Data Protection

This page sets out how Clear Sleep complies with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, with a particular focus on how we handle special category health data. This page complements our Privacy Policy, which should be read alongside it.

1. Data controller

Clear Sleep is the data controller for personal data processed in connection with our home sleep apnoea assessment service.

Contact: hello@clearsleephealth.co.uk
Country: United Kingdom

2. Special category health data

Some of the information we process about you (including your sleep symptoms, medical history, overnight test data, and clinician notes) is "special category personal data" under Article 9 of UK GDPR.

We process special category health data on the following lawful bases:

• Article 9(2)(a): your explicit consent, given at the point of signing up for the assessment
• Article 9(2)(h): processing necessary for the provision of health or social care, by or under the responsibility of a health professional bound by an obligation of professional secrecy

3. Lawful bases for ordinary personal data

For ordinary (non health) personal data we rely on the following lawful bases under Article 6 of UK GDPR:

• Contract: to provide the service you have purchased
• Legal obligation: to meet our tax, accounting and clinical record keeping duties
• Legitimate interests: to operate, secure and improve our service, in ways you would reasonably expect and that do not override your rights
• Consent: for marketing communications, which you can withdraw at any time

4. Your rights in detail

Under UK GDPR you have the following rights:

The right to be informed

We explain in our Privacy Policy and this page what we do with your personal data, why, and on what legal basis.

The right of access

You can ask for a copy of the personal data we hold about you. This is sometimes called a "subject access request". We will respond within one calendar month and provide your data free of charge, unless your request is manifestly unfounded or excessive.

The right to rectification

If any of the personal data we hold about you is inaccurate or incomplete, you can ask us to correct it.

The right to erasure ("right to be forgotten")

You can ask us to delete your personal data. We will honour the request unless we are legally required to keep it, for example, clinical records that must be retained under UK medical record keeping guidance.

The right to restrict processing

In certain circumstances you can ask us to stop processing your data while we look into a query or complaint you have raised.

The right to data portability

Where we process your data based on contract or consent, and the processing is carried out by automated means, you can ask to receive your data in a structured, commonly used, machine readable format.

The right to object

You can object to processing based on legitimate interests. You can also object at any time to processing of your data for direct marketing.

Rights related to automated decision making

Clinical interpretation of your test results is performed by a qualified human clinician. We do not make significant decisions about you using solely automated processing.

5. How to exercise your rights

To make any data protection request, email hello@clearsleephealth.co.uk. Please include enough information for us to verify your identity and to understand what you are asking for. We may ask for additional proof of identity before releasing personal data.

We will respond within one calendar month. In limited circumstances we may extend this by a further two months. If so, we will tell you why within the first month.

6. International transfers

Where any of our processors are located outside the United Kingdom, we use appropriate safeguards under UK GDPR, including:

• Transfers to jurisdictions covered by a UK adequacy regulation
• The UK International Data Transfer Agreement
• The EU Standard Contractual Clauses combined with the UK Addendum

7. Data breaches

We take the security of your data seriously. In the unlikely event of a personal data breach that is likely to result in a risk to your rights and freedoms, we will notify the Information Commissioner's Office within 72 hours where required, and notify you directly if the risk is high.

8. ICO registration and complaints

Where required, Clear Sleep is or will be registered with the Information Commissioner's Office. If you are not satisfied with how we have handled your personal data, please contact us in the first instance. You also have the right to lodge a complaint with the ICO:

Information Commissioner's Office
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: ico.org.uk

9. Contact

For any data protection related question, contact hello@clearsleephealth.co.uk.