Lawful basis for processing

Why we need to process your personal information	Lawful Basis
Why we need to process your personal information	1 Our ground to process your personal information	2 Additional ground to Additional lawful basis for Special category data e.g. health records
Contacting you following an enquiry from you through our website, by email, by phone line or social media	Necessary steps for us to enter into a contract with you	For the provision of health or social care or treatment Necessary to protect vital interests Necessary for defense of legal claims
Establishing a patient record	Necessary steps for us to enter into a contract with you Legitimate interests and appropriate business need to use your information which does not overly prejudice your rights	For the provision of health or social care or treatment Necessary to protect your vital interest or the vital interests of another person where you or they are not capable of giving consent
To provide you with healthcare and related services	Fulfilling our contract with you for the provision of health care and/or treatment To protect your vital interest of the vital interests of another person where you or they are not capable of giving consent Necessary for task carried out in the public interests	For the provision of health or social care or treatment Necessary to protect your vital interest or the vital interests of another person where you or they are not capable of giving consent Necessary for task carried out in the public interests
To ensure that your account and billing is fully accurate and up-to-date	Fulfilling our contract with you for the provision of health care and/or treatment Legitimate interests and appropriate business need to use your information which does not overly prejudice your rights	For the provision of health or social care or treatment The use is necessary in order for us to establish, exercise or defend our legal rights
Maintaining improved quality of service, training including conducting post treatment surveys, but excluding marketing	Legitimate interests and appropriate business need to use your information which does not overly prejudice your rights	Necessary to manage health or social care systems or services
Maintaining accounting and financial records, internal and external audit requirements	Legitimate interests and appropriate business need to use your information which does not overly prejudice your rights For compliance with legal obligations	N/A
Disclose information to regulatory bodies (see exception with PHIN below)	To comply with a legal or regulatory obligation	Necessary for reasons of substantial public interest Necessary to protect against serious cross-border threats to public health
Disclose information to regulatory bodies or information organisations, including the Private Health Care Information Network” (PHIN).	To comply with a legal or regulatory obligation	Necessary for reasons of substantial public interest
To answer any complaint or legal claim from you	Legitimate interests and appropriate business need to use your information which does not overly prejudice your rights For compliance with legal obligations To establish, exercise or defend our legal rights	Necessary for the establishment, exercise, or defence of legal claims
Communicating with third party, share updates about your care (e.g. insurance companies) and updating other healthcare professionals about your care (e.g. NHS)	Fulfilling our contract with you for the provision of health care and/or treatment Legitimate interests and appropriate business need to use your information which does not overly prejudice your rights	Necessary for the provision of health care or treatment or the management of health care systems pursuant to contract with a health professional Necessary for reasons of public interests in the area of public health and ensuring high standards of quality and safety of health care
Use of closed-circuit television (CCTV) for security purposes	Legitimate interests and appropriate business need to use your information which does not overly prejudice your rights	N/A
We may provide your personal information to our third party survey provider	Legitimate interests and appropriate business need to use your information which does not overly prejudice your rights	Your consent
Provide marketing information to you	Your explicit consent	N/A

Please note that failure to provide us with your personal information (including your sensitive information) may mean that we are unable to set you up as a patient, provide you with the required treatment or facilitate the provision of your healthcare.

Legal references

In most circumstances, HCA will rely on Article 6 (1) (b) and Article 9 (2) (h) of the General Data Protection Regulations (GDPR) for the processing of your personal data. The GDPR has been incorporated into UK law as part of the Data Protection Act 2018. In addition HCA may rely one or more of the following basis including when sharing personal data.

Legal obligation: the processing is necessary for compliance with a legal obligation Article 6 (1)(c)*
Vital interests: the processing is necessary to protect someone’s life. Article 6 (1) (d)
Public interest: the processing is necessary to perform a task in the public interest. Article 6 (e)
Legitimate interests: the processing is necessary for an organisation’s legitimate interests or the legitimate interests of a third party. Article 6 (1) (f)

When processing special category data HCA may rely on;

Employment, social security and social protection Article 9 (2)(b)
Vital interests of the Data Subject Article 9 (2) (c)
Substantial public interest Article 9 (2) (g)
Provision of health or social care Article 9 (2) (h)
Public interest in the area of public health such as protecting against serious cross border threats to health Article 9 (2) (i)
Consent Article 9 (2)(a)

* This includes the Notice by Secretary of State under Reg 3(4) of Health Service Control of Patient Information Regulations issued 1st April 2020 allowing healthcare providers to share personal data and any other such notice that may be issued to support efforts against COVID-19.

Last Updated: January 2022

Download policy