Privacy Policy
Introduction
Welcome to the K2 My Pregnancy Notes Privacy Policy. Please read this Privacy Policy carefully, it should only take you approximately 10 minutes to read. We have set out a very brief summary of some key points set out in this Privacy Policy in the box below.
| Key Issue |
Summary |
| Who we are | K2 is a technology provider and we provide digital services to the NHS in connection with the provision of your maternity care. The digital product that this Privacy Policy relates to is called K2 MyPregnancyNotes or K2 Hampton - blood pressure monitoring (we call it the K2 MPN for short in this policy) |
| What data we have | We collect account registration data and any data that you provide (which is likely to include medical data and information about your personal circumstances) |
| Our relationship with you | If your Healthcare Provider uses K2 MPN, then we don't make any of the decisions about your data at all – we just provide a service to your Healthcare Provider and they make the decisions about what data we have and what happens to it.
If you use K2 MPN without linking your account registration up with a Healthcare Provider then we have a direct relationship with you and we will be a "data controller" of your data. |
| Where is your data | Your data is stored in the UK on equipment (servers) controlled by Microsoft. We have a contract with Microsoft and they can only use the data to provide the service to us (in the same way that we will only use your data to provide a service either to the NHS or to you). |
| How you can get in touch or find out more | You have got various rights to access, correct and delete your data. More information is set out below. We can be contacted on: 01752 397800 or email: support@k2ms.com. You can also contact your Healthcare Provider to find out more about how your data will be used. |
Introduction and some important phrases
K2 Medical Systems Limited (referred to in this policy as K2 or we) provides technology and digital services (the Services) to various NHS Trusts and other healthcare providers who may be responsible for providing healthcare services at a national or local level (the Healthcare Providers).
K2 Medical Systems Limited is a company established in England with its registered address at K2 Medical Systems Ltd., The Apex, Derriford Business Park, Brest Road, Plymouth, PL6 5FL (company number 03809089). We are registered with the ICO as a data processor and as such we are not required to register a Data Protection Officer although we can be contacted on: +44 (0) 1752 397800 or email: websupport@k2ms.com with any queries relating to data protection.
Whilst we provide a number of services, one of our key offerings to Healthcare Providers is the provision of "electronic Personal Health Records" (ePHR) in maternity care that allows women under the care of the Healthcare Providers (the Women or Users) to access digital maternity notes. The digital maternity notes technology platform that this Privacy Policy relates to is called the K2 MyPregnancyNotes ePHR or K2 Hampton - blood pressure monitoring (we will refer to it as the K2 MPN).
In this Privacy Notice we will use the following phrases:
- Clinician is a collective term for antenatal healthcare professionals including for example midwives and GPs;
- MCP(s) means "Maternity Care Providers" which is a collective term for the facilities and locations in which Clinicians are based such as hospitals and birth centres;
- Personal Data means any information that relates to you as an individual person;
- Pre-Booking Stage describes the use of the K2 MPN platform to book a Woman into the care of a specific MCP where certain information is collected by the Healthcare Providers and must be provided by the Woman;
- Sharing Stage means the use of the K2 MPN platform by the Woman who can choose to share her Personal Data with her MCP after the Pre-Booking Stage.
If you have any questions about the use of your Personal Data by K2, you can contact us here: support@k2ms.com. You can also contact your Healthcare Provider if you have questions about their use of your Personal Data. Your healthcare provider should also have a privacy policy and should be able to explain how your Personal Data is used.
This statement was last updated on 28th February 2024 . We may need to make periodic changes to this Privacy Policy and we will notify Users of any changes via the K2 MPN platform.
Quick Links
- Purpose of this privacy policy
- Your MCP (Maternity Care Provider)
- What role does K2 perform in the context of the provision of maternity care?
- The Pre-Booking Stage and the Sharing Stage
- How is your Personal Data collected?
- International transfers
- Data security
- Data retention
- Your data protection rights
- How we share your Data
- How to get in touch with us
Purpose of this privacy policy
The purpose of this privacy policy is to provide you with important information about how your personal data is collected and processed, and to help you to understand the part that K2 and the K2 MPN platform plays in the provision of maternity care to you. We recognise that you need to have confidence in how your data is being used and processed.
We provide the Services to the Healthcare Providers in the context of strict clinical requirements and guidelines that apply at both national and local level and as such we do not usually determine or influence how your personal data is processed, and in the majority of cases we only process your data on the instructions of the Healthcare Providers involved in your care. For the purposes of data protection law (including the General Data Protection Regulation, GDPR, which you may have heard of), when K2 is processing your data on the instructions of the Healthcare Providers we act as "data processors". We have set out below the limited scope of our role as a data processor.
Contact details
If you have any questions about this privacy policy or our privacy practices, please contact our support team using the email address support@k2ms.com.
You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues (www.ico.org.uk, 0303 123 1113). We would, however, always appreciate the chance to deal with any concerns before you approach the ICO so please contact us in the first instance.
