This Practice is supporting vital health and car planning and research by sharing your data with NHS Digital. For More information about this see the GP Practice Privacy Notice for General Practice Data for Planning and Research
Privacy notice
Overview
1.1 Cumbria Health on Call Limited (“CHoC”) whose registered office is Capital Building, Hilltop Heights, London Road, Carlisle CA1 2NS is a Data Controller. This means that we determine the purpose and means of the processing of your Personal Data.
1.2 CHoC is required to appoint a Data Protection Officer (DPO) in respect of our processing activities. ChoC uses an external DPO whose details are set out below:
Yvonne Salkeld
Head of Information Governance
eHealth Cumbria
Cumbria Partnership NHS Foundation Trust
Maglona House, Unit 68, Kingstown Broadway, Carlisle, CA3 0HA
Tel: 01228 603927
You should contact the DPO if you have any concerns about the information contained in this privacy notice or data protection within CHoC generally.
1.3 CHoC takes the security and privacy of your data seriously. We need to gather and use information about you as part of our business, to provide the best care to patients, ensure patient safety and to manage our relationship with patients and third parties. We intend to comply with our legal obligations under the Data Protection Act 2018 (the ‘2018 Act’) and the EU General Data Protection Regulation (‘GDPR’) in respect of data privacy and security. We have a legal obligation to provide the information contained in this policy.
1.4 This policy applies to all patients, service users and third parties (excluding job applicants) whose personal data we process as a result of our business activities and service provision. If you fall into one of these categories then you are a ‘data subject’ for the purposes of this policy.
1.5 CHoC has a separate privacy notice in respect of job applicants, which can be viewed via the following link https://www.chocltd.co.uk/recruitment/ .
1.6 CHoC has measures in place to protect the security of your data in accordance with our Data Protection, Information Governance, Records Management, Information Security, and Email and Internet Use policies.
1.7 CHoC will hold data in accordance with our Records Management Policy. We will only hold data for as long as necessary for the purposes for which we collected it.
1.8 This notice explains how CHoC will hold and process your information.
1.9 It is intended that this privacy notice is fully compliant with the 2018 Act and the GDPR. If any conflict arises between those laws and this notice, CHoC intends to comply with the 2018 Act and the GDPR.
2. Data Protection Principles
2.1 Personal data must be processed in accordance with six ‘Data Protection Principles.’ It must:
- be processed fairly, lawfully and transparently;
- be collected and processed only for specified, explicit and legitimate purposes;
- be adequate, relevant and limited to what is necessary for the purposes for which it is processed;
- be accurate and kept up to date. Any inaccurate data must be deleted or rectified without delay;
- not be kept for longer than is necessary for the purposes for which it is processed; and
- be processed securely.
We are accountable for these principles and must be able to show that we are compliant.
3. How we define personal data
3.1 ‘Personal data’ means information which relates to a living person who can be identified from that data (a ‘data subject’) on its own, or when taken together with other information which is likely to come into our possession. It includes any expression of opinion about the person and an indication of the intentions of us or others, in respect of that person. It does not include anonymised data.
3.2 This policy applies to all personal data relating to data subjects whether it is stored electronically, on paper or on other materials.
3.3 This personal data might be provided to us by you, someone else (such as a relative, the NHS 111 service, your doctor or an independent doctor acting on our behalf), or it could be created by us.
3.4 We will collect and use the following types of personal data about you:
- Name and address and contact telephone number;
- date of birth;
- the contact details for your emergency contacts;
- your gender;
- your marital status and family details;
- your health records and genetic data;
- your identification documents including passport and driving licence;
- your images (whether captured on CCTV, by photograph or video); and
- any other category of personal data which we may notify you of from time to time.
4. How we define special categories of personal data
4.1 ‘Special categories of personal data’ are types of personal data consisting of information as to:
- your racial or ethnic origin;
- your religious or philosophical beliefs;
- your genetic or biometric data;
- your health;
- your sex life and sexual orientation; and
- any criminal convictions and offences.
We may hold and use any of these special categories of your personal data in accordance with the law.
5. How we define processing
5.1 ‘Processing’ means any operation which is performed on personal data such as:
- collection, recording, organisation, structuring or storage;
- adaption or alteration;
- retrieval, consultation or use;
- disclosure by transmission, dissemination or otherwise making available;
- alignment or combination; and
- restriction, destruction or erasure.
This includes processing personal data which forms part of a filing system and any automated processing.
