Reality Consulting Limited data
With effect from 23 May 2018 the Data Protection Act 2018 (the Act) is
the UK’s implementation of General Data Protection Regulation (GDPR).
Reality complies with the Act.
Reality’s Registration Under the Data
Protection Act 2018
Reality has appropriately registered with the Information Commissioner’s
Office under the Act.
Our Registration Number is Z5954105.
Our Data Protection Officer is Kate Brown – email:
Reality maintains a simple spreadsheet of Customer contacts, i.e. the individuals with whom it is necessary for Reality
staff to communicate. All contact information is provided voluntarily (either
verbally in a telephone call or via email) and is essential in order that
Reality may provide their contracted services.
This spreadsheet contains only basic details about existing Customers, or
about prospective Customers who have contacted Reality to enquire about
possible work. These details are limited to:
· Job title
· Organisation worked for
· Contact telephone numbers
· E-mail addresses
All of Reality’s Customers and prospects are personnel working within NHS organisations, and whose contact details are generally a matter of public record. As such, none of the data held about these individuals can be deemed sensitive.
Customers’ “Personal Data”
Whilst Reality does not hold or process any Personal Data on
behalf of its Customers, its staff are often required
to examine a Customer’s Personal Data in the course of carrying out contracted
tasks. This data is classified as Personal Data, as defined under the Act, but
it is held and processed only by Customers, not by Reality. From the Reality
point of view, all such data will be treated in accordance with the Patient
Identifiable Data Procedure set out below.
When accessing a Customer’s Personal Data, Reality will
follow the Code of Practice set out below. This includes access for the
purposes of preventative maintenance; fault diagnosis; software installation;
software testing; upgrade; repair; replacement or any other related activity
carried out under the terms of any contract. The Code of Practice shall
apply to access of Personal Data both at the Customer’s premises and remotely
via a network, and in all circumstances: for example, during examination of
software printouts or screen dumps created in order to
investigate a support problem; or when using the Customer’s data for processing
in a live or testing environment.
The Customer provides a secure facility for remotely
connecting to their network to enable Reality to fulfil its contracts. This
facility always precludes any data (patient based or otherwise) being copied
from the Customer’s servers to Reality’s machines.
Reality will indemnify the Customer against any claim,
demand or loss arising under the Act, or from any breach of the Code of
Practice set out below, caused by any action (authorised or unauthorised)
taken by any Reality employee, or other person acting officially on behalf of
The Customer agrees to conform to current Data Protection legislation, and to adhere to the Patient Identifiable Data Procedure set out below.
Code of Practice
• All work involving access to the
Customer’s Personal Data shall be carried out only by employees, or other
persons acting officially on behalf of Reality, who are aware of the
requirements of GDPR and of their individual responsibilities under the Act to
maintain the security of the data.
• Any Personal Data in the custody of
Reality shall be kept under appropriately secure conditions.
• Where Personal Data is recorded or
copied by Reality in any form, it shall either be returned to the Customer, or
disposed of by secure means, at an appropriate time after completion of the
work that required the record or copy to be made.
• Any Personal Data transferred
between one place and another by Reality, or officially on behalf of Reality,
shall be carried by an appropriately secure method.
• Reality shall not transfer Personal Data out of the United Kingdom unless specific and appropriate permission has been given to perform such a transfer.
Patient Identifiable Data Procedure
• The Customer agrees never to send
anything containing Patient Identifiable Data (for example, screenshots showing
a patient's name, date of birth, address, telephone number or text notes that
may identify them, or data files containing this information in readable text)
to Reality via any insecure means, including but not limited to e-mail or
standard post. Where it is necessary to provide specific examples, such
examples should ideally be placed in a file on the Customer's server (where
patient data is already held securely) to which Reality has access.
Alternatively, such details may be shared verbally over the telephone, or sent
by an agreed method of encrypted e-mail.
• In the event of the Customer inadvertently sending Patient Identifiable Data to Reality by post or e-mail in breach of this procedure, Reality will immediately destroy such data as securely as it is able, and will not be able to respond to it. Reality will also send out a letter or e-mail to the Customer pointing out the breach, so that steps can be taken to ensure that a breach of this type does not recur.
Data Protection Details
Reality’s Data Protection Officer is:
Reality Consulting Limited
Telephone: 0300 600 1161
Reality has appropriately notified its systems to the Information Commissioner under the Data Protection Act 1998. Reality’s Registration Number is Z5954105.