We would also recommend that you contact your MCP or local NHS Trust if you have broader concerns about the way that your Personal Data is used in the context of the provision of maternity care.
What role does K2 perform in the context of the provision of maternity care?
You may not have given any thought to how your Personal Data is used by Healthcare Providers, but there are some very well-established protocols that determine when data is accessible to different parties within the broader health and social care system. Digital healthcare services are however still considered relatively innovative.
K2 is not a healthcare provider, nor does K2 provide medical advice or interpret or 'use' medical data.
K2 is a technology provider specialised in developing technology and digital services that can be used by Healthcare Providers. We have developed the K2 MPN platform alongside Clinicians and Healthcare providers to make sure that it is fit for purpose.
The main function of the K2 MPN technology is to facilitate the delivery of digital maternity notes to Women by their Clinicians and their chosen MCP.
Healthcare Providers can deploy the K2 MPN in a variety of ways, including using it on a standalone basis or by integrating it with other 'on site' systems that they use. You should contact your MCP to find out how they use the K2 MPN. In any case, where your MCP has chosen the K2 MPN as its digital maternity notes system, we will be using your Personal Data and providing the Services solely on the basis that we act as a service provider (and data processor) for the Healthcare Provider and so our use of your Personal Data will be limited to use in accordance with the Healthcare Provider's instructions.
The Pre-Booking Stage and the Sharing Stage
At the Pre-Booking Stage:
Women under the care of a particular MCP where the MCP or relevant Healthcare Provider has deployed the K2 MPN will be directed to self-report their pregnancy through a K2 MPN webpage. Where Women do not have access to the internet and/or require additional help and support, the mandatory information may be entered through the K2 MPN on the Women's behalf.
The collection of data at the Pre-Booking Stage includes of a series of mandatory and optional questions (all developed in close consultation with Clinicians and Trusts). It will be clearly indicated which questions are mandatory and which are optional. The optional information may include marital status, ethnicity, NHS Number, height and weight and additional medical and lifestyle information.
Information provided at the Pre-Booking Stage will be shared with your MCP. The collection of Personal Data through the K2 MPN platform at this stage is carried out solely on the instructions of the relevant Healthcare Provider.
At the Sharing Stage:
At the end of the Pre-Booking Stage (i.e. once you have self-reported the pregnancy through the K2 MPN), you will be asked whether you wish to move into the Sharing Stage. In the main, this is an optional process but may be encouraged or in some cases mandated by your Clinicians and MCP. If you proceed to the Sharing Stage, the information submitted at the Sharing Stage will be shared with your MCP and relevant Clinicians.
If you proceed to the Sharing Stage, an ePHR will be created that will be used by your Clinicians and MCP throughout the pregnancy unless you choose to revoke the sharing of your Personal Data with the MCP and Clinicians.
K2 acts as a service provider to the Healthcare Providers and therefore processes your Personal Data only on the instructions of the relevant Healthcare Provider. Your MCP and Clinicians will be able to tell you more about how your Personal Data is used in the hospital setting and as part of your maternity care.
How is your Personal Data collected?
Most of the Personal Data that K2 processes is data that Women provide directly by entering it into the K2 MPN platform.
Where the relevant MCP has deployed the K2 MPN (in other words, where K2 acts as a service provider to the Healthcare Providers), additional Personal Data will be added to the K2 MPN from the Clinicians and from the "on site" systems used by the relevant Healthcare Providers (i.e. data will come from the Clinicians and MCP into the K2 MPN). Your Clinicians and MCP will be able to provide you with more information about where else they may collect data from.
International transfers
We do not transfer your personal data outside of the UK.
Data security
We have put in place very robust security measures to prevent your Personal Data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to Users' Personal Data to those employees, agents, contractors and other third parties who have a need to know. We have implemented measures to ensure that they will only process your Personal Data on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal data breach and will notify you, the Healthcare Providers and any applicable regulator of a breach where we are required to do so under applicable laws.
Your MCP and the relevant Healthcare Providers should be able to tell you more about how your Personal Data is secured when it processed by them.
Data retention
We retain Personal Data about you for as long as we are required to do so by the relevant Healthcare Provider.
When we provide Users with the User Only Service version of the K2 MPN, we will only retain Personal Data for as long as you continue to have an account registered on the K2 MPN.
You can ask us to delete your Personal Data at any time by contacting us at support.k2ms.com. Any request to delete or amend data must be received by K2 in a written format, we cannot accept a phone conversation as evidence for wishing to delete or amend your data. We may also ask you to provide additional information to help us identify you for verification reasons.
