Privacy Policy

This Privacy Policy is provided by 2T Solutions Limited, a company registered in England and Wales under company number 08055195 with its registered office at Forest Links Road, Ferndown, Dorset, England, BH22 9PH ('we', 'our' or 'us'), in connection with our corporate website at www.2tsolutions.co.uk and our related business communications and enquiries (Website).

We take your privacy seriously. Please read this Privacy Policy carefully as it contains important information about how and why we collect, store, use and share personal data about you.

It also explains your rights in relation to your personal data and how to contact us or the relevant regulator if you have a complaint. Our collection, storage, use and sharing of personal data is regulated by applicable data protection law, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

For the personal data described in this Privacy Policy, we generally act as controller, meaning that we decide how and for what purposes that personal data is used. Our separate role as a processor of personal data through SpiritEHR is explained in SpiritEHR and customer data.

This Privacy Policy applies to personal data that we process for our own purposes in connection with the Website, business enquiries, prospective and existing business relationships, and related communications.

The Website may contain links to, or use services provided by, third-party websites or service providers. Those third parties may process personal data in accordance with their own privacy notices. This Privacy Policy does not govern personal data that our healthcare customers control and that we process on their behalf through SpiritEHR. See SpiritEHR and customer data below.

The personal data we collect about you depends on how you interact with us and the Website. We may collect and use the following categories of personal data:

If you do not provide personal data that we reasonably require to respond to your enquiry or manage our relationship with you, we may not be able to respond to your request or provide the information or services you have requested.

We collect and use this personal data for the purposes described in How and why we use your personal data below. If you use the form on our Contact page, that form asks for your name and email address, and for your organisation, phone number, enquiry type and message if you choose to provide them.

Special category personal data includes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs or trade union membership, genetic data, biometric data used for identification, data concerning health, and data concerning a person's sex life or sexual orientation.

The Website is not intended for the submission of patient, clinical or other health information. Please do not include patient-identifiable information, medical information, information about criminal convictions or other special category personal data in a general Website enquiry or other general communication to us.

If special category personal data is provided to us through the Website or a general communication without being requested, we will handle it only as reasonably necessary and in accordance with applicable data protection law, including to respond appropriately, protect our systems and legal rights, and delete or restrict the information where appropriate.

We provide SpiritEHR and related health information exchange services to healthcare organisations. In providing those services, we may process personal data, including patient and health information, on behalf of our customers. This may include patient-identifiable and clinical information that passes through SpiritEHR and may be accessible to authorised personnel where necessary to provide or support the service.

Where we process that information on a customer's documented instructions, the relevant healthcare organisation determines the purposes and means of the processing and generally acts as controller, while we act as its processor. That processing is governed by our contractual arrangements with the relevant customer and is not governed by this Privacy Policy.

If you are a patient or service user and your enquiry relates to personal data processed through SpiritEHR on behalf of a healthcare organisation, you should ordinarily contact the relevant healthcare organisation in the first instance. We may assist that organisation with its data protection obligations where required under our contract with it.

This Privacy Policy does not describe all processing undertaken through SpiritEHR or replace any privacy information provided by the relevant healthcare organisation.

We collect personal data directly from you when you contact us, submit an enquiry through the Website, request information about our products or services, communicate with us by email, telephone or social media, or otherwise interact with us. We may also receive business contact information from the organisation you work for, from publicly available professional sources, or from business contacts and partners where permitted by law.

We may also collect technical and usage information automatically when you use the Website, including through cookies or similar technologies where these are used. Further information is set out in our Cookie Policy.

Under the Privacy and Electronic Communications Regulations we may store cookies or similar data on your device without consent only where they are strictly necessary to provide the service you asked for. Anything else needs your permission first.

This Website currently uses only the strictly necessary local storage described in our Cookie Policy. We do not use advertising cookies, and we do not use analytics cookies to track you across other websites.

Under data protection law, we can only use your personal data if we have a proper reason, for example:

1. (i) where you have given consent;
2. (ii) to comply with our legal and regulatory obligations;
3. (iii) for the performance of a contract with you or to take steps at your request before entering into a contract; or
4. (iv) for our legitimate interests or those of a third party.

A legitimate interest is when we have a business or commercial reason to use your information, so long as this is not overridden by your own rights and interests. We will carry out an assessment when relying on legitimate interests, to balance our interests against your own. You can obtain details of this assessment by contacting us (see How to contact us below).

The table below explains what we use your personal data for and why.

See Who we share your personal data with for further information on the steps we will take to protect your personal data where we need to share it with others.

