At Kalsi & Kalsi our mission is to support every individual in developing a healthy lifestyle in an effective and convenient way. We are passionate about privacy and strive to comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA), and to be market leaders when it comes to healthcare and privacy.
This policy explains how we use your personal data. We want to help you understand how we work with your data, so that you can make informed choices and be in control of your information. We invite you to spend a few moments understanding this policy. We may update this policy from time to time and we will notify you when we do so.
This policy explains how we use your personal data for our healthcare services and products. It also governs the use of your data through the apps we use and our websites (and any reference to “our Apps” in this policy shall also include a reference to these apps and our websites).
This policy covers:
- Who we are;
- What personal data we hold and how we get it;
- What we use your personal data for;
- Sharing your personal data;
- Data security and transfers; and
- Your rights. If you have any further questions about how we process your information, please don’t hesitate to get in touch by contacting us via [email protected]
Who we are
Our healthcare services are delivered by Kalsi Health Ltd, a company registered in England and Wales (number 11550868), operating under the Kalsi & Kalsi trademark. The registered office for our company is 85 Great Portland Street, First Floor, London, W1W 7LT/
Your relationship is with Kalsi Health Ltd. When this policy talks about ‘Kalsi & Kalsi’, ‘Kalsi Health’, ‘us’ or ‘we’, it means Kalsi Health Ltd.
What personal data we hold and how we get it
We use the following categories of personal data:
- Personal details
- When you register with us, you complete forms and provide us with basic information about yourself, such as your name, date of birth, physical address and email address.
- Health and medical information
- The main type of information we hold about you is health and medical information: information about your health, symptoms, treatments, consultations and sessions, medications and procedures. This includes details of your consultations with our doctors, and interactions with our digital services.
- We get some of this information directly from you, when you register with us and when you use our healthcare services. If you have asked for us to do so, we will send the consultation notes that we take during your use of our service to your GP. Any correspondence will occur via e-mail, Calendly, Telegram messenger and Doxy.me services.
- We may also hold information about you and your health from other apps, devices and services where you have given your consent to that data being shared with us. Examples include where you decide to share information collected from an app monitoring your sleep.
- Financial information
- If you make any payments on the Apps, your credit/debit card details are processed directly by a third party processor that will store all payment information and transaction details. We will only retain details of transactions on secure servers and we will not retain your credit or debit card information.
What we use your personal data for
The purposes for which we use your personal data and the legal grounds on which we do so are as follows:
- We obtain and use your personal details and financial details in order to establish and deliver our contract with you.
- We obtain and use your medical information because this is necessary for medical purposes, including medical diagnosis and the provision of healthcare or treatment. This includes the information collected through our consultations with you (such as notes and recordings), our digital services, and medical history from your previous GP if you collect it and consent to our use of it. It may also include sharing information with other healthcare professionals as necessary for the provision of care to you, such as your GP, specialist referral services, therapists, pharmacists, hospitals, accident and emergency services, pathology service providers, and diagnosis centres chosen by you for the purpose of imaging request forms.
- Where you have provided your explicit consent, we will use your medical information (always having removed personal identifiers, such as your name, address and contact details) to improve our healthcare products and services so that we can deliver better healthcare to you and other Kalsi & Kalsi users. This medical information (de-identified in the way described above) may include your medical record (both records received and created by us), transcripts of your interactions with us. This does not involve making any decisions about you - it is only about improving our products, services and software so that we can deliver a better experience to you and other Kalsi & Kalsi users, and help achieve our aim of making healthy lifestyle support affordable and accessible to everyone. Strict confidentiality and data security provisions apply at all times.
- We may obtain and use data about your precise location where you give your consent (through providing us access to your location), for example, to help direct you to relevant local services. We may also derive your approximate location from your IP address.
- We use your email address and/or phone number to contact you with occasional updates and marketing messages where you have not opted out, based on our legitimate interest in marketing our services to you and subject to your right to opt out at any time.
- Based on our legitimate interest in managing and planning our business, we may analyse data about your use of our products and services to, for example, troubleshoot bugs within the Apps, forecast demand of service and to understand other trends in use, including which features users use the most and find most helpful, and what features users require from us. This does not involve making any decisions about you - it is only about improving our Apps so that we can deliver better services to you. Strict confidentiality and data security provisions will apply at all times.
