Privacy and Data Protection Policy

1 ABOUT THIS POLICY
1.1 Effective Medical Ltd appreciate your interest in our products and services and your visit to this website. Your data privacy is important to us and we want you to understand how we use and share your personal information.

1.2 This policy outlines how Effective Medical makes use of personal information, including when and why it is collected, used and disclosed and how it is kept secure.

1.3 Contact details at the end of this policy which you can use if you have any questions, including how to update or access your personal information or to make a complaint.

1.4 Our Data Protection policy may change from time to time to take into account the changing data protection landscape. As such, Effective Medical will update this policy accordingly.

1.5 Where Effective Medical is engaged in a contractual relationship where the handling of staff, patient or otherwise personal/sensitive data (i.e. for partners and clients), this policy should be considered in conjunction with the Information Security & Data Privacy Policies & Procedures document which will be shared as part of any agreement.

2 WHO WE ARE
2.1 Effective Medical Ltd (also known as EML or Effective Medical) is an organisation headquartered in the UK (formerly known as Left Pen Medical Ltd).

2.2 Where this policy refers to “we”, “our” or “us” below, unless it mentions otherwise, it is referring to Effective Medical.

3 HOW AND WHAT PERSONAL INFORMATION WE COLLECT
3.1 Personal information you give to us: This is information about you that you give to us by entering information via our website (specifically our ‘Contact Us’ or ‘Careers’ forms), or by corresponding with us by phone, email or other means and is provided entirely voluntarily. The information you give to us includes your name, contact details (such as phone number, email address and address), enquiry details and, where applicable, CV/Résumé.

Personal information we collect about you: We may automatically collect the following personal information: our web servers store as standard details of your browser and operating system, the pages that you visit on our website, the date of your visit, and, for security reasons, e.g. to identify attacks on our website, the Internet protocol (IP) address assigned to you by your internet service. We collect some of this information using cookies – please see Cookies.

Personal information obtained from other sources: We may obtain certain personal information about you from sources outside our business that you choose to make public (for example, data you publish via LinkedIn or Twitter).

With the exception of certain data that we may retain for regulatory oversight, you have the right to request what data we hold about you, and request that we delete this data from our systems (see “7.2 Right to be forgotten”, below).

4 HOW WE USE YOUR PERSONAL INFORMATION
4.1 Where you have contacted us via our website or other means, we will use the data to contact you back about the nature of your enquiry only.

4.1 We may use your personal information (where we still retain it) to contact you about private data (personal, corporate, program or project data, etc) that we believe may have become compromised via any means (including security breach, accidental release, etc), and that we believe you may have a significant interest in.

4.2 We will use your personal information to comply with our legal obligations including: (a) to assist HMRC, a regulatory authority such as the Food & Drug Administration or European Medicines Agency, the police, government agency or criminal investigation body; (b) to identify you when you contact us; and (c) to verify the accuracy of data that we hold about you.

4.3 We may use data collected about you whilst browsing our website using Cookies (see Cookies for details of what data may be collected and refusing the collection of this data) for (a) analysis of how our website is used; (b) the geographic location of our website visitors; (c) to administer our website and for internal technical operations, such as troubleshooting, testing, statistical purposes; (d) for the prevention of fraud and other criminal activities; (e) for network and information security in order for us to take steps to protect information against loss or damage, theft or unauthorised access; (f) to enforce or protect our contractual or other legal rights or to bring or defend legal proceedings; and (g) for general administration including managing your queries or complaints.

4.4 Details of email conversations, including copies of email correspondence, attachments and email addresses may be retained to help us meet any future regulatory or legal obligations.

4.5 Your personal data will never be shared with anyone outside of Effective Medical.

4.6 We will never use your personal data for marketing purposes, either from Effective Medical or from any 3rd party.

5 WHERE YOUR PERSONAL DATA IS STORED
5.1 We make use of leading cloud-based CRM systems for storage of data where, for the purposes of data integrity, business continuity and disaster recovery, data may be propagated through back-up systems that may be outside of the EU/EEA borders.

5.2 We ensure that appropriate security measures are taken with the aim of ensuring that your privacy rights continue to be protected as outlined in this policy. Steps include (a) ensuring all staff at Effective Medical are trained on this, and other related privacy policies in place at Effective Medical; (b) ensuring our systems are architected with the philosophy of “privacy by design” at their core; (c) creating Standard Operating Procedures (SOPs) and policies to protect the storage and processing of data, and; (d) make use of the Data Protection Officer role to oversee data protection and privacy policy is executed as intended.

6 RETAINING YOUR PERSONAL DATA
6.1 Your personal data will be retained no longer than is absolutely necessary in an identifiable format, and no longer than 7 years beyond our last contact (unless you exercise your right to be forgotten – see “7.2 Right to be Forgotten).

6.2 For the purposes of defending legal action or regulatory oversight, we may retain for longer periods, details of email conversations including copies of email correspondence, attachments and email addresses.

7 YOUR DATA PROTECTION RIGHTS
7.1 General Data Protection Regulation provides the following rights for individuals:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling.

We may ask you for information to confirm your identity and, where applicable, to help us to search for your personal information. We aim to respond to any requests as soon as is practicable, but no longer than 28 days.

7.2 Right to be Forgotten: you have the right to ask us to delete your personal data from our systems or provide you with your data in a machine-readable format. Requests should be made to the Data Protection Officer (see “Contact Us”).

7.3 Complaints can be made directly to the Data Protection Officer (see “Contact Us”) or to the UK Information Commissioners Office (ICO), where Effective Medical is headquartered. For details of the ICO, including how to contact them, see the ICO website.

8 CONTACT US
If you have any queries, suggestions or complaints about the collection and handling of personal data, or wish to contact us to amend or delete your personal data that we may hold about you, please contact the Data Protection Officer:

Data Protection Officer
Email: data@effective-medical.com
Telephone: +44 (0)845 0522420