Most of the personal information we process is provided to us directly by you or by our healthcare partners, such as:

• You have contacted us, for example, by telephone, email, and/or social media.
• You used our service(s).
• You filled out a form such as a patient registration form or feedback survey.
• Your information has been passed to us by our partner(s), such as results of tests and information from people who care for you, including health professionals and relatives.
• You have applied for a job or secondment with us.
• You are representing your organisation in the capacity of an employee or agent of the organisation.
• The professionals caring for you keep records about your health and any care you receive to ensure you are provided with the best possible treatment.

As a result, we may also access information about you on local and national shared care record programs, including SIDeR+, the Summary Care Record, and My Care Record. We set out further details about these shared care record programs below.

Examples of information used and held by us include:

• Name, address, gender, current location, your date of birth and NHS number.

• Contact information such as telephone numbers and those of next of kin or carers.

• Details of alerts such as allergies, medications and physical or mental health conditions.

• Notes and reports about your health and treatment and care you have received. Depending on which of our services you use we may also collect genetic and biometric information such as blood samples and scans. This may also include images that form part of your care, for example, photographs of wounds.

• Social family, lifestyle and/or social circumstances where this is provided as part of using one of our services.

• We do not routinely collect information about your ethnicity, race, religion or beliefs, your marital or employment status or criminal or conviction information, though this may be provided to us by our partners or those contacting our services.

• As information is sometimes supplied to us from patients’ families and carers / support network, from patients themselves, as well as from other health and social care service providers, we may also receive and hold information relating to your family/parents, children and relatives.

We have set out how we use your personal information in the table below, alongside our lawful basis (or bases) for processing.

Summary Care Record

The Summary Care Record (SCR) is a national NHS system used to support patient care. The SCR is a copy of key health information from your GP medical notes. Where this is made available to us by your GP practice or surgery, we can see key information about you when you need unplanned care or when your GP practice is closed. You can find out more about SCR here: Summary Care Record.

SIDeR+ (Somerset patients only) Shared Care Record – Somerset Integrated Digital electronic Record

We are part of the ‘Somerset Integrated Digital electronic Record (SIDeR+)’ programme to support the safe and effective provision of health and social care. This is managed with the support of the data processor Black Pear. To ensure you receive effective, safe care, we will through digital means enable your record to be available to those providing your care in whichever care setting you are seen, such as an A&E attendance, a 111 or urgent care/out of hours consultation, a physiotherapy appointment or a social care needs assessment. To achieve this, the aim of Shared Care Record is to enable health and care staff to view your information, to save valuable time in getting you the right treatment.

Your information will only be available (shared) to the staff involved in your direct care, and not at any other time, or for any other reason. Only authorised staff can access the systems and the information they see is carefully checked so that it relates to their job. Systems do not share all your data, just data which services have agreed is necessary to include. For more information about shared care records, please visit: SiDER+ webpage or SIDeR – NHS Somerset ICB.

My Care Record

Your GP, hospital, community health, mental health and social care teams may all hold records about your care separately. Often, only health and care professionals within the same organisation can see this information. This means it can be difficult for them to work together to deliver the best care.

My Care Record is an approach to improving care by joining up health and care information. Wherever possible, health and care professionals will be able to access your records from other services when it is needed for your care. This may include individuals working within hospitals, GP practices, treatment centres, care homes, social care and community teams. This will make it easier and faster for them to make the best decisions. An administrator may access your records under the direction of a health and care professional providing care to you, for example, to check details of appointments and co-ordinate care.

Several different secure computer systems are used across the region. These allow health and care professionals to digitally access your records held by other services. In some areas systems are already in place, in other areas more work is underway to invest in the technology needed. The approach also provides an agreement between all the health and care organisations involved. This means they commit to sharing information in a secure way to help improve your care.

Please see the My Care Record website www.mycarerecord.org.uk for more information. More information about the areas where your information may be used can be found on the My Care Record website: www.mycarerecord.org.uk.

Each partner organisation participating is responsible for the information they share/access within the shared environment, including personal and special category data incorporated from individual records held by partner organisations. The information that can be accessed from your record from each service or organisation will depend on the system that is used.

