General Data Protection Policy
| Version: | Review date: | Approved by: | Comments: |
| 1.0 | September 2021 | Dr Maryam Abubakar | Next Review: September 2022 |
| 2.0 | September 2022 | Dr Maryam Abubakar | Next Review: September 2023 |
| 2.0 | September 2023 | Dr Maryam Abubakar | Next Review: September 2024 |
| 2.0 | September 2024 | Dr Maryam Abubakar | Next Review: September 2025 |
| 2.0 | June 2025 | Dr Maryam Abubakar | Next Review: June 2026 |
1. Introduction
Camford Medicals is committed to safeguarding the privacy and personal data of our patients, staff, and partners. In line with our mission to provide hospital-level healthcare in the comfort of patients’ homes, we process personal and sensitive health data with utmost care and in full compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Chapter 2
2. Scope
This policy applies to all employees, contractors, and third parties handling personal data on behalf of Camford Medicals. It covers all forms of personal data, including electronic and paper-based records.
Chapter 3
3. Legal Basis for Processing
We collect and process personal data only when necessary and on lawful bases, including:
- Consent – where patients have given clear permission.
- Contractual obligations – for providing healthcare services.
- Legal obligations – to comply with healthcare regulations.
- Vital interests – in life-threatening emergencies.
- Legitimate interests – to improve services and patient outcomes.
- Provision of health care or treatment – as a special category lawful basis under Article 9(2)(h) UK GDPR.
Chapter 4
4. Types of Personal Data Collected
We may collect and process the following categories of data:
- Identity and contact details
- Medical history and treatment records
- NHS and hospital discharge information
- Medication usage
- Appointment and referral details
- Consent records
Chapter 5
5. Purpose of Data Processing
We collect and use personal data to:
- Deliver home-based medical services including IV therapy, wound care, and medication support
- Ensure continuity of care following hospital discharge
- Manage long-term health conditions such as diabetes
- Schedule appointments and communicate with patients and referring clinicians
- Comply with legal and regulatory healthcare requirements
Chapter 6
6. Data Sharing and Third parties
Camford Medicals may share personal data with:
- Hospitals and NHS trusts
- Referring GPs and specialists
- Regulatory bodies (e.g. CQC)
- Approved third-party service providers (under strict confidentiality agreements)
We never sell personal data.
Chapter 7
7. Data Retention
We retain personal data only for as long as necessary for the purposes it was collected, in line with NHS and statutory requirements. After this period, data is securely deleted or anonymised.
Chapter 8
8. Data Security
We implement strong technical and organisational measures to protect personal data, including:
- Secure, password-protected systems
- Encrypted communication channels
- Regular staff training on data protection
- Access control and role-based permissions
Chapter 9
9. Data Subject Rights
Under the UK GDPR, individuals have the right to:
- Access their personal data
- Request rectification or erasure
- Restrict or object to processing
- Data portability
- Withdraw consent at any time (where applicable)
- Lodge a complaint with the Information Commissioner’s Office (ICO)
To exercise any of these rights, contact:
Data Protection Officer (DPO)
[Insert Contact Email / Address]
Chapter 10
10. Data Breach Notification
In the event of a personal data breach, we will:
- Assess the nature and severity of the breach
- Notify the ICO within 72 hours, if required
- Inform affected individuals where there is a high risk to their rights and freedoms
- Take immediate steps to contain and remedy the issue
Chapter 11
11. Policy Review
This policy will be reviewed annually or in response to significant changes in data protection law or our operations.