6 How will we process your personal data?
6.1 CHoC will process your personal data (including special categories of personal data) in accordance with our obligations under GDPR and the 2018 Act.
6.2 We will use your personal data for:
- performance of tasks carried out in the public interest or in the exercise of official authority vested in us as a controller (in respect of the provision of health services to patients and service users);
- where it is necessary to protect your vital interests;
- complying with any legal obligation;
- Where we need to perform the contract we are about to enter into or have entered into with you; or
- if it is necessary for our legitimate interests (or for the legitimate interests of someone else). However, we can only do this if your interests and rights do not override ours (or theirs). You have the right to challenge our legitimate interests and request that we stop this processing. See details of your rights in section 10 below. This bullet point is not relevant for patients and service users and will only be relied upon in respect of other third parties such as suppliers.
We can process your personal data for these purposes without your knowledge or consent. We will not use your personal data for an unrelated purpose without telling you about it and the legal basis that we intend to rely on for processing it.
If you choose not to provide us with certain personal data you should be aware that we may not be able to provide our services to you.
7. Examples of when we might process your personal data
7.1 We have to process your personal data in providing primary care health services as follows and in each case the lawful basis will be the performance of official authority vested in us or, in life-threatening situations involving you, to protect your vital interests:
- Decisions made by health professionals or support staff when treating you or assessing the best course of treatment for you;
- Liaising with other NHS Organisations and health professionals in relation to your care and health records;
- Improving our service provision for future service users;
- Preparing statistics on NHS performance and activity;
- Administration;
- Investigating concerns and complaints;
- Obtaining payment for services provided;
- Training and education of staff, including assessing performance. to decide how much to pay you, and the other terms of your contract with us;
- Research and analysis; and
- For any other reason which we may notify you of from time to time.
7.2 For third parties who are not patients or service users, we will process your personal data as follows:
- To manage payments, fees and charges and collect money owed to us;
- To manage our relationship with you, including providing you with relevant information;
- To enable you to perform the contract you have entered into with us and vice versa.
7.3 We will process special categories of your personal data (see above) in certain situations in accordance with the law. For example, in the provision of primary care health services we are permitted by the 2018 Act and GDPR to process your data where:
- it is necessary to protect your vital interests or those of another person where you/they are physically or legally incapable of giving consent;
- it is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services; or
- it is necessary for the reasons of public interest in the area of public health.
7.4 If we require your explicit consent for processing (which will be rare) then we would explain the reasons for our request. You do not need to consent and can withdraw consent later if you choose by contacting the DPO.
7.5 We will not process special category data for any third party who is not a patient or service user, other than for recruitment, which is covered by a separate privacy notice as detailed above.
7.6 We do not take automated decisions about you using your personal data or use profiling in relation to you.
8. Sharing your personal data
8.1 We will share your personal data, including health data with other health and adult social care organisations as necessary. We are required to do this by law in order to improve the care provided to you.
8.2 Sometimes we might share your personal data with our contractors and agents, including Doctors who are not employees of CHoC, in order to carry out our obligations under our contract to provide primary care health services.
8.3 Personal data shared with other health and adult social care organisations is subject to legal safeguards imposed on the recipients. Where we share personal data with anyone who is not subject to such legal safeguards, we require hose organisations or individuals to keep your personal data confidential and secure and to protect it in accordance with the law and our policies. They are only permitted to process your data for the lawful purpose for which it has been shared and in accordance with our instructions.
8.4We do not send your personal data outside the European Economic Area. If this changes you will be notified, we will only undertake such transfers where we can ensure adequate safeguards are in place and we will explain those safeguards to you.
9. Subject access requests
9.1 Data subjects can make a ‘subject access request’ (‘SAR’) to find out the information we hold about them.
9.2 If you would like to make a SAR in relation to your own personal data you should make this in writing to our Chief Executive at our office address: Capital Building, Hilltop Heights, London Road, Carlisle CA1 2NS. We must respond within one month unless the request is complex or numerous in which case the period in which we must respond can be extended by a further two months.
9.3 There is no fee for making a SAR. However, if your request is manifestly unfounded or excessive we may charge a reasonable administrative fee or refuse to respond to your request.
10. Your data subject rights
10.1 You have the right to information about what personal data we process, how and on what basis as set out in this policy.
10.2 You have the right to access your own personal data by way of a subject access request (see above).
10.3 You can correct any inaccuracies in your personal data. To do so you should speak to a member of our staff or contact our DPO.
