Privacy notice

01Who we are

Jorja Medical Cannabis is a private healthcare provider offering specialist consultations and ongoing clinical care to adults in the United Kingdom. This notice explains what personal information we hold about you, why we hold it, who we share it with and what rights you have over it.

The data controller for the information described in this notice is [registered company name to be confirmed], a company registered in England and Wales, company number [company registration number to be confirmed], registered office [registered office address to be confirmed]. We are registered with the Information Commissioner's Office under registration number [ICO registration number to be confirmed].

If you are reading this before becoming a patient, most of it still applies to you. We treat enquiry information with the same care as patient information.

02The information we collect

We collect only what we need to assess you safely, provide your care and meet our legal duties. The categories below cover everything we hold.

• Identity and contact details: your name, date of birth, address, email address and telephone number, and proof of identity where we are required to verify it.
• Eligibility information: the answers you give in our online eligibility check, including your condition, how long you have had it and what treatments you have already tried.
• Health data: your diagnosis, symptoms, medical history, current and previous medicines, allergies, test results, consultation notes, prescriptions issued and correspondence with your GP or other clinicians. This is special category data under Article 9 of the UK GDPR.
• Membership and payment information: your membership start date, billing history and payment status. Card details are handled by our payment provider and are not stored by us.
• Communications: emails, messages, and notes of telephone calls with our patient support team.
• Technical information: how you use this website, as described in our cookie policy.

03Our lawful bases for using your information

UK data protection law requires us to identify a lawful basis for each use of your personal data, and an additional condition for health data.

• Article 6(1)(b), performance of a contract: to deliver the membership and clinical services you have signed up for, including booking appointments, administering repeat prescriptions and taking payment.
• Article 6(1)(f), legitimate interests: to run and improve the clinic safely, to keep proper records, to respond to enquiries, to prevent fraud and to protect our legal position. We balance these interests against your rights and we do not rely on this basis where your interests override ours.
• Article 6(1)(c), legal obligation: where we must retain or disclose information under law, for example controlled drugs record keeping or a court order.
• Article 9(2)(h), provision of health care and management of health care systems and services: this is our condition for processing health data. It allows a healthcare provider to process health data for medical diagnosis, the provision of care and treatment, and the management of health care services, subject to the duty of confidentiality.
• Article 9(2)(c), vital interests: in an emergency where you are unable to give consent and there is a risk to life.
• Consent: for optional things such as marketing emails, and for requesting your records from third parties. You can withdraw consent at any time, and withdrawing it does not affect processing already carried out.

We do not rely on consent as our lawful basis for delivering your clinical care. If we did, withdrawing consent would require us to stop keeping the safe clinical record we are professionally obliged to maintain.

04Where your medical records come from

A specialist cannot prescribe safely without an accurate picture of your health, so we ask for your medical records before your assessment. Records may come from your GP practice, from an NHS trust, from a previous private clinic, or from you directly if you have already obtained a copy.

We request records only with your consent, and we tell you what we are asking for and why. You can obtain your own records instead if you prefer: you have a right of access to them, and your GP practice can provide a summary care record. If records cannot be obtained, we will tell you plainly how that affects your assessment rather than proceeding without them.

We also write to your GP, with your consent, so that your NHS record shows what you are taking. Joined up records are safer for you, particularly if you are ever treated in an emergency.

05Who we share your information with

We never sell your data and we never use your health information for advertising. We share it only where it is necessary for your care or required by law.

• Your clinical team: the specialist doctor, pharmacist and any multidisciplinary team members involved in reviewing your case.
• Your GP: with your consent, so your main health record is complete.
• The dispensing pharmacy: your prescription and the contact details needed to dispense and deliver it to you.
• Our processors: IT and hosting providers, our clinical record system, our secure video consultation provider, our payment provider and our email provider. Each is bound by a written contract that limits them to acting on our instructions.
• Regulators and authorities: where we are legally required to disclose, for example to the Care Quality Commission, the General Medical Council, the police under a lawful request, a court, or the Medicines and Healthcare products Regulatory Agency when reporting a suspected adverse reaction.
• Safeguarding partners: where we have a duty to raise a concern about a child or an adult at risk, as set out in our safeguarding statement.

06International transfers

We aim to keep personal data within the United Kingdom or the European Economic Area. Some of our technology suppliers process data outside those areas, for example in the United States.

Where that happens, we rely on UK adequacy regulations, or on the International Data Transfer Agreement or the UK Addendum to the European Commission standard contractual clauses, together with a transfer risk assessment. You can ask us which suppliers are involved and what safeguards apply.

07How long we keep your information

We keep clinical records for the periods expected of UK healthcare providers, and no longer than we need to.

08Your rights

You have the following rights over your personal data. To use any of them, contact our Data Protection Officer using the details below. We will respond within 1 month, and we will tell you if we need longer because the request is complex.

• Access: you can ask for a copy of the personal data we hold about you, including your clinical record. We provide this free of charge.
• Rectification: you can ask us to correct inaccurate information. Where a clinical opinion is recorded and you disagree with it, we will not delete the opinion, but we will record your disagreement alongside it.
• Erasure: you can ask us to delete your data, but this right is limited for medical records. We must keep clinical records for the retention periods above in order to meet legal and professional obligations, so we will usually be unable to erase them even after you leave the clinic.
• Restriction and objection: you can ask us to pause or stop certain processing, including processing based on our legitimate interests.
• Portability: where processing is based on consent or contract and carried out by automated means, you can ask for your data in a structured, machine readable format.
• Withdraw consent: you can withdraw consent for anything we do on that basis, including marketing and further record requests.
• Automated decisions: we do not make decisions about your care by automated means. Our online eligibility check is a filter to save you time and is never a clinical decision.

09How we keep your information secure

Your records are held in access controlled clinical systems, encrypted in transit and at rest. Access is limited to staff who need it for your care and is logged. Our staff receive information governance training, and confidentiality obligations are written into their contracts.

If a personal data breach occurs that is likely to result in a risk to your rights, we will report it to the Information Commissioner's Office within 72 hours and tell you where we are required to.

10Cookies

This website uses a small number of cookies. What we set, why we set it and how to change your choices are set out in full in our cookie policy.

11Complaints about how we use your data

Please raise it with our Data Protection Officer first, so that we can put it right. If you are not satisfied, you can complain to the Information Commissioner's Office at any time.

Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. Telephone 0303 123 1113. Website ico.org.uk.

12How to contact us

Data Protection Officer, Jorja Medical Cannabis, [Data Protection Officer name to be confirmed], [DPO email address to be confirmed], [postal address to be confirmed].

If your query is about your care rather than your data, contact patient support instead and we will get it to the right person.

13Changes to this notice

We review this notice at least once a year and whenever our processing changes. The date at the top of this page shows when it was last updated. If we make a change that materially affects you, we will tell you directly rather than relying on you to notice it here.