Introduction

The Health Hut RCT Limited uses closed circuit television (CCTV) images to help protect the business’s property and provide a safe and secure environment for employees, practitioners, clients and visitors. This policy explains how images are collected, used, retained and disclosed. For more information about privacy rights associated with personal data collected through CCTV, please refer to the business’s privacy notice and data protection policy.

The business operates two separate types of camera system: conventional CCTV cameras, which record video images, and Ring cameras in the reception areas of both clinics, which are used for live viewing only. Conventional CCTV does not record audio. The Ring cameras do not record or store video footage and do not record sound or conversations. The different arrangements for each system are set out below.

Purposes of CCTV and live monitoring

The business considers CCTV and live monitoring necessary and proportionate where used for the following safety and security purposes. They may assist with:

·       Prevention or detection of crime or equivalent malpractice.

·       Identification of offenders and support for appropriate investigations.

·       Monitoring the security of the business premises.

·       Supporting compliance with health and safety rules and business procedures.

·       Identifying unauthorised actions or unsafe working practices and, where necessary, providing relevant evidence.

·       Helping practitioners respond to immediate safety or security concerns while viewing a Ring camera live.

CCTV and live monitoring must be used only for appropriate purposes and in a way that is necessary and proportionate. They must not be used for unrelated or excessive monitoring.

Location of cameras and privacy

Conventional CCTV cameras are located at strategic points throughout the business premises, principally at entrance and exit points and other appropriate communal or public areas. Cameras are positioned to provide useful images while limiting unnecessary intrusion into privacy.

Ring cameras are located in the reception areas of both clinics for security purposes and to help protect practitioners. They are used for live viewing only, as described in section 4.

No camera will be directed at toilets, shower facilities, changing rooms, treatment areas where monitoring would be inappropriate, staff kitchen areas, staff break rooms or private offices. Cameras must not unnecessarily capture neighbouring or private areas. Cameras are clearly visible wherever practicable, and appropriate signs are displayed so that employees, practitioners, clients and other visitors are aware that CCTV or live camera monitoring is in operation.

Camera positions and settings will be reviewed as necessary to ensure that monitoring remains appropriate and proportionate and does not unnecessarily intrude on the privacy or dignity of clients, staff or visitors.

Recording, retention and live viewing - Conventional CCTV cameras

Conventional CCTV records video images for the purposes described in this policy. It does not record audio or conversations. Images produced by the equipment should be as clear as possible to be effective for those purposes. The equipment will be checked regularly to ensure that it is working properly.

The normal retention period for conventional CCTV images is up to one month. Images held on a recorder, hard drive or server will be deleted or overwritten when the retention period expires. Footage may be retained for longer only where there is a specific and justified reason, such as a police enquiry or incident investigation. Any extended retention will be limited to the footage needed and reviewed regularly. Any footage downloaded or copied must be stored securely and deleted when it is no longer required.

Before adopting this policy, the business must check that the actual settings of its conventional CCTV recorder match the retention period above. If the system retains footage for a different period, this section must be updated to reflect the actual arrangement.

Ring cameras in reception

The Ring cameras in the reception areas of both clinics are used for live viewing only. Video footage is not recorded or stored, and sound or conversations are not recorded. These cameras therefore do not provide recorded footage that can be retrieved later. They are intended to help practitioners monitor the reception areas in real time for safety and security purposes.

Access to Ring live feeds is restricted to authorised practitioners who need access for the purposes set out in this policy.

Access to and disclosure of recorded CCTV images

Access to and disclosure of images recorded by the conventional CCTV system is restricted to protect individuals’ rights. Recorded images will be kept securely. Access is limited to authorised people who need to view the images for the purposes set out in this policy. Any access, copying or disclosure must be limited to what is necessary and appropriate.

Recorded images may be disclosed where lawful and necessary to:

1.     The police and other law enforcement agencies, to assist with preventing or detecting crime or investigating an incident.