10.4 You have the right to request that we erase your personal data where we were not entitled under the law to process it or it is no longer necessary to process it for the purpose it was collected. To do so you should speak to a member of our staff or contact our DPO.
10.5 While you are requesting that your personal data is corrected or erased or are contesting the lawfulness of our processing, you can apply for its use to be restricted while the application is made. To do so you should contact our DPO.
10.6 You have the right to object to data processing where we are relying on a legitimate interest to do so and you think that your rights and interests outweigh our own and you wish us to stop.
10.7 You have the right to object if we process your personal data for the purposes of direct marketing.
10.8 You have the right to receive a copy of your personal data and to transfer your personal data to another data controller in limited circumstances. We will not charge for this and will in most cases aim to do this within one month.
10.9 With some exceptions, you have the right not to be subjected to automated decision-making.
10.10 You have the right to be notified of a data security breach concerning your personal data.
10.11 In most situations we will not rely on your consent as a lawful ground to process your data. If we do request your consent to the processing of your personal data for a specific purpose, you have the right not to consent or to withdraw your consent later. To withdraw your consent, you should contact our DPO.
10.12 You have the right to complain to the Information Commissioner. You can do this by contacting the Information Commissioner’s Office directly. Full contact details including a helpline number can be found on the Information Commissioner’s Office website (ico.org.uk). This website has further information on your rights and our obligations.
11. Data Security
11.1 We have put in place measures to protect the security of your data. We will keep our working practices under review and update them as necessary to protect personal data.
11.2 Third parties will only process your data on our instructions and where they have agreed to treat the data confidentially and to keep it secure.
11.3 We have put in place appropriate security measures to prevent your data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your data to those employees, agents, contractors and other third parties who have a business need to know. They will only process your data on our instructions and they are subject to a duty of confidentiality.
11.4 We have procedures in place to deal with any suspected data security breach and will notify you and the Information Commissioner’s Office of a suspected breach where we are legally required to do so.
12. Data retention
12.1 We will only retain your data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal data are available in our Records Management Policy. Please contact our DPO if you would like to see a copy of our Records Management Policy. To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.
12.2 In some circumstances we may anonymise your personal information so that it can no longer be associated with you, in which case we may use such information without further notice to you.
Cookies
Cookies are used on most websites including this one to collection information and improve user access. A cookie is a small text file that contains a unique label or ID number. When you visit a website that uses cookies, the website sends a cookie to your browser’s software and it is stored on your computer even after you leave the site. When you visit the website at a later date the cookie’s ID number is sent back to the website, allowing the website to recognise the user.
Most web browsers automatically accept cookies but, if you prefer, you can change your browser to prevent that or to notify you each time a cookie is set.
Visiting www.allaboutcookies.org will provide information on settings within your browser as well as other useful information on cookies.
Please note however, that by blocking or deleting cookies you may not have full use of the website.
If you continue using this site we will assume that you are happy to receive all cookies and reserve the right to amend, remove or add new cookies and similar technical tools at any time.
Links to other websites
Our website contains links to other websites and partners. However, once you have used these links to leave our site, you should note that we do not have any control over that website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites and such sites are not governed by this privacy statement.
Contacting us
f you have any questions or feedback about this privacy statement, or if you would like us to stop processing your information, please do not hesitate to get in touch.
Cumbria Health on Call Ltd, Hilltop Heights, London Road, Carlisle, Cumbria, CA1 2NS.
Tel: 01228 514830
Fax: 01228 402803
Email: office@choc.nhs.uk
This website uses cookies
A cookie is a small file, typically of letters and numbers, downloaded on to a device (like your computer or smart phone) when you access certain websites.
Cookies allow a website to recognise a user’s device.
Some cookies help websites to remember choices you make (e.g. which language you prefer if you use the Google Translate feature). Analytical cookies are to help us measure the number of visitors to a website. The two types we use are ‘Session’ and ‘Persistent’ cookies. Some cookies are temporary and disappear when you close your web browser, others may remain on your computer for a set period of time.
We do not knowingly collect or intend to collect any personal information about you using cookies. We do not share your personal information with anyone.
What can I do to manage cookies on my devices?
Most web browsers allow some control of most cookies through the browser settings. To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit www.allaboutcookies.org.
To opt out of being tracked by Google Analytics across all websites visit http://tools.google.com/dlpage/gaoptout.
If you are concerned about cookies and would like to ask further questions please do not hesitate to write to our website developers – support@gpsurgery.net
