Introduction

The Data Protection Act 2018 and the UK General Data Protection Regulation (“UK GDPR”) govern how we process personal data. This notice explains what information we collect, why we use it, who we share it with, how long we retain it and the rights available to you.

JW Medical Management Ltd is the data controller for the personal data described in this notice, except where we act solely on the documented instructions of a client as its data processor. Our privacy contact details are:

Gary Marshall Data Representative
JW Medical Management Ltd
Suite 30/31, Normanby Gateway, Lysaghts Way, Scunthorpe DN15 9YG
Email: gary@jw-medical.co.uk

Where we act as a processor for a client—for example, when providing payroll, medical secretarial, billing or practice-management support—the client remains responsible for deciding why and how the personal data is used. Our written data-processing terms cover documented instructions, confidentiality, security, subprocessors, assistance with individual rights and breaches, deletion or return of data, and audit requirements.

The purposes for which we intend to process personal data

We intend to process personal data for the following purposes:

• To respond to enquiries, prepare proposals and take steps before entering into a contract.
• To provide accountancy, tax, payroll, billing, collection, medical secretarial, practice-management, business-support and related professional services.
• To manage our client and business relationships, communicate with relevant contacts, maintain records and administer our services.
• To carry out identity, anti-money-laundering, sanctions, fraud-prevention and other checks required by law or professional standards.
• To prepare invoices, receive and reconcile payments, recover debts, resolve fee queries and manage our financial affairs.
• To comply with legal, regulatory and professional obligations, including those arising from our regulation by the Association of Accounting Technicians (“AAT”).
• To establish, exercise or defend legal claims and deal with complaints, disciplinary matters, insurance matters and disputes.
• To operate, secure and improve our website, systems and services, including the use of website analytics and limited technical information about visits to our website.
• To seek feedback, conduct service research and produce anonymised business statistics.
• To send information about relevant services where permitted by law, including where we rely on legitimate interests, and where consent is required, only after you have made a clear and affirmative choice. You may opt out of direct marketing at any time.

Resource downloads and marketing communications

When you request a resource through our website, we use your name and email address to send the requested resource and record which resource you requested. We may also collect your speciality and practice or organisation name if you choose to provide them, so that we can better understand the interests of people using our resources and make future information more relevant. Providing these additional details is optional.

Sending the requested resource is separate from marketing. You can receive a resource without agreeing to receive our newsletter or other marketing communications. We will add you to the Private Practice Matters mailing list only if you actively select the optional consent box, which is unticked by default. If you consent, we will send the Private Practice Matters newsletter and occasional practical updates from JW Medical Management, normally no more than once a month in total. You may withdraw your consent or unsubscribe at any time without affecting the lawfulness of processing carried out before withdrawal.

For resource delivery and related administration, we rely on our legitimate interests in responding to requests, providing useful resources and maintaining accurate records of those requests. Where you choose to receive the Private Practice Matters newsletter or other marketing updates, we rely on your consent. We record the consent status, date and time, form or page source, and the wording presented when consent was obtained so that we can demonstrate your choice. We retain these records in accordance with the retention periods explained below.

We may convert personal data into information that no longer identifies any individual. We may use and retain genuinely anonymised information for statistical, management and service-improvement purposes.

Website analytics and cookies

Our website uses analytics technologies to understand how visitors use it, diagnose problems and improve content and performance. Where an analytics cookie or similar technology is not strictly necessary, we will seek consent before using it. You can change or withdraw your cookie choices through the controls made available on our website. Further details, including the technologies used, their purposes and retention periods, should be set out in our website cookie notice.

The legal bases for our intended processing of personal data

We rely on one or more of the following lawful bases, depending on the purpose and circumstances:

• Contract: processing is necessary to take steps at your request before entering into a contract or to perform a contract with you.
• Legal obligation: processing is necessary to comply with legal, regulatory or professional duties, including anti-money-laundering, tax, accounting and record-keeping requirements.
• Legitimate interests: processing is necessary to operate and protect our business, deliver and improve services, administer client relationships, recover debts, prevent fraud, secure our systems and website, obtain professional advice, defend claims and, where appropriate, communicate about relevant services. We balance these interests against your rights and interests.
• Consent: where the law requires consent, including for certain marketing or optional cookies. Consent may be withdrawn at any time without affecting earlier lawful processing.

Where we collect information directly from you, some information is required to enter into or perform a contract, or to meet a legal or regulatory requirement. If you do not provide it, we may be unable to start or continue the relevant service. Other information is optional, and we will make this clear when we collect it.

Categories of personal data collected

The information we hold may include:

• identity and contact information, including names, addresses, dates of birth and identification documents;
• business, employment, company, directorship and professional information;
• financial, banking, payment, tax, accounting, payroll, pension, billing and debt information;
• information needed for anti-money-laundering, sanctions, fraud-prevention and regulatory checks;
• service, engagement, transaction, correspondence, call, enquiry, complaint and relationship-management records;
• information supplied by or about employees, contractors, clinicians, patients, customers, suppliers, shareholders, directors, beneficial owners and other relevant contacts;
• technical and usage information, including IP address, device, browser, operating system, referring page, pages viewed, dates, times and cookie or similar identifiers collected through our website. Where our website or marketing system records an IP address or other technical audit data as part of its standard form-submission process, we use that information for security, fraud prevention and, where applicable, demonstrating the circumstances in which consent was given;
• marketing preferences and consent records; resource-request history, including the resource requested; optional speciality and practice or organisation information; form or page source; feedback and survey responses; and
• where necessary and lawful, special-category information or criminal-offence information.