We may share information about you with staff in other organisations where it is necessary for your care, without your explicit consent. This includes sharing information with routine and urgent care services and sharing information where it is necessary to save your life or the life of another person in an emergency.

We may also share information about you with relevant organisations for safeguarding purposes and to support your ongoing care. For example, we may share your information with:

• Your GP practice / surgery. A copy of your primary and urgent care health records is automatically shared with your registered surgery as shown on the national Spine. This is to support you and to ensure continuity of care. Depending on the services or care being provided to you, you may be able to object to this information being shared. Should you wish to object to the sharing of this information, please speak to the person taking your call and clinician providing your care. It may impact your care and treatment if your GP does not have your full medical history.
• Others involved in your care such as hospitals, community teams, dentists and other urgent and primary care providers including other 111 providers.
• Ambulance and emergency services including first responders.
• Social services and local authorities (and their safeguarding teams).
• Support services such as school nurses, education services, funeral homes, coroners and care homes.
• NHS organisations including Integrated Care Boards and NHS England.

Sometimes we are required by law to pass on personal information without your consent, for example:

• When required to by a formal court order or as required by a statutory body such as the Department for Work and Pensions, for example, to prevent or investigate fraud.
• When sharing information with the police (and/or other law enforcement agency) to prevent, detect and/or support the investigation of a serious crime, and/or prevent harm to you or to other people.

Sometimes we may also pass on personal information to other health care organisations/providers on an ‘implied consent’ basis supported by section 251B of the Health and Social Care Act 2012. This may be for the purposes of planning or research, when permission is granted by the Confidentiality Advisory Group (CAG) to use confidential information without patient consent in line with Section 251 of the NHS Act 2006. For more details, please read the ‘Confidentiality Advisory Group’ section of the Health Research Authority’s website. Where necessary, HUC will comply with the National Data Opt-Out (NDDO) service. For more details about the NDDO, please see below.

HUC’s data processors

In carrying out our services, your personal data may also be transferred to our data processors, who we hold contracts with to support the work that we do. Those data processors are only permitted to process your personal data in accordance with, and within the bounds of, the terms of HUC’s contracts with them. Consequently, the data processors we work with are not permitted to share your personal information with any organisation apart from HUC or a third party they contract with, such as their processors (sub-processors of HUC). Examples of data processors HUC works with are:

• IT services or clinical system suppliers and providers (who may access our computers or records to fix a fault);
• Courier services;
• Information Management services (including secure data destruction of documents and hardware);
• Survey and feedback services (paper surveys to shape service delivery, safety, quality and audit);
• Payment card services (to facilitate card payment transactions such as SumUp, whose Privacy Policy can be found here Privacy Policy | SumUp);
• Scanning and data storage services;
• Translation services such as Language Line LanguageLine UK | Data Processing;
• Data services, for example, cloud storage.

We do not routinely undertake international data transfers. Where personal data is sent outside of the UK, steps will be taken to ensure that any transfer complies with relevant data protection laws and codes of practice issued by the Commissioner.

We will not share your information with any third parties for the purposes of direct marketing.

There may be some instances where HUC acts as a data processor, as opposed to a data controller. In this instance, the data controller responsible for the collection and handling of your personal data will provide you with the necessary transparency information.

In order to process personal data, we are required to rely on an appropriate lawful basis. This also applies to the processing of children’s data, although there are additional rules and safeguards that apply to the handling of children’s data.

Ordinarily, for the purpose of providing direct care, we rely of the lawful basis of public task, under Article 6(1)(e) UK GDPR. There are very limited circumstances where HUC could rely ‘consent’ as an appropriate lawful basis under the UK GDPR. Where we do rely on ‘consent’ under Article 6(1)(a) UK GDPR, it is important to ensure the child understands what they are consenting to, and it is explained in way that is easy to understand and meets the requirements of consent under the UK GDPR.

Under the UK GDPR, there is no minimum age at which a child can provide their consent, but the ‘consent’ captured must comply with Article 4(11) UK GDPR (consent must be “freely given, specific, informed and unambiguous indication of the data subject’s wishes by which he or she, by a statement or by a clear affirmative action, signifies agreement to the processing of personal data relating to him or her”). HUC does not provide information society services where there are additional rules in the capturing of consent of children under the age of 13.

