What is Klinik?

Klinik is a healthcare technology company who provides automated digital solutions to healthcare providers to help triage and prioritize patients based on the symptoms they provide. Klinik has entered into an arrangement with your GP or other healthcare provider (referred to this Privacy Notice as “Your Healthcare Provider”) to enable you to use the Klinik technology for the purpose of accessing the services you specifically need, based on your clinical presentation. That technology has to make use of your personal data, i.e. information relating to you from which you can be identified, and this privacy notice sets out the basis on which that data is used by Klinik.

The law distinguishes between ‘controllers’ and ‘processors’, whereby controllers have ultimate responsibility for how and why your personal data is used, or ‘processed’ which is the legal terminology, and processors follow the instructions of controllers when using personal data. Klinik is both controller and processor, depending on the specific ways in which your personal data is being processed by our technology.

Klinik has developed a Medical Engine, or ‘ME’ for short, which is designed to support healthcare providers and patients alike by triaging an individual’s symptoms in order to assess their potential clinical diagnoses and the urgency with which they need to be seen by a healthcare professional. Medical Engine uses an automated process, or algorithm, which is designed to run without human intervention using the specific personal data, including symptoms, that you enter.

Klinik as processor

Klinik will be the processor for the digital interface you use to enter your personal details and relevant clinical information, as Your Healthcare Provider will be the controller for that personal data. Klinik will also be the processor for the personal data which comprises the suggested diagnosis and clinical urgency our technology provides to Your Healthcare Provider, because it is those healthcare professionals who validate that information and determine what to do with it. All directly identifiable data is processed in our capacity of a processor under instructions from Your Healthcare Provider.

The personal data processed by the Medical Engine is ‘pseudonymized’ meaning that the identifiers have been removed such that you cannot be directly identified from it without using additional information, but it is still considered personal data in a legal sense. Klinik is the processor for the automated processing of that pseudonymized data, which enables our Medical Engine to provide a suggested diagnosis and indication of your clinical urgency to Your Healthcare Provider by carrying out an automated healthcare assessment.

Klinik as controller

We would also like to use the pseudonymized data processed by the Medical Engine in order to assess the quality and improve our product, technology and services, to include ensuring that the Medical Engine continually improves and safeguards patient safety, but only if you have given your explicit consent to us doing so. This is set out in further detail below, but in essence we will only use your data for these purposes beyond the healthcare needs assessment where you have specifically and explicitly confirmed that you consent to us doing so.

Information in this privacy notice

We are required under data protection legislation to notify you of certain information about how we will use your personal data when acting as controller, and we do so in this privacy notice. Please note that you should refer to the privacy notice of Your Healthcare Provider to find out the basis on which they process your personal data when they are acting in the capacity of controller.

It is important that you read and retain this notice, together with any other privacy notice we may provide on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information and what your rights are under the data protection legislation.

Data protection principles

We will comply with data protection law. This requires that the personal information we hold about you is:

1. Used lawfully, fairly and in a transparent way.

2. Collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes.

3. Relevant to the purposes we have told you about and limited only to those purposes.

4. Accurate and kept up to date.

5. Kept only as long as necessary for the purposes we have told you about.

6. Kept securely.

The kind of information we hold about you

Personal data, or personal information, means any information about an individual from which that person can be (in)directly identified. It does not include data that does not allow you to be identified (anonymous data), but does include data where the identity has been removed but can be re-added so as to render the data identifiable again (pseudonymous data).

There are certain types of more sensitive personal data which require a higher level of protection, such as information about a person's health or sexual orientation. This is known as ‘special category data’, and more detail on our approach in respect of this data is set out below.

In order for you to use the Klinik technology, Klinik in its role as processor (i.e. in respect of directly identifiable data collected from you in order to carry out the healthcare needs assessment and to provide a suggested clinical diagnosis and urgency to Your Healthcare Provider) will need to collect the following personal data:

• Personal and contact details
• First and last name
• Age
• Sex
• National Insurance Number or other personal identity code such as NHS number
• Home address
• Contact information (address, telephone number, and email address)
• IP address and other technology log information
• Approximate location of device using the patient form (if user consents to provide it)

We will also need to collect the following special category data to enable the technology to make a fully informed assessment:

• Current symptoms and ailments forming the basis of your proposed interaction with Your Healthcare Provider

Klinik in its role as controller would like to collect and use the following personal data:

• Age
• Sex
• Current symptoms and ailments

Please note, in line with the GDPR, all information that allows you to be directly identified will be stored separately by Klinik and be adequately secured to prevent identification.

Purpose of processing your personal data

The primary purpose of processing your personal data is in order to carry out an automated healthcare needs assessment based on pseudonymized data, which in turn supports Your Healthcare Provider in respect of your potential clinical diagnosis and the urgency with which you need to be seen and reviewed by a healthcare professional. Please note that it is entirely up to Your Healthcare Provider, and not Klinik, to decide on your diagnosis and whether, and if so when, any clinical intervention is required. Klinik will also, where you have given us your consent, use your personal data in pseudonymized form to develop and improve our products, service and technology. We will not use or disclose your personal data for marketing purposes.

