This is a summarised version of our the Digital Practice DPIA. This document highlights what data Digital Practice uses and where it is stored.
Review date: 5th November 2024.
Data storage, retention and deletion
Data is stored within computer systems and servers: Client ID, user ID, dates and times of calls, message transcripts.
Most data is retained for 7 years or until the end of the contract, unless the client practice or group requests a different retention period. Anonymised technical data for access to systems is retained indefinitely as a logging and anti-fraud measure.
Clinical records (message traffic) within Digital Practice are maintained indefinitely until either end of contract or instruction to delete from the Data Controller. As these are clinical data, instruction to delete must come from the veterinary Principal/Partner/Clinical Director of the relevant Practice as per RCVS guidelines. Instructions to delete clinical records from non-clinical administrative or legal staff will not be accepted. However, a standing instruction to erase server copies of this data after a set time period, issued prior to initiation of the service, will be enforced.
At the end of the contract, or on instruction from the Principal/Partner/Clinical Director, data will be made available for download if requested and on confirmation that this has been achieved, be wiped and overwritten on all servers.
Scope of the processing
What is the nature of the data, and does it include special category or criminal offence data? How much data will you be collecting and using? How often? How long will you keep it? How many individuals are affected? What geographical area does it cover?
Data collected:
Practice User
Name and practice affiliation
Logging of use and activity
Transcript of any information given in the chat or related forms
Payment amount and reconciliation record
Practice Client
Name and practice affiliation (indirect but extrapolable)
Animal name
Contact information
Device and service information
Transcript of any information given in the chat
Data pulled from PMS and displayed (based on Merlin):
Client record:
Client notes
Payment links
Client data:
Sites
Client id
Next appointment
Client balance
Account type
Last tx amount
Last tx date
Patient record:
Reminders
Patient notes
Clinical history
Patient data:
Last seen
Age
Weight
Sex
Breed
Insurance
Health care plan
Data stored in Digital Practice:
Clinical staff
Name
Email address
Password (hashed)
Profile picture (if uploaded)
Client
First name
Last name
Phone number
User ID
Messenger handle (if used)
Patient
Name
Species
Breed
Patient ID
Message transcripts
Plain text
Files
Record of payment
Amount only, no card details
Financial information is handled directly by Stripe, card data does not cross our servers.
Data Subjects are (a) employees of the practice which is the Data Controller, or (b) clients of that practice - currently existing clients only although in future self-registration may be possible.
Data retention by default is 7 years, in accordance with VDS and RCVS guidance, although this is dependent on the practice’s policy and can be changed as required.
Geographical area will depend on the catchment of the practice. We store data in AWS, in the nearest / most appropriate data centre for the practice.
Questions?
If you have any further questions or concerns, please contact support@digitalpractice.vet