered by a professional confidentiality code) sign a confidentiality agreement that explicitly makes clear their duties in relation to personal health information and the consequences of breaching that
  • Access to patient records is regulated to ensure that they are used only to the extent necessary to enable the Doctor and or administration team to perform their tasks for the proper functioning of “Centric Health Digital Health” and additional services including escalation to a Centric Health GP
  • Accepting bookings for scheduled telephone or video calls.
  • Issuing text messages or e-mail as reminders for appointments.
  • Ensuring all clinical notes have updated and saved on a GP Software System named Socrates.
  • Ensuring all prescriptions and or referrals have been actioned through Healthmail.
  • Take into consideration Freedom of Information and Data Protection.
  • Be clear about the purpose
  • Action any Subject Access Requests within appropriate timeframes.
  • Be satisfied that we are disclosing the minimum information to the minimum amount of people necessary.
  • Be satisfied that the intended recipient is aware the information is confidential and that they have their own duty of 

WHAT PERSONAL DATA IS COLLECTED? 

In order to provide our services to you we need to process certain personal data in relation to you, which includes: 

  • Biographical data - We collect the following biographical data: name, assumed names, address, phone number, email address, gender, family relationships (e.g. spouse, children), date of birth, PPS number, GMS 
  • Interactions with us - If you interact with us, we will record details of those interactions (e.g. phone calls and logs of phone calls, email correspondence and hard copy correspondence). If you make a complaint, we will process details in relation to that complaint
  • Online services - When you interact with us online (by computer, tablet or smartphone), you will often provide personal data to us, which you will be aware of when using the services or for which you give consent. We also automatically collect data about your use of our services, such as the type of device you are using and its IP address, and how you interact with the Further details are available in the cookies policy that accompanies the relevant service. 

 

CATEGORIES OF PERSONAL DATA 

  

Category of data 

  

Purpose of Processing 

  

Lawful of processing 

Administrative: 

name, address, contact details (phone, mobile, email), dates of appointment 

  

  

____________________________ 

Medical Record: 

Individual Health identifier, 

GMS number, PPSN, date of birth, religion, sexual orientation, gender, family members, family history, contact details of next of kin, contact details of carers, vaccination details, medication details, allergy details, 

current and past medical and surgical history, genetic data, laboratory test results, imaging test results, near patient test results, ECGs, Ultrasound scan images, and other data required to provide medical care 

  

Necessary to support the administration of patient care in general practice 

  

  

 ________________ 

  

Necessary to provide patient care in general practice 

  

  

Article 6.1(d): processing is necessary in order to protect the vital interests of the data subject or of another natural person; 

 _____________________ 

Article 6.1(e): processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; 

  

Special Categories are processed under the derogations in Articles 9.2(h) and 9.2(i).   

  

  

  

Account Details: 

Record of billable services provided, patient 

name, address, contact details, billing and payment records, and debit or credit card details. 

  

  

  

Required for providing a service and billing.  

  

  

  

Article 6.1(c): processing is necessary for compliance 

with a legal obligation to which the controller is subject(Revenue, Medical and Legal Obligations) 

, and Article 6.1(b) in relation to getting paid for providing a service to private patients 

  

  

  

  

RECIPIENTS WITH WHOM WE SHARE PERSONAL DATA 

  

Categories of Recipient 

Description 

Health   and   Social   Care 

Providers 

  

Other GPs, Health Service  Executive,  Voluntary  Hospitals, 

Private     Hospitals     and     Clinics,       Pharmacies, 

Data Processors with  a 

contract 

  

 Clanwilliam [Socrates] Patient Administration System [PAS]. https://www.socrates.ie/privacy-statement/ 

Healthmail : secure transmission of Prescriptions & referrals to another medical professional.  https://www2.hse.ie/privacy-statement/ 

GP24 Out of Hour Doctor:https://www.gp24.ie/privacy-policy 

Legal Arrangements 

Coroner, Revenue, Social Protection, Medical Council 

  

Public Health 

Infectious   disease   notifications,  influenza   surveillance, the National Cancer Registry, and other National Registries 

  

Third Parties – This will only be actioned under explicit patient consent 

 

Solicitors, Insurance Companies, Health Insurance Companies, Banks 

  

 

HOW WE USE & PROCESS YOUR DATA 

Centric Health needs to process clinical information about our patients to ensure that all clinical staff have complete information to ensure you get the best digital treatment while under our care. 

Each patient will have a unique Medical Record and all your details are kept within your unique medical record. 

We process your personal data to provide you with our services and to assist us in the operation of our business. Under data protection law we are required to ensure that there is an appropriate basis for the processing of your personal data, and we are required to let you know what that basis is. 

 

There are various options under data protection law, but the primary bases that we use are (a) processing necessary for the performance of our contracts with you, (b) processing necessary in order for us to pursue our legitimate interests, (c) processing where we have your and/or your dependents’ consent,  (d) processing that is required under applicable law (e ) Vital Interest. 

 

LEGAL REQUIREMENTS 

In certain circumstances, we are required by law to report information to the appropriate authorities. This information is often provided after authority has been given by a qualified health professional. For example: 

  • Where we encounter infectious diseases, which may endanger the safety of others e.g. COVID 19, meningitis or measles 
  • Where a formal court order has been issued 

 

 

 

  • Section 7(1)(a) of the Ombudsman Act 1980 provides the Ombudsman with powers to acquire information or documents for the purpose of a preliminary examination or investigation by him or her under the 
  • Ombudsman for Children: Section 14 of the Ombudsman for Children Act 2002 provides the Ombudsman for Children with the power to acquire 

  

The Data Protection Commissioner may, for the purposes of the investigation of a complaint under the Data Protection Acts, require the Centric Health to provide any documentation as is considered necessary information or documents for the purpose of a preliminary examination or investigation. 

