01
Controller and contact
KHEIR MEDICAL SERVICES is the proposed controller identity and must be legally confirmed before launch.
02
Website enquiries
The form collects a name, email address, optional telephone number, enquirer type and brief administrative message. Visitors are told not to include symptoms, health records or other sensitive clinical material.
The plugin does not retain form submissions in the WordPress database. It passes the message to the configured administrative email using the hosting mail service; resulting email may be retained by the practice and its providers under the approved policy.
03
Clinical referrals
Clinical information must be submitted only through the approved secure referral route and must not be entered in the website enquiry form. The final notice must identify how that route operates, who provides it, why clinical information is processed and how long it is kept.
04
Purpose and legal basis
Administrative details may be used to answer enquiries, manage correspondence and protect the website from misuse. Clinical information is processed only for approved healthcare, professional and legal purposes.
The practice must document the relevant GDPR Article 6 basis and, where health data is involved, the Article 9 condition for each purpose.
05
People and providers
Access should be limited to authorised practice personnel and approved services supporting email, hosting, security or clinical systems. The completed notice should name or describe those recipients, processor agreements and any international transfer safeguards. Disclosure may also be required for safeguarding, safety or legal reasons.
06
Retention and security
Information should be limited to what is necessary, protected by proportionate access controls and removed when the approved clinical, professional and legal retention period ends. The practice must insert its actual schedule here.
07
Individual rights
Depending on the circumstances, people may have rights of access, correction, restriction, objection, deletion and information about use. A right may be limited where clinical, safeguarding or legal obligations apply. Concerns can be raised first with the practice and then, if needed, with Ireland’s Data Protection Commission.
09
Children and young people
Information about clinical privacy should be available in language appropriate to the young person’s age and understanding. Confidentiality is important, while safety, safeguarding and law can sometimes require information to be shared.