Privacy notice

MSI Reproductive Choices UK is the data controller. It means that if this notice applies to your information, it is our responsibility to protect it. 

We collect information about you in the following ways: 
– When you give it to us directly 
– When you call us, telephone calls are recorded for training and monitoring purposes
– When our staff call you back the calls are recorded
– Onsite CCTV captures images for the purpose of security
– If you choose to enter it into our web chat tool
– If you provide it to access our services via a booking form
– For vasectomy clients, we receive your personal details from your GP if you are referred to our services by your GP
 
You may give us your information when you visit our website, book an appointment with us, submit a contact us form or submit a booking form.
We do not buy information about individuals from companies that sell such details. 

– If you have submitted a contact us form, we need your information to contact you
– You have called us to discuss and/or book treatment
– If you choose to enter it when using our web chat tool or a booking form 
– If you are an applicant applying for a job with us, we need your information to process your application

Each time we use any information about you we need to have a lawful basis to do so. 
The reasons why we would use information about you are:
 
– For NHS clients’ medical care: We need to use the information to be able to provide our official and legal services. This lawful basis is known as a “public task”, since the service is NHS funded.
 
– For Private clients’ medical care: We need to use the information to be able to provide our official and legal services that the client has asked to pay for.  This lawful basis is known as a “contract”.
 
– For clients who have opted in to receive automatic email or SMS updates: You will be asked whether you would like to receive automatic messages and reminders about your appointments and aftercare. These automatic messages will also include links to our website which contain information about your treatment that you will need to read prior to your appointments. After your treatment you’ll receive some messages from us relating to your aftercare. All clients are asked whether they’d like to opt in – we will only ever send these updates with your consent.  
 
– For clients needing an emergency transfer to a hospital: We need to use the information to protect the life of the client. This lawful basis is known as “vital interest”.
 
– For all clients who are part of anonymised or pseudonymised research: We need to keep information that is in the public interest. It can be used for scientific or historical research. This lawful basis is known as “public task”.
 
– For all clients that consent to being sent a link or contacted about feedback: any data used will be anonymised but we seek your permission to send you a link, or book an appointment with you for feedback. This is your choice, if you decide not to consent or should you change your mind at any time, you do not need to give a reason and your medical care and legal rights will not be affected.
 
– For all clients that access our services via a booking form: The data collected here is necessary to book into our services and will be encrypted at all times. We need to use the information to be able to provide our official and legal services. For NHS patients, this lawful basis is known as a “public task”, since the service is NHS funded.
 
– We also may need to include team member names in organisational documents. We need to use this information to meet our legal duties as a health care provider. This lawful basis is known as “legal obligation”.
 
– For internal communication:  We need to share information with our teams to be able to provide our services.  Sharing information with our teams also helps us to work with other organisations. This lawful basis is known as “legitimate interest”.

– For quality purposes: We use artificial intelligence (AI) within our secure telephony solution to analyse call recordings between agents and our clients in order to improve the quality of our calls. Our lawful basis for doing so is legitimate interest and for the management of health care services.  AI is not used to make automated decisions about you or your care.
 
– For website visitors: If a person sends personal information on our website, we can use the information if the person gives permission. This lawful basis is known as “consent”.
 
– For individuals who wish to share their story: If a person wishes to share their abortion story via our website form, we can use the information as we have that person’s permission. This can be withdrawn at any time by emailing the address on the form. The lawful basis we rely on is “explicit consent”.  
 
– For MSI Reproductive Choices Event Attendees (online):  If an attendee has signed up for one of our events they will have to consent to the use of their email address for receiving invitations.  The lawful basis is consent and it can be withdrawn at any time.
 
– For Job Applicants: If a person has applied for a job with MSI UK via our website or a third-party website, we need to use the information provided to process the job application. Data collected for various stages of the job application will have differing lawful bases. The relevant lawful bases throughout the recruitment process are to enter a contract with the individual and the legitimate interests of MSI UK.
 
When the information you give to us is classed as sensitive, it needs more protection than usual. Sensitive information, such as information about your health, is called “special category data’’. We can only use sensitive information if we have two reasons to use it. 
 
The first reason comes from the list above. The second reason to use sensitive information is:
– For medical reasons and to provide health care.
– For public health reasons, for example to stop the spread of disease or infection
– To keep information for statistics, for scientific or historical research, or for public interest. This is always balanced with your right to data protection
– For safeguarding and vital interests

Abortions in Great Britain must be carried out under the legal requirements set by the Abortion Act 1967. This Act requires abortion care services to send some information on the abortions they undertake to the Chief Medical Officer at the Department of Health and Social Care (DHSC). 
The following information is sent: 
– patient reference number  
– date of birth 
– postcode 
– ethnicity 
– marital status 
– number of previous pregnancies 
– treatment details 

This information is also used to produce abortion care statistics with the aim of monitoring and improving services. DHSC follows extremely robust procedures to avoid the possibility of individuals being identified from the data. 

