This policy describes the types of personal data collected when you use our sites and how your personal data is used, shared and protected. It also explains the choices you have relating to your personally identifiable information and how you can contact us.
WHO IS RESPONSIBLE FOR THE PROCESSING OF YOUR PERSONAL DATA?
The entity responsible for the processing of your personal data is Saint James Hospital.
WHAT PERSONALLY IDENTIFIABLE INFORMATION DO WE COLLECT AND WHEN?
We ask you for certain personally identifiable information to provide you with the services you request. For example, when you request to receive communications, book an appointment, or interact with our sites. We will never share your information with a 3rd party without your explicit permission to provide you with access to that service. We may also collect sensitive personal data.
- Contact details: including name and surname, email, telephone number and physical address
- Personal details: including gender, date of birth and ID number
- Medical data: Specific medical history,
- Other health data: General health conditions and allergies.
- Personal preferences: including your marketing and cookie preferences, IP addresses, referrer headers, data identifying your web browser and version, and web beacons and tags.
When interacting with our sites, data is automatically collected and shared with us by the technology platforms providing the experience. For example, your web browser or mobile device may share certain data with Saint James Hospital as those devices interact with our sites. More information about these practices is included in the Cookies and Pixel Tags section below.
We may also ask you to complete surveys that we use for quality purposes.
We document all forms of communication between the data subject and Saint James Hospital on the data subject’s record held internally. We may make notes on relevant patient files enabling us to provide better care for medical, customer-service, legal, compliance, and regulatory purposes
WHY AND HOW WE USE (PROCESS) YOUR PERSONALLY IDENTIFIABLE INFORMATION?
We use the personal data we collect from you in the following ways:
To provide the features of the sites and services you request
When you use our sites, we will use your data to provide the service you have selected. For example, if you request more information, we will use the contact details you give us to communicate with you.
To operate, improve and maintain our business and services
We may use the data you provide to us to operate our business. For example, when you make a purchase, we may use that information for accounting, auditing and other internal functions. Specifically, we may temporarily store unidentifiable payment details, so we can match payment confirmation. This is only kept for a short period. As another example, we may use data about how you use our products and services to enhance your user experience and to help us diagnose technical and service problems and administer our sites.
To protect our or others’ rights, property or safety
For general research and analysis purposes
We use data about how our visitors use our sites and services to understand customer behaviour or preferences.
We may also use your personal data in other ways and will provide specific notice at the time of collection and obtain your consent where necessary.
TOOLS TO MANAGE WHAT WE COLLECT
In many cases, your web browser or mobile device platform will provide additional tools to allow you to control when your device collects or shares particular categories of information. For example, your mobile device or web browser may offer tools to allow you to manage cookie usage or location sharing. We encourage you to familiarise yourself with and use the tools available on your devices.
SHARING OF YOUR PERSONALLY IDENTIFIABLE INFORMATION
We may share your personal data with:
- Company affiliates for the purposes outlined above
- Third party service providers who, on behalf of Saint James Hospital:
- Process credit cards, payments, and deliveries
- Manage and service our data
- Distribute emails
- Conduct research
- Analyse our data
- Administer certain services and features
We are not responsible for the privacy policies of the third-party service providers but do check from time to time that our partners and suppliers are compliant with local privacy and data protection laws.
We may also transfer personal data we have about you in the event we sell or transfer all or a portion of our business or assets (including in the event of a reorganisation, spin-off, dissolution or liquidation).
PROTECTION AND MANAGEMENT OF YOUR PERSONALLY IDENTIFIABLE INFORMATION
The confidentiality of your personal information is of paramount concern to us and we comply with EU data protection law and all the applicable medical confidentiality guidelines issued by professional bodies such as the Malta Medical Council.
Your confidential medical information will be disclosed to the healthcare professionals, as justified by providing you the treatment or care. Additionally, such information might be disclosed to other entities, such as courts or medical professional bodies, only in the circumstance and following the communication modalities required under the Maltese law.
If you receive services from us and that service transfers to a new provider, we may share your personal and confidential medical information with the new provider.
We invest appropriate resources to protect your personal information from loss, misuse, unauthorised access, modification or disclosure.