Your Data Protection Rights
You can exercise the following rights by contacting your MCP or Healthcare Provider. If you have any questions or if you want to exercise any of the rights described below, please contact us by email on support@k2ms.com.
| Right of Access | Commonly known as a "data subject access request" this enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. |
| Right of Correction | This enables you to have any incomplete or inaccurate data we hold about you corrected. |
| Right of Erasure | This enables you to ask us to delete or remove personal data where there is no good reason for us continuing to process it or where you have successfully exercised your right to object to processing. |
| Right to object to processing | Where we are relying on a legitimate interest (or those of a third party) and there is something about your situation which makes you want to object to processing on this ground as you feel it impacts on your fundamental rights and freedoms. |
| Right to request restriction of processing | This enables you to ask us to suspend the processing of your personal data in a number of specific scenarios including; where you want to establish the data's accuracy and where you wish us to hold it our use of the data is unlawful but you do not want us to erase it, where you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims and where you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it. |
| Right to Transfer | We will provide to you, or a third party you have chosen, your personal data in a structured, commonly used, machine-readable format. Note that this right only applies to automated information which you initially provided consent for us to use or where we used the information to perform a contract with you. |
How do we share your Personal Data?
As described above, your Personal Data will be shared with your MCP since the MCP or Healthcare Provider is the data controller responsible for the use of your data. At the Pre-Booking Stage (and if you proceed to the Sharing Stage), all of the data that you provide will be shared with your MCP (and therefore with Clinicians involved in your care).
We have engaged with a service provider called Microsoft Azure to provide data storage services. Your Personal Data will be stored on equipment (servers) controlled by Microsoft Azure. We have a written agreement in place with Microsoft Azure and they are obliged to protect the data's confidentiality, integrity and availability (i.e. they are obliged to keep the data secure).
We could merge with or be acquired by another business. If this happens we share the information that relates to you. You will be sent notice of such an event where required by applicable laws.
In the unlikely event that it is necessary, we reserve the right to disclose your personal data in order to comply with the law, applicable regulations and government requests. We also reserve the right to use such information in order to protect our operating systems and integrity as well as other users.
Cookie Policy
When K2 provide services, we want to make them easy, useful and reliable. Where services are delivered over the internet, this sometimes involves placing small amounts of information on your device, for example, computer or mobile phone. These include small files known as cookies. They cannot be used to identify you personally.
These pieces of information are used to improve services for you through, for example:
- Enabling a service to recognise your device so you don't have to give the same information several times during one task
- Recognising that you may already have given a username and password so you don't need to do it for every web page requested
- Measuring how many people are using services, so they can be made easier to use and there's enough capacity to ensure they are fast.
- Preventing Bots from performing attacks on the website using services such as ReCaptcha.
Please note that the cookie providers listed below may distribute the gathered cookie information with other third party websites for the purpose of activity tracking. You can find out more about the policy of each cookie provider on their respective privacy pages.
Cookies in Current use
Please by aware that the providers listed below may change their cookie names without notice.
As an example, we use the following cookies on our website:
Necessary
Provider: K2 Medical Systems
Cookie: .AspNetCore.Anitforgery.#
Purpose: Helps prevent Cross-Site Request Forgery (CSRF) attacks.
Source: www.mypregnancynotes.com, www.k2hampton.com
Provider: K2 Medical Systems
Cookie: ARRAffinity
Purpose: Used to distribute traffic to the website on several servers to optimise response times.
Source: www.mypregnancynotes.com, www.k2hampton.com
Provider: Google
Cookie: rc::a
Purpose: This cookie is used to distinguish between humans and bots. This is beneficial for the web site, in order to make valid reports on the use of their web site.
Source: https://www.google.com/recaptcha/api.js
Provider: Google
Cookie: rc::b
Purpose: This cookie is used to distinguish between humans and bots.
Source: https://www.google.com/recaptcha/api.js
Provider: Google
Cookie: rc::c
Purpose: This cookie is used to distinguish between humans and bots.
Source: https://www.google.com/recaptcha/api.js
Marketing
The following cookies are listed as Marketing cookies as they could be used to for targeting ads. However, K2 only utilises these cookies as they are also mandatory to distinguish between bots and humans using the Recaptcha technology. K2 are categorically not using these cookies to target ads, as K2 does not have advertising in use on the website.
Provider: Google
Cookie: NID
Purpose: This cookie is used to distinguish between humans and bots. And registers a unique ID, identifying a users device.
Source: https://www.google.com/recaptcha/api.js
Provider: Google
Cookie: rc::d-15#
Purpose: This cookie is used to distinguish between humans and bots. And registers a unique ID, identifying a users device.
Source: https://www.google.com/recaptcha/api.js
How to control and delete cookies
K2 will not use cookies to collect personally identifiable information about you.
However, if you wish to restrict or block the cookies which are set by our websites, or indeed any other website, you can do this through your browser settings.
You can also visit www.aboutcookies.org which contains information on how to make these changes on a wide variety of browsers. You will find details on how to delete cookies from your machine as well as more general information about cookies. Please be aware that restricting cookies may impact on the functionality of our website.
If you wish to view your cookie code, just click on a cookie to open it. You'll see a short string of text and numbers. The numbers are your identification card, which can only be seen by the server that gave you the cookie.
For information on how to do this on the browser of your mobile phone you will need to refer to your handset manual.
