Privacy Notice
Merrion Wellness Ltd, Trading As The Merrion Clinic
As you may know already on May 25th the new General Data Protection Regulation (GDPR) will come into force. It will introduce big changes in how your personal data are collected, processed, stored and archived.
The aim of this Notice is to explain to you as our patient - as Data Subject - what kind of personal information we gather on you, why and how we process it as data controller.
Please note from time to time, we may update this Notice, and any new version will be posted on our website. We recommend you regularly review it to ensure that you are always aware of our privacy practices.
1. Your data are safe with us
If you decide to attend The Merrion Clinic, we will need to know about your health status. This info is considered “sensitive personal data” and we will handle it carefully.
We will keep your data safe, train our staff to properly manager your personal data and we will ensure you can exercise your rights.
Your data will not be shared with any third party and they will be only accessible to the relevant clinic staff to allow us to best manage your case.
2. Why we need your data
Data Protection laws say that we are allowed to use personal data where we have a proper reason to do so. We will use your personal data to perform our agreement with you, i.e. to help you to get well, and to pursue our legitimate interest, in particular:
· To measure your current health and to show any progress made.
· To identify the best therapy and treatment available in our clinic to support your health.
· We may also contact you in relation to any appointments made and to respond to any questions or concerns.
3. Data Subjects type detail
Explicit consent is required for The Merrion Clinic, to process both personal and sensitive data. Where we are asking you for sensitive personal data we will always tell you why and how the information will be used.
We collect your data through an Online Health Questionnaire that you consent to complete, in order for us to best manage your individual health program.
Further information is collected during consultations with our clinic practitioner such as but not exclusive to:
Personal Details: Name, Address, Contact Details, Occupation;
Health data (medical history, diet, family medical history, GP name and address etc), lifestyle choices, mental clarity and moods.
4. How we use your personal information
We use the personal information we collect to ascertain your current well being so we can work with you on a specialized basis tailoring our program to suit your needs.
5. We justify our processing of clients personal information on the following legal bases:
In order to perform our obligation under our agreement with you, to empower clients to achieve optimum health, vitality and wellness on a physical, mental, emotional, & spiritual level.
We have determined that our legitimate interests include the following:
The Merrion Clinic provides a program of nutritional guidance & naturopathic cleansing, in combination with other therapies to support the body. It draws from the best, working systems of traditional Chinese medicine, ancient and modern nutritional wisdom, longevity systems and effective psycho-spiritual methodologies.
The purpose of our program is to equip the modern individual with the tools necessary to be able to live at the pinnacle of life experience.
Our aim is to help empower clients achieve optimum health, vitality and wellness on a Physical, Mental, Emotional & Spiritual level. Helping you live life consciously, radiating with joy & happiness.
6. Data Subject rights
The GDPR has clearly stated what the Data Subjets (you) rights are, under certain circumstances, in relation to their personal information:
• Right to access personal information
• Right to rectify personal information
• Right to restrict the use of personal information
• Right to request that personal information is erased
• Right to object to processing of personal information
• Right to data portability (in certain specific circumstances)
• Right to lodge a complaint with a supervisory authority.
If you wish to exercise these rights, you can contact us at The Merrion Clinic , 50 Merrion Square East, Dublin 2.
Where you request us to exercise one of these rights, we shall provide information on the action we take on the request without undue delay and in any event within one month of receipt of the request. This may be extended by a further two months in certain circumstances, for example where requests are complex or numerous. The information will be provided free of charge, except where requests are manifestly unfounded or excessive, in particular because of their repetitive character. In these circumstances we may charge a reasonable fee or may refuse to act on the request. We will advise you of any fees prior to proceeding with a request. We may ask for additional information to verify your identity before carrying out a request. Where we do not carry out a request, we shall inform you without delay and within one month of receipt of the request, providing our reasons for not taking the action requested.