Encryption & Security: We use a variety of security measures, including authentication tools to maintain the safety of your personal data. Your personal data is contained behind secured networks and is only accessible by a limited number of persons who have special access rights to such systems. Saint James Hospital has continuous IT support. Appropriate, industry-standard, security measures are in place to protect your data. (details are available upon request). This includes the encryption of all data held within our Electronic Medical Records and Hospital Information System and a secure physical firewall for the server.
Where is the data stored: The personal data we collect or generate (process) will be stored in Malta. Your data is stored on site with a select amount being backed up in a secure data centre.
We will never sell your data, but we may share your data with data recipients for processing purposes only. We may disclose your personal information to any member of our group, which means our subsidiaries, our ultimate holding company and its subsidiaries.
Some of the data recipients with whom Saint James Hospital shares your personal data may be located in countries other than the country in which your personal data originally was collected. The laws in those countries may not provide the same level of data protection compared to the country in which you initially provided your data.
Nevertheless, when we transfer your personal data to recipients in other countries, we will ensure your data is protected as described in this Policy and in compliance with EU General Data Protection (GDPR) regulation.
Retention of your data: We retain your personal data for as long as we hold legitimate interests to fulfil the purposes for which we collect it, unless otherwise required by law. Please refer above to the Data Minimisation section.
Your rights related to your personal data: You have the right to withdraw your consent with respect to our use of your personal data at any stage. Saint James Hospital will endeavour to continue to provide the services; however, by withdrawing your consent, the efficiency of these services may be affected. In such a case, someone from the Hospital will contact you.
You also have the right to access your data and to modification or deletion, in the event your data is incorrect or otherwise unlawful. You can submit a free of charge subject access request and Saint James Hospital will provide all the data held within a period of 1 month. In the case you provided an email address but desire to no longer to be contacted by us via email, you have the option to opt out of email communication from us.
You can contact us to exercise your rights of access, modification and deletion or to object to the processing of your personal data by sending an email to firstname.lastname@example.org
COOKIES AND PIXEL TAGS
Saint James Hospital receives and records information, which may include personal data, from your browser when you use our sites. We use a variety of methods, such as cookies and pixel tags to collect this information, which may include your
- unique cookie identifier, cookie information and information on whether your device has software to access certain features;
- unique device identifier and device type;
- domain, browser type and language,
- operating system and system settings;
- country and time zone;
- previously visited websites;
- information about your interaction with our sites such as click behaviour, purchases and indicated preferences; and
- access times and referring URLs.
Third parties may also collect information via sites through cookies, third party plug-ins and widgets. These third parties collect data directly from your web browser and the processing of this data is subject to their own privacy policies. More information on the identity of these third parties and their privacy policies is provided below.
Functional: These cookies are required for basic site functionality and are therefore always enabled. These include cookies that allow you to be remembered as you explore our sites within a single session or, if enabled, from session to session.
Performance: These cookies allow us to improve our sites’ functionality by tracking usage. In some cases, these cookies improve the speed with which we can process your request, allow us to remember site preferences you have selected. De-selecting these cookies may result in poorly tailored recommendations and slow site performance.
Social media and Advertising: Social media cookies offer the possibility to connect you to your social networks and share content from our sites through social media. Advertising cookies (of third parties) collect information to help better tailor advertising to your interests, both within and beyond our sites. In some cases, these cookies involve the processing of your personal data. De-selecting these cookies may result in seeing advertising that is not as relevant to you or you not being able to link effectively with Facebook, or other social networks and/or not allowing you to share content on social media.
For a comprehensive and up-to-date summary of every third-party accessing your web browser, we recommend installing a web browser plugin built for this purpose. You can also choose to have your computer warn you each time a cookie is being sent, or you can choose to turn off all cookies. You can do this through your browser settings on each browser and device that you use. Each browser is a little different, so look at your browser Help menu to learn the correct way to modify your cookies. If you turn cookies off, you may not have access to many features that make our sites more efficient and some of our services will not function properly.
COMPLIANCE WITH REGULATORS
We will obey a valid court order or subpoena if these require us to provide the information that we store to law enforcement authorities or a court of law. We will only do so upon legal scrutiny and confirmation of the validity of such requirement in the country where we are deemed to provide operate.
Applicable law and our practices change over time. If we decide to update our Policy, we will post the changes on our sites. We strongly encourage you to read our Policy and regularly check for any changes.
This policy is effective from 30th May 2018