How patient data is handled

Written for whoever has to sign for this — a data protection officer, an IT lead, a medical director. Every claim here is something we can be held to, and where a claim has an exception the exception is in the same paragraph rather than in a footnote.