Your rights
Under the UK GDPR you have the right to obtain a copy of your personal data, have inaccurate data corrected, have data erased in defined circumstances, restrict or object to processing, receive your data in a portable format, and not be subject to a solely automated decision with legal or similarly significant effect. Curenium makes no solely automated decisions of that kind. Clinical decision support, including allergy and interaction checks, is advisory and always reviewed by a clinician.
Who to ask
This is the part people most often get wrong, so it is worth being direct about it. If your request concerns your health records, the hospital or clinic that treated you is the controller and you should contact them. They hold the clinical relationship, and only they can judge whether an exemption applies to a particular entry. If your request concerns your Curenium account itself — your login, your contact details, your notification preferences — contact us directly at support@plannorium.com.
If you contact us about health records, we will not ignore you. We will tell you which organisation to approach, and we will notify them without undue delay so they can respond.
Making a request
No particular form is required. Tell us, or the treating organisation, who you are, what you want, and how to reach you. Requests are free of charge. We will need to verify your identity before releasing anything — releasing a health record to the wrong person is itself a serious breach. We will ask only for what is necessary to establish that you are who you say you are.
How long it takes
A response is due within one calendar month of receipt. That may be extended by a further two months where a request is complex or where several requests have been made; if we extend, you will be told within the first month and given the reason. Where Curenium is assisting a controller, we aim to provide them with what they need within 7 days, so that they can meet the statutory deadline rather than spend it waiting on us.
Erasure and its limits
The right to erasure is not absolute, and in healthcare it is frequently limited. A clinical record ordinarily cannot be erased on request, because processing is necessary for the provision of health care under Article 9(2)(h) and for compliance with a legal obligation to retain it. Saying so plainly is more useful than implying a deletion that will not happen. What you can generally ask for instead: correction of inaccurate entries, a note recording your disagreement with an entry, restriction of processing while a dispute is resolved, and erasure of data that is not part of the clinical record.
If you are not satisfied
Tell us first — most complaints are resolved faster that way, and we would rather hear it directly. You also have the right to complain to the Information Commissioner's Office at ico.org.uk or on 0303 123 1113, and you may do so without contacting us first. Where your complaint concerns your health records, it may need to be directed to the treating organisation as controller, and the ICO will tell you if so.
Contact
support@plannorium.com — for requests about your Curenium account, and for controllers seeking assistance with a request they have received.