Data Protection Complaints Procedure
Statutory complaints procedure — Data Protection Act 2018, s.164A
1. What this procedure is for
This procedure tells you how to make a complaint to Cannexis Biopharma Ltd ("Cannexis") about how your personal data has been handled, and what we will do in response. It is separate from a general service complaint and from a request to exercise your data-protection rights (for that, see UK GDPR & Your Data Rights).
Making a complaint to us is free, and you do not have to complain to us before you go to the Information Commissioner's Office (ICO) — but we would like the chance to put things right.
2. Who can complain, and about what
Anyone can complain if they believe Cannexis has handled their personal data in a way that breaches data-protection law — for example, that we have processed it unlawfully, failed to keep it secure, kept it too long, shared it inappropriately, or not honoured your rights.
If you are a patient: your treating clinic or pharmacy is the controller of your clinical records and has its own complaints route. We will work with them where a complaint concerns clinical records. You can complain to either us or your clinic; we will tell you if a complaint is better handled by the other party and, with your agreement, pass it on.
3. How to make a complaint
Contact us by any of the following, marking it "Data protection complaint":
- Email: privacy@cannexis.org
- Data Protection Officer: LHI Consulting — info@lhiconsult.com
- Post: Data Protection Complaints, Cannexis Biopharma Ltd, 142-143 Parrock Street, Gravesend, Kent, DA12 1EY
Please tell us, as far as you can: who you are and how to reach you; what happened; which data it concerns; and what you would like us to do. If you need help making the complaint in a different format, tell us and we will assist (see the Accessibility Statement).
4. What we will do — and by when
| Step | Timeframe |
|---|---|
| Acknowledge your complaint, give it a reference, and confirm who is handling it | Within 30 days of receipt (statutory maximum under DPA 2018 s.164A) — in practice we aim for 5 working days |
| Verify identity where needed, to protect your data | Promptly after acknowledgement |
| Investigate — review the processing, take appropriate steps, and where we find something wrong, put it right | Within one calendar month of acknowledgement where we can; if it is complex we will tell you and give a revised date |
| Respond in writing — our findings, what we have done or will do, and your right to escalate | At the conclusion of the investigation |
We record every complaint, our handling of it, and the outcome, and we use complaints to improve. Complaint case records are retained for 6 years (see the retention schedule).
5. If you are not satisfied — escalation to the ICO
If you are unhappy with our response, or we do not respond within the timeframes above, you have the right to complain to the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
You can go to the ICO at any time, but it will usually expect you to have raised the matter with us first.
6. No detriment
You will not be treated less favourably, and your care will not be affected, because you have made a data-protection complaint.
Data Protection Officer: LHI Consulting — info@lhiconsult.com · c/o Cannexis Biopharma Ltd, 142-143 Parrock Street, Gravesend, Kent, DA12 1EY