Data protection complaints procedure

About this document

Version history

1. How to complain

An individual may complain if they believe Alessia has infringed their rights under UK data-protection law in connection with their personal information.

• Online information: https://alessiahq.com/legal/privacy-complaints
• Email: privacy@alessiahq.com with subject “Data Protection Complaint”
• Post: Alessia International Ltd, 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom

To make a complaint, email privacy@alessiahq.com with the subject “Data Protection Complaint”. You do not need an Alessia account.

If a disability or accessibility need makes it difficult to complain by email, call us on +44 20 4514 5863 or write to our registered address. We will agree a suitable way for you to make your complaint and receive our response.

The complainant should provide enough information to identify the issue, relevant account or event, dates and desired outcome. They must not send patient data, passwords, authentication tokens or unnecessary portfolio evidence by ordinary email or post.

2. What Alessia will do

Alessia will:

1. record the complaint and date received;
2. aim to acknowledge the complaint within five business days and always acknowledge it within 30 days of receiving it;
3. verify identity proportionately where needed;
4. clarify scope without using clarification to delay unnecessarily;
5. make enquiries appropriate to the subject matter;
6. preserve relevant evidence and restrict access;
7. identify whether Alessia or an Institution is controller for the complained-of processing;
8. keep the complainant informed of material progress where a final response cannot yet be given;
9. take appropriate corrective or preventive action; and
10. communicate the outcome without undue delay, with reasons and available escalation routes.

We target a substantive outcome within one month of receiving the complaint. An extension of up to two further months is exceptional, applies only to a complex complaint, and is communicated within the first month with the reason and regular progress updates.

3. Institution-controlled information

If the complaint concerns an Institution-controlled account, Alessia will promptly identify and inform the controlling Institution under the DPA and assist it. Alessia will tell the complainant which organisation is handling the complaint unless law, confidentiality or security prevents that disclosure.

Alessia remains responsible for any part concerning its independent-controller processing, such as its own security, billing, contracting or legal administration.

4. Investigation

During an investigation, we may review relevant account, system and service-provider records and ask appropriate Alessia teams or the controlling Institution to assist. We restrict access to information necessary for the investigation, protect confidentiality and preserve relevant evidence. If the complaint also involves a data-rights request or possible personal-data breach, we will coordinate the relevant processes and deadlines. We document our findings and reasons and will not treat anyone unfairly for making a complaint.

5. Outcome

Our written outcome will explain what we investigated, our decision and material reasons, any action taken or planned, any outstanding steps and expected timing, and how to request an internal review or contact the ICO or another applicable authority. We may withhold information where reasonably necessary to protect another person's rights, confidentiality, security, legal privilege or an active investigation.

Where appropriate, we will correct the issue, consider whether anyone else is affected and make any required notifications.

6. Escalation

To request an internal review, email legal@alessiahq.com with the subject “Privacy Complaint Review”. Where practicable, someone who did not make the original decision will conduct the review.

UK complainants may contact the Information Commissioner's Office at any time; they do not lose that right by using Alessia's process. The ICO can be contacted at ico.org.uk/make-a-complaint, by telephone on 0303 123 1113, or by post at Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. Regional supplements identify additional authorities and appeal routes.

7. Complaint records

We keep restricted records of complaints, including relevant contact and identity-verification information, key dates, the issue raised, investigation activity, outcome, remediation and any regulatory or legal escalation. We limit those records to what is reasonably necessary.

We normally retain the minimised complaint case file for six years after final closure, as explained in our Retention Schedule. We may retain necessary material longer for active proceedings, an appeal, regulatory enquiry, insurer requirement, a longer applicable limitation period or a documented legal hold. We delete raw attachments and copied content when they are no longer needed as evidence and do not retain an entire account or portfolio merely because a limited part is relevant.