We will do our best to respect and take account of people’s choices about how their information is used, including who it is shared with, such as family members. In particular, in the case of children, we will take account of whether the child is able (‘is Gillick competent’) to make decisions about how their information is used and shared, including with their parents and family members. This means there may be times we will respect a child’s choice about how their information is used and shared, but in other cases we may need to take a different view based on the wishes of their parents and what is in the child’s ‘best interests’.

We will only retain your personal data for as long as reasonably necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements. Our retention guidelines are aligned to the NHS Records Management Code of Practice as well as guidance from the National Archives. Please find a copy of our retention schedule here.

When deciding how long to retain your personal data, we consider its amount, nature and sensitivity; the risk of harm from unauthorised use or disclosure; the purposes for which we process it and whether those purposes can be achieved in other ways; and any applicable legal, regulatory, tax, accounting or other requirements.

We may retain your personal data for longer than the retention period if you make a complaint or if we reasonably believe there is a prospect of litigation arising from our relationship with you.

In some circumstances, you may ask us to delete your data before the retention period ends. Please contact our Information Governance team or our DPO using the contact details above to submit your request to delete your data before the retention period ends.

Your medical records contain confidential patient information, also known as special category data. This information can help with research and planning. You can choose if you do not want to share your data in this way. You can also choose for someone else, such as your children when they are under the age of 13, which aligns with the age a child can give consent to participate in digital services. This is often called the National Data Opt Out (NDDO). It was introduced so patients could opt out of their data being used for research and planning purposes in line with the recommendations of the National Data Guardian. Your choice will only apply to the health and care system in England. Follow this link to find out how this data is used and how to opt out, this includes guidance on:

• What is meant by confidential patient information
• What the benefits are of sharing your data
• Understand more about who uses your data
• Find out how your data is protected
• Make your choice, see or change your opt out decision

To find out how this is data is used and how to opt-out please click here: Choose if data from your health records is shared for research and planning – NHS

You have the right to restrict how and with whom we share the personal information in your records, in some instances. This must be noted explicitly within your records so all healthcare professionals and staff treating you are aware of your decision. It is important to note that there are a number of 111 and urgent care providers across the UK (not just HUC). If you do not want information about your care shared, you should advise the healthcare advisor (call handler) and clinician each time you interact with our service, so that we may consider and facilitate your request where possible.

It is important to understand that not allowing access to your information may affect the quality of the care you receive or make the provision of treatment or care unavailable to you. Please discuss any concerns you have with a member of HUC staff and / or the treating clinician.

In many situations, it is necessary to share information between services to deliver your care. However, it may be possible to request that specific or sensitive information is not made available to them.

There may also be some situations where information still needs to be made available/shared. For example, if there is a serious concern about an individual’s safety or where an ambulance needs to be called or to facilitate a patient’s attendance at an Emergency Department. We therefore may not be able to facilitate your request in all instances. Please discuss any concerns you have with HUC staff.

If you would like to restrict how and with whom we share your personal data in your records, or if you have any concerns about how your data may be shared, please contact our Information Governance team or DPO using the contact details above.

We have implemented and maintain appropriate technical and organisational security measures, such as ensuring ongoing compliance with the national Data Security Protection Toolkit annually to benchmark our performance against nationally recognised NHS standards. We have met these standards each year and continue to enhance our information security measures with certifications such as Cyber Essentials Plus.

Your rights as a data subject

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on the lawful basis we use for processing your information.

Your right of access – Subject Access Requests (SARs)

You can submit a request for the personal data that HUC holds about you (also known as a ‘subject access request’ or ‘SAR’). We are legally required to act on requests and provide information free of charge with the exception of requests that are manifestly unfounded, excessive or repetitive. If we determine this to be the case, we may charge a reasonable fee or refuse to act on the request. We can also refuse to provide information if an appropriate exemption applies.

