Telephone recording policy

Healthbridge Limited (ZAVA and Superdrug Online Doctor) has a telephone system used by the Customer Support (CS) teams that can record conversations. Like many other organisations, recording phone calls is a standard practice that Healthbridge Limited uses for quality monitoring, training, compliance, and security purposes.

All calls received by the ZAVA and Superdrug Online Doctor CS teams will be recorded by Healthbridge Limited. They will be kept on the server for a period of 30 days. After 30 days they will be automatically deleted unless kept longer for the purposes specified in this policy.

Recordings will only be used for the purposes specified in this policy. If calls are transferred from CS to a doctor, the call recording will stop once the call is successfully transferred.

In order to maintain high standards and protect the public and staff we want to record all telephone calls received by the CS team. We'll keep them for a limited period of time (30 days), or longer as applicable.

We shall ensure that the use of these recordings is fair and that we comply with the requirements of the relevant legislation. This includes:

• Regulation of Investigatory Powers Act 2000
• Telecommunications (Lawful Business Practice) (Interception of Communications Regulations) 2000
• Telecommunications (Data Protection and Privacy) Regulations 1999
• General Data Protection Regulation 2018
• Data Protection Act 2018
• Human Rights Act 1998

All calls made to the CS teams will be recorded. The caller will be able to object to the processing, or restrict the processing, by notifying CS on the phone, or by sending an email.

Under normal circumstances a call will not be downloaded or kept for longer than 30 days unless:

• it is necessary to investigate a complaint
• there is a threat to the health and safety of staff or visitors, or for the prevention or detection of crime
• it is necessary to check compliance with regulatory procedures
• it will help standards in call-handling through use in training and coaching our staff

If downloaded for any of the above purposes they will be deleted once the recording's use is complete, that is once a formal HR investigation is over, or the file has been sent to the police.

Personal data collected in the course of recording activities will be processed fairly and lawfully in accordance with data protection law. It will be:

• adequate, relevant, and not excessive
• used for the purpose(s) stated in this policy only and not used for any other purposes
• accessible only to those with defined responsibilities, with this access being enabled/disabled upon authorisation of the Chief Operating Officer, COO or Head of CS
• treated confidentially
• stored securely on a local server with access via 3CX server
• not kept for longer than necessary and securely destroyed once the issue(s) in question have been resolved, for example, deleted after an HR investigation is complete
• password-protected if downloaded, for example to share with HR for formal investigation of conduct

Where call recording facilities are being used, the caller will be informed that their call is being recorded for quality, training, security, and compliance purposes.

If a patient requests that all of their data be deleted, recorded phone calls will be automatically deleted after 30 days, which falls within the timeframe for data requests.

For recordings kept for investigation purposes, recordings will still be kept as long as necessary to carry out the investigation.

For training purposes, the need for the data will be reviewed after 6 months and deleted as necessary, or when the patient requests deletion of the data.