Procedure: Handling Individual Rights Requests

Version: 1.0 Owner: DPO (Dr Simon Chapman)

1. Scope

This procedure applies to all requests made under UK GDPR Articles 15-22, including Subject Access Requests (SARs), Right to Erasure, and the Right to Object.

2. Receipt of Request

Requests may arrive via support@checktick.uk or dpo@checktick.uk.
Any staff member receiving a request must forward it to the DPO within 24 hours.

3. Verification & Triage

Identify the Subject: Verify the requester's identity (e.g., via registered email or transaction ID).
Identify the Role: * If the request concerns Account Data, CheckTick (Controller) handles it.
If it concerns Survey Data, we notify the Customer (Controller) and assist them in fulfilling the request.
Encrypted Survey Data: SARs concerning responses on encrypted surveys (including encrypted non-patient surveys) follow the same unlock-and-decrypt path as patient-data surveys: the survey owner unlocks their key material (password, recovery phrase, OIDC, or organisation key) to decrypt the responses, and the extracted data is provided to the Controller to fulfil the request. Surveys with a recorded encryption opt-out store responses in plaintext and can be extracted directly.

4. Handling an Objection (Article 21)

If an individual objects to processing:

Step 1: Stop any non-essential processing of that specific data record immediately.
Step 2: Assess if there are "compelling legitimate grounds" that override the objection (rare in healthcare surveys).
Step 3: If the objection is valid, delete or anonymize the data as requested.
Step 4: Confirm completion to the individual within 30 days.

5. Logging

All requests are logged in our Data Rights Request Tracker (Internal) including date of receipt, action taken, and date of completion.