The anonymised data may also be shared with the Office for National Statistics to produce conceptions data and research organisations for statistical and research purposes.

Your treatment will not routinely be recorded on your NHS record.

– For termination or pregnancy clients, we will not disclose medical records to your GP or contact them without your permission, other than when needed for emergency medical care or safeguarding concerns. We will however inform your GP of a positive STI result in the event that we cannot reach you after several attempts.

– For vasectomy clients, your GP is provided with a copy of your discharge summary upon completion of your treatment where they have referred you to MSI for treatment.

All clinical professionals are bound by the code of confidentiality and data protection laws.

Select MSI Reproductive Choices team members will have access to your information to carry out their job, to assist in the delivery of healthcare treatment,  and we may need to share some of your information with other healthcare providers for your care. Also to gain NHS funding or to understand your medical history.

In some cases, we outsource certain tasks to suppliers, such as a chemist for our postal telemedicine service. We undertake checks on all suppliers that have access to client data to ensure they have appropriate security measures and data protection standards, and all suppliers sign a data processing agreement. 

We may also engage with external organisations to process information on our behalf such as our professional file archiving and laboratory partners. We will always ensure that our contract with them sets out our expectations and requirements as to how they should handle your information. Where possible we will keep the sharing of your information to a minimum.   

We may have to disclose your details, where required by the law, to the police, regulatory bodies or legal advisors. We do not make disclosures to authorities without your consent unless it is in your best interest to do so, or where a court order has been obtained and we are obliged to comply.  

We may disclose your details to emergency services where it concerns your vital interests, or the vital interests of someone else, for example in a ‘life-or-death’ situation. 

We may disclose your details to other trusted partners, such as local authority social care, where there is a serious concern that you or someone else may be at risk of harm. Where MSI has legitimate safeguarding concerns, your consent is not required to share relevant information to keep you or someone else safe.

Your details may be disclosed to the British Pregnancy Advisory Service (BPAS), another abortion provider, where a duplication of abortion medication is detected for the same pregnancy in each provider’s telemedicine pathway. Duplications are flagged to us via our mutual trusted postal telemedicine chemist service, and data sharing agreements are in place between both providers. This sharing is in the interest of MSI UK and you, our client, to protect you from potential harm.

We will never sell your information to third parties.  

The NHS national data opt-out applies to the processing of your health information for research and planning purposes and not for individual care (for example use of a MSI UK service). Opt-outs do not apply where our clients receiving treatment via NHS funding consent to the use of their data for payment and invoice validation. For further information on NHS opt out and the use of your data please visit “Your NHS data matter”.

MSI Reproductive Choices UK is accredited with the Cyber Essentials Certificate and recently achieved the Cyber Essentials Plus accreditation. Cyber Essentials is a Government-backed scheme which protects organisations against cyber threats. This accreditation recognises our ability to resist and react to cyber-crime attempts, and acknowledges our commitment to protecting your personal information.  

We only keep information about you for as long as we need to. We are required to retain all of our health care records for a minimum period of time for legal and safety reasons. The length of time depends on the type of record. We keep all abortion records for 10 years and all vasectomy records for 8 years, exceptions can apply to certain records’ retention periods where it may be required by the law. For more information about our records management and retention, please see the Records Management Code of Practice for Health and Social Care 2020.
 
Your rights and control over your information 

Information we collect and use about you is always within your control. This means that you have rights over this information and you may be able to request the following:  

– Information about how we handle your information  
– Access to the information we hold about you  
– Your information to be amended or updated  
– To object to the use of your information  
– To restrict the ways in which we use your information  

In some cases your information can be deleted or deactivated, however, the right to erasure does not apply if processing is necessary for the purposes and for the provision of health or social care; or for the management of health or social care systems or services.

As a client you can request access to, or copies of your health record(s), this includes scans or personal data we hold as part of your records. The right of access, commonly referred to as ‘Subject Access’, gives individuals the right to obtain a copy of their personal data as well as other supplementary information.  
Read more about how you can make a ‘Subject Access’ Request (SAR) by filling the form at this link.
If you would like to find out more information about your rights, please email [email protected]  
Please note if you email the Information Governance address you will receive an automatic reply.
If you would like to make a complaint, please email [email protected]  
You also have a right to submit a complaint to the Information Commissioner’s Office in the UK. Our ICO number is Z5517462.