 TRANSFERS OUTSIDE OF THE EUROPEAN ECONOMIC AREA (EEA) 

 For this service, Centric Health processes all of your data within the EEA. 

 If we transfer your personal data outside of the EEA, please rest assured that we will ensure that appropriate measures are in place to protect your personal data and to comply with our obligations under applicable data protection law. 

  

YOUR RIGHTS 

Under GDPR, you have rights regarding the use of your personal details. Centric Health is the Data Controller charged with protecting your medical data. 

Centric Health has a responsibility in how we handle this information. 

You have the right to data protection when your details are: 

  • held on a 
  • held on paper or other manual form as part of a filing system; and 
  • images of your data, e.g. XRAY 

  

WHAT IS THE AIM OF THESE RIGHTS? 

With Data protection rights we help you to make sure that the information stored with us about you is: 

  • Accurate and up to 
  • Only available to those who should have 
  • Only used for stated 

 

 

  • Stored securely 

WHAT SHOULD YOU EXPECT? 

  • Expect fair treatment from Centric Health and our staff in the way we obtain keep, use and share your information. 
  • That you have the right to be fully informed in why we are collecting your information and how we are using it. 
  • That you have the right to object to Centric Health using your details for a particular 
  • That you have the right to ensure inaccurate information about you is corrected when it is safe to do so. 
  • Request to see a copy of all information kept about you unless exceptional circumstances apply 
  • Complain to the Data Protection Commissioner if you feel your data protection rights are being infringed. 

CENTRIC HEALTH MUST DO? 

Centric Health will comply with the Principles of GDPR  

  • To obtain information lawfully, fairly and 
  • Collect only data necessary for a specific purpose(s) and only use this data for set purpose 
  • Ensure the information is accurate and up to date. We will need your help for this, so please inform us if you have changed any contact or next of kin 
  • Data is stored as long as necessary to provide excellent care 
  • We will endeavour to keep your data safe and secure. 

RIGHT TO OBTAIN A COPY OF YOUR INFORMATION 

Under GDPR, you have a right to obtain a copy of any information relating to you kept on a computer or in a structured manual filing system or intended for such a system by any entity or organisation. 

A request for access, release, or copy of personal data can only be made by the patient or any third party (registered next-of-kin or solicitors authorised by patients, Patient Legal Guardian, or Power of Attorney) it must be issued to: 

  • Supply relevant information to locate records 
  • Include legal name, date of birth, date of service and Medical record number (if possible) 

 

 

 

  • Be accompanied by appropriate identification example Current Irish Driver’s License, Valid Passport, and Proof of address example a current utility bill. This is to make sure that personal information is not given to the wrong 

Once you have made your request, you must be given the information within 30 calendar days and free of charge. A charge will only apply if the request is deemed to be excessive or repetitive in nature. If there are to be any delays or question will contact, you and keep you up to date. 

 All requests should be emailed to  centricgpsupport@centrichealth.ieor posted to “ Centric Health Digital Health” C/o Centric Health , Floor 7, RSA House, Dundrum Town Centre, Sandyford Road, Dundrum, Dublin 16, D16 FC92.  

CAN ACCESS BE REFUSED? 

Access can be refused to some or all of the patient’s personal health information, only, if providing access is likely to cause serious harm to the physical or mental health of the requester or if providing access would disclose the personal data of another person without their consent or would disclose a confidential expression of opinion about the requester. 

DELIVERY 

The recommended method of delivery of the request is by: 

  • Registered post via An Post 
  • Emailed using an agreed password and confirming 
  • Faxed following from confirmation of fax number and confirmation of receipt. 

RETENTION OF PERSONAL DATA 

Centric Health will retain your personal data in accordance with our respective retention policy. This policy operates on the principle that we keep personal data for no longer than is necessary for the purpose for which we collected it. It is also kept in accordance with any legal requirements that are imposed on us. This means that the retention period for your personal data will vary depending on the type of personal data. For further information about the criteria that we apply to determine retention periods please see below:  

  • Statutory and regulatory obligations - As we work in a highly regulated industry, we have certain statutory and regulatory obligations to retain personal data for set periods of 
  • Managing legal claims - When we assess how long we keep personal data we take into account whether that data may be required in order to defend any legal claims which may be If such data is required, we may keep it until the statute of limitations runs out in relation to the type of claim that can be made. 
  • Business requirements - As we only collect personal data for defined purposes, we assess how long we need to keep personal data for in order to meet our reasonable business 

 

 

CONSENT FOR MINORS 

Where we are required to gather the personal information of a minor (defined as a person aged under 18 years of age*), we will require the attendance and consent of a parent or guardian, and will only acquire and store such data with their permission, as well as the awareness of the minor themselves.  

* In the medical area, the Non-Fatal Offences Against the Person Act, 1997 (Section 23) provides that a minor who has reached the age of 16 can give consent to medical treatment and/or processing of their medical data. 

 Where the parents of the minor are not in a position to provide such consent, the support and of a recognized body will act ‘in loco parentis’ – for example, the family GP, school principal, social worker or Gardai will be consulted in order to ensure that any such processing of personal data is being done in the vital interests of the minor. As much as possible, the minor will be made aware of the processing activity and its purposes. 

USEFUL LINKS 

Data Protection Commission: https://dataprotection.ie/ 

A guide to Data Protection and what it means for you http://gdprandyou.ie/ 

DATA PROTECTION OFFICER  

If you have any questions about your data protection, you may contact Centric Health’s Data Protection Officer: 

Email: DPO@centrichealth.ie Phone: 01 299 3500 

Letter: Data Protection Officer, Centric Health, Floor 7, RSA House, Dundrum Town Centre, Sandyford Road, Dundrum, Dublin 16, D16 FC92