Special-category and criminal-offence information

We do not seek sensitive information unless it is necessary for a specified service or legal requirement. Where we process special-category information—such as health information—we identify an Article 6 lawful basis and an Article 9 condition under the UK GDPR. This may include processing necessary for employment, social-security or social-protection obligations, substantial public-interest reasons, or the establishment, exercise or defence of legal claims, as applicable. Where required, we also meet a condition in Schedule 1 to the DPA 2018 and maintain an appropriate policy document. Criminal-offence information is processed only where authorised by law and subject to appropriate safeguards.

Source of personal data collected

We may obtain personal data:

• directly from you, including through proposals, contracts, email, telephone, post, social media, website enquiry forms, resource-request forms, newsletter subscription forms and meetings;
• from our clients, your employer, colleagues, authorised representatives, accountants, advisers, suppliers, customers, clinicians, secretarial and billing providers, and other relevant business contacts;
• from HMRC, Companies House, regulators, professional bodies, law-enforcement bodies and other public authorities;
• from publicly available sources, credit-reference, identity-verification, sanctions and fraud-prevention providers; and
• automatically through our website and systems, including cookies and analytics technologies.

Where we obtain your personal data from someone else, we will provide this privacy information within the period required by law—normally within one month, at our first communication with you, or before the first disclosure—unless an exemption applies.

Persons / organisations to whom we may give personal data

We may share your personal data with:

• our clients, your employer and people whom you or our client authorise us to contact;
• HMRC, Companies House, pension providers, banks, payment providers and other relevant authorities or institutions;
• AAT, OPBAS and other regulators or professional bodies;
• accountants, solicitors, auditors, consultants and other professional advisers;
• professional-indemnity, tax-protection and other insurers, together with their advisers;
• IT, cloud-hosting, email, file-storage, backup, cybersecurity, website, analytics, communications, customer relationship management, email-marketing, practice-management, payroll, billing, payment and other service providers;
• subcontractors and an alternate appointed to protect client interests in the event of incapacity or death;
• debt-recovery providers and courts where necessary to recover sums due or protect legal rights; and
• another organisation in connection with a proposed sale, restructuring or transfer of our business, subject to appropriate confidentiality safeguards.

If the law allows or requires us to do so, we may share your personal data with:

• the police and law enforcement agencies
• courts and tribunals
• the Information Commissioner’s Office (“ICO”)

We may need to share your personal data with the third parties identified above in order to comply with our legal obligations, including our legal obligations to you. If you ask us not to share your personal data with such third parties we may need to cease to act.

International transfers

Some of our suppliers or their support teams may process personal data outside the United Kingdom. Before making a restricted transfer, we use a lawful transfer mechanism, such as UK adequacy regulations, the UK International Data Transfer Agreement, the UK Addendum to approved standard contractual clauses, or another mechanism permitted by law. We also carry out appropriate due diligence and apply contractual, organisational and technical safeguards. You may contact Gary Marshall for further information about the safeguards used.

Retention of personal data

When acting as a data controller and in accordance with recognised good practice within the tax and accountancy sector we will retain all of our records relating to you as follows:

• client, tax, accounting, payroll, billing, advisory and engagement records are normally retained for seven years after the end of the relevant tax year, accounting period or business relationship, as appropriate;
• anti-money-laundering and identity-verification records are retained for the period required by applicable law;
• website analytics information is retained in accordance with the settings applied to our analytics service and our cookie arrangements, and is not kept longer than necessary for the stated purpose;
• resource-request records are retained only for as long as needed to deliver the resource, administer the request, understand interest in our resources, improve the relevance of future information and meet applicable legal or evidential requirements. Newsletter and marketing subscription records are retained while you remain subscribed. If you opt out or withdraw consent, we retain only the minimum suppression and consent-history information needed to respect and demonstrate your choice; and
• records may be retained for longer where required by law, regulation, insurance, a complaint, an investigation, litigation, a legal hold or the establishment, exercise or defence of legal claims.

When the applicable retention period ends, we securely delete or anonymise the information. Where we act as a processor, we delete or return personal data in accordance with the client’s documented instructions and our written data-processing terms.

Complaints

Questions about this privacy notice, requests to exercise your data-protection rights and complaints about our handling of personal data should be directed to Gary Marshall, Data Representative, at JW Medical Management Ltd, Suite 30/31, Normanby Gateway, Lysaghts Way, Scunthorpe DN15 9YG, or by email at gary@jw-medical.co.uk. If you have problems accessing a requested resource or need general assistance, please contact info@jw-medical.co.uk.

We would welcome the opportunity to resolve your concern. You also have the right to complain to the Information Commissioner’s Office. Further information is available at www.ico.org.uk.