- Where necessary, we may need to share personal and financial details for the purposes of fraud prevention and detection.
- We also store your medical information, such as notes from consultations and your interactions with our digital services, for safety, regulatory, and compliance purposes. For example, we may need to review your information and, where necessary, make disclosures in compliance with reasonable requests by regulatory bodies including the General Medical Council or as otherwise required by law or regulation.
- Where necessary for safety, regulatory and/or compliance purposes, we may audit consultations and your other interactions with our services. Strict confidentiality and data security provisions will apply at all times to any such audit and access.
Sharing your personal data with others
- We may share your personal data with companies we have hired to provide services on our behalf, including those who act as data processors on our behalf, acting strictly under contract in accordance with Article 28 GDPR. Those data processors are bound by strict confidentiality and data security provisions, and they can only use your data in the ways specified by us.
- We may share with our commercial partners aggregated data that does not personally identify you, but which shows general trends, for example, the number of users of our service.
- Where you access our services through your health insurance provider, and where you have given your consent, we will need to let your insurance company know your name, email address, policy number, location (based on IP address), demographic information, that you had an appointment with us, the date of the appointment, details of your diagnosis, prescription, pharmacy location, whether or not you had a referral made and other similar information about your appointment with us.
- We will, where necessary for your treatment or care, share your information with your other health and social care providers. For example, your GP, specialist referral services, therapists, pharmacists, hospitals, accident and emergency services, pathology service providers, diagnosis centres chosen by you for the purpose of imaging requests, and other health and care bodies. This may include sharing information with such services for safeguarding purposes in accordance with our legal obligations.
- We may preserve or disclose information about you to comply with a law, regulation, legal process, or governmental request; to assert legal rights or defend against legal claims; or to prevent, detect, or investigate illegal activity, fraud, abuse, violations of our terms, or threats to the security of our services or the physical safety of any person. Except as described above, we will never share your personal information with any other party without your consent.
We retain your medical records in accordance with national best practice guidance - in particular, advice provided by the Department of Health (2006) Records management: NHS code of practice, and summary guidance issued by the British Medical Association. The below is a summary of our retention policy, but we may retain records for other periods as required by law or regulation.
- Records retained for 10 years after death or after the patient has permanently left the country unless the patient remains in the European Union. In the case of a child, if the illness or death could have potential relevance to adult conditions or have genetic implications for the family of the deceased, the advice of clinicians should be sought as to whether to retain the records for a longer period. Electronic patient records (EPRs), as held in our Apps, must not be destroyed, or deleted, for the foreseeable future.
Data storage, security and transfers
- We do not store your personal health data. All your personal health data - including your lifestyle information, medication information and diagnostic information - is stored on your device(s) and on secure (cloud) servers held by our partner companies such as Calendly, Telegram and Doxy.
- Where you have chosen a password that enables you to access certain parts of the Apps, you are responsible for keeping this password confidential. We ask you not to share the password with anyone.
- We do not store any credit or debit card information. Payments are processed via a third party payment provider (Stripe) securely.
- Your data may be processed or stored via destinations outside the European Economic Area, but always in accordance with data protection law and subject to strict safeguards. For example, we work with third parties to use their software platforms who have servers outside the UK or EEA to send communication emails to our users.
As indicated above, whenever we rely on your consent to process your personal data, you have the right to withdraw your consent at by contacting us either through the apps or [email protected] You also have specific rights under the GDPR and DPA to:
- Wherever we process data based on your consent, withdraw that consent at any time;
- Understand and request a copy of information we hold about you. All health and lifestyle information held and exchanged is kept within the Telegram messenger app. For other information, you can make a request by email;
- Ask us to rectify or erase information we hold about you, subject to limitations relating to our obligation to store medical records for prescribed periods of time;
- Ask us to restrict our processing of your personal data or object to our processing; and
- Ask for your data to be provided on a portable basis. You may also contact the Information Commissioners Office (the data protection regulator in the UK): Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone: 0303 123 1113 (local rate).
For any questions or concerns, you can contact us by sending an email to [email protected]