6.1 Right to access personal information
Individuals have the right to confirm the following with us:
• Whether or not we process personal information about them
• Certain specified information about the processing
Individuals also have a right to access the personal information and be provided with a copy.
6.2 Right to restrict processing of personal information
Individuals have the right to request that we restrict processing of their personal information where one of the following applies:
• An individual contests the accuracy of the personal information.
The restriction will apply until we have taken steps to verify the accuracy of the personal information;
• The processing is unlawful but an individual does not want the personal information to be erased and requests restriction instead;
• We no longer require the personal information for the purposes of processing, but it is still required by an individual in connection with a legal claim;
• An individual has exercised their right to object to the processing.
The restriction will apply until we have taken steps to verify whether we have compelling legitimate grounds to continue processing.
6.3. Right to object to processing of personal information
Where personal information is used to target marketing to an individual, they have the right to object to this at any stage. An individual also has the right to object to processing of their personal information where the legal basis of the processing is in our legitimate interests. We will have to stop processing until we are able to verify that we have compelling legitimate grounds for processing which override the individual’s interests, rights and freedoms, or alternatively that we need to continue processing for the establishment, exercise or defence of legal claims.
6.4 Right to rectification of personal information
If an individual believes that the personal information we hold on them is inaccurate, they may request that it be amended.
6.5 Right to request erasure of personal information (“right to be forgotten”)
An individual may also request the erasure of their personal information in certain circumstances, including the following (this is not an exhaustive list): • The personal information is no longer necessary in relation to the purposes for which they were collected or otherwise processed; • The processing was based on consent which has been withdrawn and there is no other legal basis for processing; • The individual has exercised their right to object to the processing and there are no overriding legitimate grounds for the processing to continue. There are also certain exceptions where we may refuse a request for erasure, for example, where the personal information is required to comply with a legal obligation or for the establishment, exercise or defence of legal claims. If an individual does request erasure of their personal information, this will potentially remove records which we hold for their benefit, such as their presence on a suppression list and they will have to contact us to provide personal information if they wish for us to hold this in future.
6.6 Right to Data Portability
Where we are relying upon the legal basis either of consent or that the processing is necessary for the performance of a contract to which an individual is a party, and that personal information is processed by automatic means (e.g. electronically), an individual has the right to receive all the personal information which they have provided to us in a structured, commonly used and machine-readable format and to transmit this to another controller (for example your GP) directly, where this is technically feasible.
6.7 Supervisory Authority
An individual also has a right to lodge a complaint with a supervisory authority, in particular in the Member State in the European Union where they are habitually resident, where they work or where an alleged infringement of Data Protection laws has taken place.
7. Marketing Communications
If you have given consent to be kept informed about upcoming events, talks, seminars, products and services offered by The Merrion Clinic, we will keep you informed by email.
Our email marketing campaigns published may contain tracking facilities within the actual email. This allows for subscriber activity to be tracked and stored in a database for future evaluation and analysis. The information collected may include but is not limited to: the opening of emails, forwarding of emails, the clicking of links within the email content, times, dates and frequency of activity. This information is solely used to refine future email campaigns and to provide the user with more relevant content based on their activity.
Users can unsubscribe at any time. This process is detailed at the footer of each email campaign. If an automated un-subscription system is unavailable clear instructions on how to un-subscribe will by detailed instead.
Upcoming Appointments
We will also keep you informed of any upcoming appointments by text and/or email if you have consented for us to do so. This preference can be changed at any time.
All personal details relating to subscriptions are held securely and in accordance with the GDPR.
No personal details are passed on to third parties or shared with anyone outside of the company.
Under the GDPR you may request a copy of any personal information we hold about you. If you would like a copy of this information, please write to the business address The Merrion Clinic, 50 Merrion Square East, Dublin 2.
8. Sharing Data
The Merrion Clinic do not share, sell or rent information about you, with other people or non-affiliated companies, except to provide products or services that you have requested, when we have your permission.