We may send marketing communications about our products, services and business where permitted by law, particularly to relevant business contacts.

Depending on the circumstances, we may rely on your consent or our legitimate interests for direct marketing under data protection law, and we will comply with the applicable rules on electronic marketing. Where consent is required, we will obtain it before sending the relevant communication.

You can opt out of receiving marketing communications at any time by:

• contacting us at info@2tsolutions.co.uk; or
• using the unsubscribe link included in any marketing email where one is provided.

We do not sell your personal data to third parties. We will not share your personal data with other organisations for their own direct marketing purposes unless we have a lawful basis to do so and provide any transparency or choice required by law.

You also have the right to object at any time to the use of your personal data for direct marketing. See Your rights below.

We may share personal data with service providers that help us operate the Website and our business, such as website developers and hosting providers, IT and cybersecurity providers, email and communications providers, customer relationship management or business administration providers, and analytics providers where applicable.

We require service providers that process personal data on our behalf to use appropriate security measures and to process that personal data only for authorised purposes and in accordance with our instructions and applicable law.

We may also share personal data where reasonably necessary with:

• external auditors and accountants, including in relation to our accounts and business compliance;
• professional advisers, such as lawyers and other advisers, who are subject to appropriate duties of confidentiality;
• law enforcement agencies, courts, tribunals, regulators and public authorities where required or permitted by law; and
• other parties in connection with a significant corporate transaction or restructuring, including a merger, acquisition, asset sale or insolvency, subject to appropriate confidentiality and data protection safeguards.

If you would like more information about who we share personal data with and why, please contact us using the details in How to contact us below.

We will only share personal data where we have a lawful basis to do so and to the extent reasonably necessary for the relevant purpose.

We keep personal data only for as long as reasonably necessary for the purposes for which it was collected, including to manage our business relationships and enquiries and to meet applicable legal, regulatory, contractual, accounting and reporting requirements. The appropriate retention period will depend on the nature of the information, the purpose for which it is used and any relevant legal or limitation requirements.

When personal data is no longer required, we will securely delete or anonymise it, unless we are required or permitted by law to retain it for longer.

Some of the service providers we use may process personal data outside the UK. Where a transfer of personal data from the UK is subject to the UK GDPR rules on restricted transfers, we will ensure that an appropriate transfer mechanism or exception applies.

Depending on the destination and recipient, this may include relying on UK adequacy regulations (including an applicable recognised data bridge), using contractual safeguards or other safeguards recognised under UK data protection law, or relying on a specific exception where legally permitted.

Where appropriate, we will also consider whether additional measures are required to ensure that transferred personal data receives a level of protection consistent with applicable UK data protection law.

You can contact us using the details below if you would like further information about the safeguards used for any relevant international transfer.

The transfer arrangements we use may change from time to time as our service providers and applicable legal mechanisms change.

You generally have the following rights in relation to your personal data, although the rights that apply may depend on the circumstances and the lawful basis for processing:

For further information about these rights, including when they do and do not apply, please contact us using the details below. You may also refer to guidance published by the UK Information Commissioner's Office (ICO).

If you would like to exercise any of these rights, please email or write to us using the details in How to contact us below. When contacting us, please:

• provide enough information to identify yourself and any additional identity information we may reasonably request; and
• tell us which right you wish to exercise and the personal data to which your request relates.

We have appropriate security measures to prevent personal data from being accidentally lost, or used or accessed unlawfully. We limit access to your personal data to those who have a genuine business need to access it.

We also have procedures in place to deal with any suspected data security breach. We will notify you and any applicable regulator of a suspected data security breach where we are legally required to do so.

You should also take reasonable precautions when communicating with us electronically and avoid sending patient-identifiable or other sensitive information through general Website contact channels unless we have specifically directed you to an appropriate secure method.

Please contact us if you have any queries or concerns about our use of your information (see How to contact us). We hope we will be able to resolve any issues you may have.

You also have the right to lodge a complaint with the Information Commissioner.

The Information Commissioner can be contacted at ico.org.uk/make-a-complaint or telephone: 0303 123 1113.

We may change this Privacy Policy from time to time, including where our Website, business practices or legal obligations change. The current version and its effective date will be made available on the Website. Where a change is material, we may take additional steps to bring it to your attention where appropriate.

You can contact us by post or email if you have questions about this Privacy Policy or our use of your personal data, wish to exercise a data protection right, or want to make a complaint.

Our contact details are:

• Forest Links Road, Ferndown, Dorset, England, BH22 9PH
• info@2tsolutions.co.uk

Please put "Data protection" in the subject line of an email so it reaches the right person quickly.