A pre-filled Data Protection Impact Assessment for clinics connecting ClinicSignal, following the ICO's DPIA structure
A DPIA is the clinic's document as controller, but most of its content describes the processor's system. HMDG has filled in everything it can from its side. The parts marked [Clinic to complete] depend on your own practice. Print or copy this page into your own DPIA record. It does not replace legal advice.
Probably yes. The processing involves health-related data about identifiable patients (appointment types can imply conditions), a new technology for the clinic, an AI component, and transfers to the United States. Any one of these is a factor the ICO lists; together they make a DPIA the prudent course.
Nature. ClinicSignal reads appointment, patient-reference, practitioner, billing and referral records from the clinic's practice management system through an API credential the clinic supplies, stores a defined subset (see the field-level map in the Data Guide, section 2), computes operational and financial metrics, and presents them on a dashboard and in emails. Patient names and contact details are fetched on demand for recall worklists and never stored. An AI service turns aggregated figures into written explanations. Anonymised cohort totals feed sector benchmarks unless the clinic opts out.
Scope. All patients, practitioners and referring contacts in the connected system, including historical records from the date the clinic's system began. Data retained for the life of the agreement; deleted within 30 days of termination or request (backups within 90 days).
Context. Patients expect their clinic to analyse its own appointment and billing data to run the practice. They would not expect clinical notes to be shared, and they are not. The clinic remains controller; HMDG Limited (ICO ZB365505) is processor under the DPA.
Purposes. Utilisation, attendance, rebooking, retention, revenue and practitioner reporting; recall worklists the clinic acts on through its own systems; marketing attribution; AI-assisted explanations; sector benchmarking.
[Clinic to complete] Number of patient records in your system; which locations and practitioners are in scope; whether you will use recall worklists, marketing attribution and benchmarking.
HMDG's processing is documented in the DPA, Privacy Policy and Data Guide, and HMDG will answer written questions at dpa@hmdg.co.uk. [Clinic to complete] whether you will consult patients or staff (for example through your privacy notice update), and your data protection adviser's view.
| Question | HMDG's position | Clinic |
|---|---|---|
| Lawful basis | For the clinic to determine. Most clinics rely on legitimate interests (Article 6(1)(f)) and, for the health dimension, Article 9(2)(h) with Schedule 1 paragraph 2 of the Data Protection Act 2018. | [Clinic to complete] |
| Data minimisation | Named fields only; clinical notes never requested; names and contact details discarded on import; dates of birth reduced to age bands; marketing identifiers hashed. | Confirm the four free-text fields are free of clinical detail. |
| Purpose limitation | Use limited to the DPA purposes; no sale; no patient contact by HMDG; no AI training. | Decide on benchmarking opt-out. |
| Accuracy | Data mirrors the clinic's system within six hours; the dashboard shows the time of the last sync. | Keep the source system accurate. |
| Retention | Life of agreement; 30 and 90-day deletion. | Decide who requests deletion and when. |
| Individual rights | HMDG assists with requests within 5 working days (DPA clause 10). | Route requests through the clinic. |
| International transfers | USA: Railway (hosting, with the UK Addendum and Data Privacy Framework), Anthropic and Resend (UK Addendum). Supplier terms available on request. | Record the transfer in your register. |
The likelihood, severity and residual ratings below are HMDG's own assessment of its system. They are a starting point, not a finding: re-rate each row for your clinic's patient population, the permissions you grant and how your staff work, and record your own ratings in your DPIA.
| Risk to individuals | Likelihood | Severity | Measures in place | Residual |
|---|---|---|---|---|
| Re-identification of stored patient records through the stored credential | Low | High | Credential encrypted (AES-256-GCM); production access limited and MFA-protected; staff visits recorded; names fetched only on screens the clinic opens | Low |
| Credential theft granting wider access to the practice system than ClinicSignal uses | Low | High | Clinic creates the key from a dedicated Power Receptionist user with no treatment-note access (Data Guide s1); key revocable at any time | Low |
| Clinical detail entering through free-text fields | Low | Medium | Free-text cancellation descriptions are discarded unread; only catalogue names (appointment types, services, referral sources) are stored, which the clinic reviews (DPA 11.1) | Low |
| Patient details typed into the Advisor reaching the AI provider | Medium | Medium | No filter; clinic policy and MSA 5.1 condition; on-screen reminder under the question box; owner can switch the Advisor off in Settings; questions deleted after 12 months, with the data, or on request; provider contractually barred from training and deletes inputs within 30 days | Medium, controlled by staff practice |
| Transfer to the US without adequate protection | Low | Medium | UK Addendum to the SCCs with each supplier; Railway in the DPF; no clinical content transferred | Low |
| Recall exports containing contact details mishandled after download | Medium | Medium | Clinic controls exports; consent flags carried on each row; PECR responsibility stated | Clinic to manage |
| Benchmark figures revealing a clinic | Low | Low | Cohorts of 20 or more; smaller cohorts suppressed; totals only, no per-clinic rows; opt-out | Low |
| Decisions about staff or patients taken on inaccurate figures | Low | Medium | Six-hourly sync with visible timestamp; outputs are advisory; definitions published on every metric | Low |
| Security breach at HMDG or a supplier | Low | High | Measures in DPA Schedule 4; independent review May 2026 with findings closed; breach notice to the clinic within 24 hours of HMDG becoming aware | Low |
[Clinic to complete] Measures approved by; residual risks accepted by; data protection adviser's advice and whether it was followed; review date (suggested: annually, or when HMDG notifies a material change under DPA clause 16.3).