2.     Prosecution agencies, such as the Crown Prosecution Service.

3.     Relevant legal representatives or insurers, where appropriate and lawful.

4.     Authorised managers dealing with a relevant safety, disciplinary or performance matter.

5.     Individuals requesting their own personal data, subject to the rights and privacy of other people and any applicable legal restrictions.

Stephanie Smith, Owner/Director of the clinics, is responsible for authorising disclosures to external third parties where appropriate. Requests for access or disclosure, and the reasons for decisions, will be documented. Images will only be disclosed where there is a lawful basis to do so.

Because Ring cameras do not record or store footage, the business will not normally have recorded images from those cameras to retrieve or disclose. This does not remove any rights individuals may have in relation to personal data processed by the systems.

Individuals’ access rights

Under applicable UK data protection law, individuals may have the right to request access to personal data about them, including conventional CCTV images in which they can be identified. Requests should be made in writing to [email protected] and marked for the attention of Stephanie Smith.

Requests should include the date, approximate time and location of the recording to help identify the relevant footage. The business may need to verify the requester’s identity and consider the rights and privacy of other people before providing footage. Images of other people may need to be obscured. The business will respond within the applicable statutory timeframe, normally one month. Where a request is complex or numerous, the response period may be extended where permitted by law and the requester will be informed as required.

As Ring cameras are live-viewing only and do not record or store footage, the business will not normally be able to provide a recording from those cameras. Any request will nevertheless be considered and answered in accordance with applicable data protection law.

Covert recording

Covert recording is not part of the normal operation of either the conventional CCTV system or the Ring cameras. It will only be considered in exceptional circumstances, for example where there is a reasonable suspicion of serious wrongdoing or criminal activity, and only where necessary, proportionate and legally justified.

Before any covert recording begins, an appropriate assessment must consider:

·       The purpose of the proposed recording.

·       Its necessity and proportionality.

·       The risks to the privacy rights of the individuals affected.

·       The duration and timing of the recording.

·       The safeguards and security measures required to comply with applicable data protection and privacy law.

Stephanie Smith, Owner/Director of the clinics, must review the assessment and provide written authorisation before covert recording begins. Covert monitoring must be limited to the shortest reasonable period and must stop when it is no longer necessary. Audio recording is not used by the business’s normal CCTV or Ring cameras and must not be introduced without a separate assessment, appropriate authorisation and confirmation that it is lawful.

Information obtained through authorised covert monitoring will only be used for the purpose for which it was authorised or another lawful purpose. Information that is no longer required will be securely deleted unless there is a lawful reason to retain it.

Staff training and responsibilities

The business will ensure that employees or practitioners who operate the conventional CCTV system or access Ring live feeds understand the purpose of the relevant system and their responsibilities regarding privacy, confidentiality and data protection. Access must be limited to authorised people and used only for the purposes set out in this policy.

Implementation, data protection and security

The Health Hut RCT Limited is responsible for implementing and complying with this policy. Stephanie Smith, Owner/Director of the clinics, is responsible for overseeing the systems, handling enquiries and complaints, authorising external disclosure where appropriate, and reviewing the use of the cameras to ensure that it remains appropriate and consistent with applicable data protection and privacy requirements.

Personal data collected through conventional CCTV will be processed in accordance with the business’s data protection policy and applicable privacy notices. CCTV footage, recorder access and Ring account details must be protected against unauthorised access, use, copying, disclosure, alteration or loss. Login details must not be shared. Any suspected unauthorised access, disclosure or other data protection incident must be reported promptly to Stephanie Smith and handled under the business’s data breach procedures.

Questions, complaints or data protection enquiries should be sent to [email protected] and marked for the attention of Stephanie Smith, Owner/Director of The Health Hut RCT Limited.

Review

This policy will be reviewed regularly and whenever the camera systems, their settings, their purposes or the way they are used changes. The business will also check that the conventional CCTV retention settings and Ring live-only settings remain consistent with this policy.