Data Protection & GDPR Policy

1. Introduction

Syno Health is committed to protecting the personal data of its clients, employees and stakeholders. This GDPR Policy outlines our compliance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, ensuring transparency, accountability and security in our data handling practices.

2. Scope

This policy applies to all employees, contractors and affiliates who process personal data on behalf of Syno Health, whether electronically or manually. It covers all forms of data handling, including collection, storage, access, sharing and deletion. It also applies to data accessed, stored or processed on personal and business-owned devices, including laptops, tablets and mobile phones.

3. Data Protection Principles

In accordance with GDPR, Syno Health adheres to the following principles:

• Lawfulness, fairness and transparency
• Purpose limitation
• Data minimisation
• Accuracy
• Storage limitation
• Integrity and confidentiality
• Accountability

4. Data Subject Rights

Under GDPR, individuals have the following rights:

• Right to be informed
• Right of access
• Right to rectification
• Right to erasure
• Right to restrict processing
• Right to data portability
• Right to object
• Rights related to automated decision-making and profiling

5. Data Collection

Data must be collected lawfully and only for the purposes explained to the individual. Explicit consent must be obtained where required.

6. Data Storage

Data must be stored securely with encryption and access controls. Only authorised personnel may access personal data. Devices used to access or store client data must meet minimum security standards.

7. Use of Personal and Business Devices

To maintain the security and confidentiality of client information, the following rules apply to all staff and external providers using personal or business-owned devices for Syno Health-related work:

• Devices must be password-protected and use multi-factor authentication where possible.
• Full-disk encryption must be enabled where possible.
• Devices must have up-to-date antivirus or endpoint protection.
• Software and operating systems must be kept updated with the latest security patches.
• Devices used for care work must not be shared with unauthorised users.
• Client notes must not be stored locally on unencrypted devices or shared through unsecured apps or systems.
• A secure data backup process must be in place.
• Lost or stolen devices must be reported immediately to Syno Health.

Nurses and contractors may be required to complete a Device Security Declaration upon request. Syno Health may suspend data access or refuse use of devices where adequate security cannot be demonstrated.

8. Data Usage and Sharing

Data must only be used for its intended purpose. Appropriate agreements and safeguards must support any third-party sharing.

9. Data Retention and Disposal

Syno Health follows clear retention schedules based on legal requirements and business needs. Records may be retained longer where required for legal claims or regulatory compliance.

10. Data Security

Syno Health uses administrative, technical and physical measures to ensure data confidentiality, integrity and availability. Security measures apply to all personal and business-owned devices used to access client data.

11. Data Breaches

All staff must report actual or suspected data breaches immediately. The Data Protection Officer is Binish Khan, who also serves as Compliance Manager. Syno Health will assess the breach, notify affected individuals and the ICO where necessary, and implement corrective action.

12. Staff Training and Awareness

All staff receive GDPR training during onboarding and at regular intervals. The importance of data protection, including secure device use, is reinforced through ongoing communication.

13. Monitoring and Review

This policy is reviewed annually or in response to legislative changes or security incidents. Compliance checks, including spot checks on device security, may be conducted regularly.