9. International transfers
We may store personal information in locations outside the direct control of The Merrion Clinic (for instance, on server or databases co-located with hosting providers).
Our data is stored in the following locations:
FORMSITE
Formsite is a tool that allows you to create online forms and surveys. For information on Formsite and GDPR please visit
https://blog.formsite.com/2017/12/19/gdpr-privacy-shield-eu/
DROPBOX
Dropbox is a cloud storage and synchronization service where files, folders, and documents are created, accessed, and shared.
For information on Dropbox and GDPR please visit:
https://www.dropbox.com/security/GDPR
TM3
TM3 is modern and intuitive private practice and appointment software system. For details of TM3 and GDPR please visit:
https://www.tm3practicemanagement.com/learning/TM3-GDPR/
COALITION
Some clients have explicitly signed up with the Coalition Website in order for the clinic practitioner to communicate with them.
10. Retention Periods
We will retain your personal information covered by this Notice for as long as required to perform the purposes for which the data was collected.
In general terms, this will mean that personal information will be kept for the duration of our relationship.
This will generally be the length of the relationship plus the length of any applicable statutory limitation period under applicable law.
After your last visit to the clinic, we will keep your data for maximum 8 years. After 8 years have passed since your last appointment, and if we haven’t heard from you in the meantime, we will permanently delete all your personal data.
You can ask us to delete your data before 8 years have passed. You will only need to send us a written request (the so called Right to be forgotten).
You can also inform us if your personal details change and they need to be updated (the so called Right of Rectification).
If you need to pass the personal data you have with us to another practitioner or your GP, we will be happy to do so following receiving a written request from you that authorizes the clinic to transfer your data (Right of Portability).
In certain circumstances, data may need to be retained for a longer period of time, for example, where we are in ongoing correspondence or there is a continuing claim or investigation.
Your personal data will be safely stored on our computers, filing cabinets and on the cloud.
11. The Merrion Clinic’s Website
The clinic’s website is hosted by Squarespace.
This website operates an email signup program, used to inform subscribers about products and services supplied by The Merrion Clinic. Users can subscribe through an online automated form, at their own discretion. Some subscriptions may be manually input through prior written agreement with the user eg those attending and signing up at events. All personal details relating to subscriptions are held securely and in accordance with the GDPR.
You can view their privacy policy at the link below: https://support.squarespace.com/hc/en-us/articles/360000851908-GDPR-and-Squarespace
12. Confidentiality and Security
We have implemented reasonable technical and organisational measures designed to secure personal information from accidental loss and unauthorised access, use, alteration or disclosure. Our employees are required to follow specific procedures with respect to maintaining the confidentiality of our client’s personal information. Additionally, we maintain physical, electronic, and procedural safeguards to protect the personal information that we process. This includes performing ongoing evaluations of our systems containing clients’ information and making changes when appropriate.
13. Business Contact Information
Name: Merrion Wellness Ltd Trading as The Merion Clinic
Address: 50 Merrion Square East, Dublin 2, Ireland
Tel: 00353 1 678 7972
Clinical Director:
Bruce Du Vé, B Ac (London), C. Herb (Nanjing) M.I.A.Ac. Studied at Nanjing University of Traditional Chinese Medicine and has 34 years clinical experience.
Clinic Manager and Data Protection Officer:
Catherine Walsh, BSc (Hons) Computer Science
Clinic Website: www.themerrionclinic.com
14. Cookies policy
Our website uses cookies. Cookies are small text files that are placed on your machine to help the site provide a better user experience. In general, cookies are used to retain user preferences and store information for things like shopping carts. They also provide anonymous tracking data to third party applications like Google Analytics, to track and monitor your engagement and usage of the website. No personal information will be collected or stored. You can read Google’s privacy policy by clicking the link http://www.google.com/privacy.html.
However, you may prefer to disable cookies on this site. The most effective way to do this is to disable cookies in your browser. We suggest consulting the Help section of your browser to find out how.