Data Protection & Privacy

Data Protection General Statement

This Data Protection Statement outlines Mediskin's commitment to its patients, staff, suppliers and other individuals to operate its business activities in a manner which meets the compliance obligations of the Jersey data protection legislation, the Data Protection (Jersey) 2018 Law ("DPJL") and the General Data Protection Regulation (EU) 2016/679.

Mediskin understands and respects your right to privacy and we are committed to ensuring the confidentiality and security of your personal data and the personal data processing activities within our organisation by applying the appropriate technical and organisational measures required to achieve this objective.

This document covers the policies and procedures for processing personal data in a compliant manner and outlines the rights of the data subjects in respect of that data. The Privacy Notice below explains how we may use, process and store your personal data.

Data Controller

Mediskin is the data controller of all personal data and data processing activities of its aesthetic and skin care clinic operating in Jersey, Channel Islands, UK. The clinic is located at 6 Spectrum, Gloucester Street, St Helier, Jersey, JE2 3DE.

Reference documents: Data Protection (Jersey) Law 2018; Data Protection (Registration and Charges)(Jersey) Regulations 2018; EU General Data Protection Regulation 2016/679.

Privacy Notice

Scope of Application

This policy applies to our business activities operating within Jersey, Channel Islands, or the personal data processing of the data subjects within the European Economic Area (EEA) and UK.

Personal Data We Collect

Mediskin collects the following categories of personal information:

From Patients

• Contact details (name, address, email, telephone, mobile number, emergency contact and next of kin)
• Date of birth
• General health and medical information
• Skin care treatment plan and historic information
• Conversations and incidents about your care and treatment plan
• Debit or credit card information for Customer Not Present (CNP) transactions
• Photos and other images (if required)
• Voice and video recording during consultations (when required and agreed)

From Suppliers

• Contact details (name, address, email, telephone, mobile number)
• Job title
• GST and/or VAT number
• Website and relevant business social media details

Note: All digital payment processing is carried out using secure, PCI-compliant payment systems with the highest security standards. Paper copies of transaction receipts are stored in a lockable secured cabinet with restricted access and destroyed after the applicable retention period expires.

Special Category Personal Data

As part of the new patient onboarding process and for pre-treatment assessments, patients will be asked to complete prescribed forms to inform Mediskin clinical staff about their general health condition, and any other health issues, that may assist staff in determining if the requested or proposed treatments are suitable.

Patients will be asked to provide their explicit consent to share this information with Mediskin, and if required and authorised by you, to share your information with other approved health care professional(s).

In certain circumstances, requested or proposed treatments will not be provided until all information required as per the prescribed treatment form(s) is provided by the patient, to ensure the safety of the patient and clinic staff before, during and after treatment.

Purposes of Data Processing

Data Collection Methods

We collect personal data in the following ways:

• When you complete and submit a new patient form when joining our clinic for the first time via paper or digital forms
• When you are asked to update your personal data in advance of an appointment, consultation or treatment
• When you contact us by telephone, voicemail, email, text message or through our website
• When viewing and using our website
• When you transfer to us from another clinic and we receive your patient records with your consent
• In certain circumstances, from the States of Jersey, hospital or other relevant authorised body
• From third party channels such as public registers, social media and other public forums
• Directly from you when engaging with us
• From use of website cookies and beacons which may track your usage of our website

Information Collected

Patient and other data subject personal data will only be used where you are seeking to purchase and use our range of professional aesthetic and skin care treatments, products and services. The personal data collected is used to:

• Meet our obligations in the performance of a contract for provision of products or services which you have requested
• Assist in the delivery and operation of secure business communications via email, our website and other relevant means
• Meet legal obligations from relevant local laws in relation to sale of products and services (e.g. GST/VAT)
• Meet any legal obligations in relation to the defence of a legal claim or where we receive a court order for the disclosure of personal data
• Meet any other legal obligations from relevant local laws
• Assist you in case of an emergency situation

Only personal data that is necessary for the purposes of assisting our patients with the provision of products or services is actively collected. Any other personal information is only passively collected and processed in accordance with this Privacy Notice, or as required by law.