What is our lawful basis for using your personal data?

Processing for the purpose of the automated healthcare needs assessment

We rely upon the following lawful bases for this particular processing:

• Article 6(1)(f), on the basis that it is necessary for the legitimate interest of providing you with an automated healthcare needs assessment which you have chosen to undertake in connection with your access to healthcare services; and
• Article 9(2)(h), on the basis that it is necessary to provide a healthcare service.

As described above, this particular use of your pseudonymized data is used in order to support Your Healthcare Provider with a suggested clinical diagnosis and urgency. This form of processing is directly related to your clinical care and treatment, and so we do not need to rely upon your consent in order to use it for those particular purposes.

Processing for the purpose of improving technology and services

Change of purpose

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law.

Automated decision-making or profiling

Automated decision-making or profiling takes place when an electronic system uses personal information to make a decision without human intervention. There are specific limitations and restrictions set out in the UK GDPR in respect of such decision-making and/or profiling which produces legal or similarly significant effects.

You will not be subject to decisions or profiling that will have a significant impact on you based solely on automated decision-making. Our technology does run on an automated basis, using the algorithm built into the Medical Engine, but the outputs it produces are supportive in nature and, crucially, have to be validated by human intervention i.e. Your Healthcare Provider who will review your suggested diagnosis and/or indication of clinical urgency before making a decision themselves on how to proceed.

Data sharing

Your personal data collected and processed by the Klinik technology, including the outcome of the automated healthcare needs assessment, will be shared with Your Healthcare Provider for their own use as controller. Your personal data will only be accessed by specified healthcare professionals who will be subject to a legal duty of confidentiality.

We also use a limited number of third party processors to help produce and provide our service, who will process your personal data on our behalf. Those third parties and the nature of the processing services they undertake are summarized in the table below. Please also be aware that they are subject to clear contractual restrictions to only use your personal data as we instruct them to do so, and subject to appropriate security measures.

We will not otherwise share your personal information within the scope of this privacy notice unless required or permitted to do so by law. For the avoidance of doubt, however, such additional purposes will not include use of your data for insurance and/or broader commercial activities for which we do not have your consent.

Transferring information outside the UK

Klinik is located in the UK and Finland, and the processing of personal data will therefore mainly take place within the UK and EU. No directly identifiable personal data about you will be transferred outside the UK. We will, however, transfer your data to the EEA (provided, of course, that we have a lawful basis enabling us to process it as set out above in this privacy notice and further that the proposed transfer is in accordance with the UK GDPR) in reliance on the fact that the UK government has approved transfers of personal data from the UK to the EEA. For the avoidance of doubt, this transfer will only be to Klinik Healthcare Solutions based in Finland.

As for the data transfers from the EU to the UK or any other country or company located outside the EEA, this will be in line with the standards of the GDPR.

Data security

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorized way, altered or disclosed. We also have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so. This includes ensuring that all personal data stored processed on Klinik’s system is protected from unauthorized access, accidental or unlawful destruction and alteration, unauthorized disclosure and other unlawful processing. Your Healthcare Provider’s access to personal data is restricted to persons who need access to the server environments in use for maintaining the service.

The safety of the system and access to personal data are monitored using good data protection practices. All processing of personal data considers the requirements of the UK GDPR.

How long will you use my information for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. In the case of the directly identifiable data we will (in our role as processor) retain this

in accordance with the instructions given to us by Your Healthcare Provider. In the case of the pseudonymized data we will (in our role as controller) retain this for a maximum of 5 years from the point at which we have collected it. We will, during that retention period, only process your personal data in the event that we have a lawful basis to do so. Please note that in respect of using your data for Medical Engine validation and improvement then in the event that you subsequently withdraw your consent for us to use your data for such purposes then we may need to continue to retain, for instance to defend legal proceedings, but we will stop using it for any other purposes or it is converted it into a fully anonymized dataset.

NHS login

Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS Digital. NHS Digital is the controller for any personal information you provided to NHS Digital to get an NHS login account and verify your identity, and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS Digital (as the “controller”) when verifying your identity. To see NHS Digital’s Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately

Rights of access, correction, erasure, and restriction

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Your rights in connection with personal information

Under certain circumstances, and as set out in further detail in our general privacy notice, by law you have the right to:

• Request access to your personal information (commonly known as a "data subject access request"). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
• Request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
• Request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
• Object to processing of your personal information where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. We have set out above the specific steps we will take in the event that you do register such an objection.
• Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
• Request the transfer of your personal information to another party.
• Lodge a complaint with the supervisory authority, if you think we process your personal data unlawfully.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact our Data Protection Officer (details below) in writing. Please note that you should direct any queries to Your Healthcare Provider which relate to the personal data you have entered into the patient interface or has been subsequently received and used by Your Healthcare Provider following the output of the automated healthcare assessment.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

What we may need from you

We may need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Right to withdraw consent

Data protection officer

For further information please contact our Data Protection Officer, whose details are:

Ari Flinkman

Director, Information Governance

Klinik Healthcare Solutions Oy

tietosuoja@klinik.fi

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

Version: 2.1 (September 1st, 2021)