Recipients of Data

Personal data collected may be disclosed or transferred to:

• Mediskin's data processors who provide services in relation to the provision of aesthetic and skin care products and services, computer systems, patient records, photo, video or x-ray services
• Mediskin's business partners who may provide professional services in relation to additional expert skin care services, hospital and relevant health care providers
• Mediskin's data processors who provide services in relation to the secure and safe running of its business systems and processes
• Professional agents in the provision of required services (e.g. lawyers, bankers, accountants, auditors)
• Law enforcement and competent authorities as required by law
• Other third parties where requested by you and when relevant consent has been obtained
• Any new owner of Mediskin should it be acquired or merged with another company

Third party service providers are bound by the requirements of Data Processor Agreement obligations, where personal data is processed to high standards of confidentiality with required security arrangements in place.

Social Media Platforms

When we use social media platforms (e.g. Facebook, Instagram), we only operate them to promote our own business and we would not knowingly engage in activities that go beyond this scope. Patients and other data subjects are advised to refer to the respective privacy notices of these social media platforms to check their data protection and privacy rights. Mediskin cannot be held responsible for third party social media platforms or website activities.

Transfer and Access to Personal Data

Mediskin will only transfer data outside of the EEA where it is necessary for the performance of the contract agreed by you. Where the destination of the data transfer is outside the EEA and does not include a third country that has "adequacy/equivalence" status as recognised by the EU Commission, we would always ensure that appropriate safeguards are in place. Where we cannot guarantee these safeguards, we would always request your consent before the data is transferred.

Retention of Data

Mediskin will only retain your personal data for as long as is necessary to fulfil the purpose for which it was collected:

• Personal data in relation to patient, staff, supplier and other data subject transactions is retained for 10 years from the date of the transaction where they are deemed to be part of the financial records of the business
• Patient records will be kept for as long as the patient and Mediskin relationship exists, thereafter for 8 years, following the NHS Records Management Code of Practice and guidance from the local Jersey health department
• Any information required for the defence of a legal claim or to meet any other legal obligation will be held until the matter is satisfactorily resolved by the courts or relevant regulatory body

This is subject to the exception where the data cannot be deleted for legal or regulatory reasons.

Data Subject Rights

Where a data subject wishes to exercise their rights under applicable data protection laws, they should contact us at info@mediskin.je. Data subjects have the following rights:

• Access to their personal data
• Rectification of any inaccuracies
• Restriction on the processing of their data
• To object to the processing of their data
• To be forgotten (erasure of your data)
• Right to data portability
• Right to object to automated decision making and profiling
• Right to withdraw consent for data processing activities based on consent

Mediskin does not make any decisions based on purely automated means, but if we do, you have a right to object. Each request will be reviewed against the requirements of the Data Protection (Jersey) Law 2018 and in certain circumstances these rights may not be exercisable. Full explanations will be given in such cases.

Making a Complaint

The Office of the Information Commissioner in Jersey, Channel Islands, is an independent statutory authority where you can make a complaint or learn more about data protection in Jersey. Their office is located at 2nd Floor, 5 Castle Street, St. Helier, Jersey, JE2 3BT. Their website is www.jerseyoic.org and telephone number is 01534 716 530.

Security

Mediskin is committed to ensuring the security of your personal data and has implemented appropriate commercially reasonable technical, physical and organisational measures to prevent unauthorised or unlawful processing of your personal data or accidental loss or destruction of your personal data. Management and employees are trained in their data protection responsibilities and obligation to handle personal data in a confidential manner.

Changes to This Notice

Mediskin may update this Privacy Notice at any time. The updated notice will appear on our website and in our Terms of Business.

Contact Details

If you have any questions, concerns or complaints with respect to this Privacy Notice or the handling of your privacy or personal information, please contact us at info@mediskin.je or call 07700 891 000.