We will generally provide the information within one month of receiving your request. However, if your request is complex, or if we receive a number of requests from you, we may provide the information within three months of receiving your request. If we do intend to extend the deadline to respond by a further two months, we will inform you within one calendar month of receiving your request.

You can also ask a third party (eg a relative, friend or solicitor) to make a SAR on your behalf. We will need to be satisfied that the third party making the request is entitled to act on your behalf. Before responding to a SAR for information held about a child, we will consider whether the child is mature enough to understand their rights.

If the request is from a child and we are confident they can understand their rights, we will usually respond directly to the child. We may, however, allow the parent or guardian to exercise the child’s rights on their behalf if the child authorises this, or if it is evident that this is in the best interests of the child. If a child is competent, they may authorise someone else, other than a parent or guardian, to make a SAR on their behalf.

Please send your request to our Information Governance team – huc.informationrequests@nhs.net or write to us at HUC Head Office, The Old Ambulance Station, Ascots Lane, Welwyn Garden City, AL7 4HL. On receipt your request will be logged with a reference number and we will reach out to you to confirm your identity.

It may be helpful to know that most of your records we have are also held by your GP practice, so you may wish to contact them directly, and that they may also be immediately available online via the NHS App. If you have any queries, please do not hesitate to contact us.

Your right to be informed

You have the right to be provided with clear, transparent and easy-to-understand information about how we use your personal data and about your rights.
You may also ask us for a copy of the personal information we hold about you.
This notice explains the information we must provide to meet your right to be informed, including:

• Where we collected your personal information from;
• Why and how we process it, and the legal basis for doing so;
• Who the data controller is;
• Who we may share your personal information with, or the categories of recipients involved.

Your right to rectification

You have the right to ask us to rectify or correct information if it is inaccurate or incomplete. Please inform of us any data which you would like to be rectified. We will pass on the changes to any third parties who need to change their records (that we are aware of). We may seek to verify the accuracy of the personal information before rectifying it.

Your right to erasure

You have the right to ask us to erase your personal information in limited circumstances where there is no compelling reason for us to keep it. We are not required to comply with your request to erase personal information if the processing is necessary for us, for example, to comply with a legal obligation or for the establishment, exercise, or defence of legal claims.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your information in limited circumstances. If processing is restricted, we can store your personal data but cannot use it further.

Where this right applies, it is possible for us to continue using your personal information following your request for restriction where we have your consent; or to establish, exercise or defend legal claims; or to protect the rights of another natural or legal person.

Your right to object to processing

You have the right to object to processing of your personal data which has our legitimate interests as its legal basis, if you believe your fundamental rights and freedoms outweigh our legitimate interests, or if the process forms part of our public tasks.

Your right to data portability

This only applies to the information you have given us. You have the right to obtain and reuse personal data for your own purposes across different services, and so you may ask us to transmit your personal data in structured, commonly used and machine-readable formats. The right only applies if we are processing information based on your consent or for the performance of a contract, and the processing is automated.

Your right not to be subject to automated decision-making

We do not make any automated decisions, and so this right is not engaged.

Your right to withdraw consent

Please note that we do not ordinarily rely on consent as a legal basis, due to the nature of the services we offer. However, where we do rely on consent as a legal basis, and you have given your consent for us to process your personal data, you have the right to withdraw your consent at any time.

For more information about your rights as a data subject, please see the Information Commissioner’s Office website: https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/individual-rights/individual-rights/

If you have queries or concerns about the way in which your data has been or is being handled, please contact our Data Protection Officer at huc.informationrequests@nhs.net.

Alternatively, you can raise a complaint via our Patient Experience Team.

You can make a complaint about the way we process your personal information to the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/. We ask that you please attempt to resolve any issues with us first (via contacting our Data Protection Officer or Patient Experience Team), although you have a right to contact the ICO at any time.

The UK GDPR and Privacy and Electronic Communications Regulations (PECR) govern the use of personal data and cookies technologies in the UK. PECR does not just apply to personal data, but also ‘information’. Under the UK GDPR, the lawful basis we rely on to process your personal data (in the context of cookies and similar technologies) is consent under standards set by Article 6(1)(a) UK GDPR, or our legitimate interests, under Article 6(1)(f) UK GDPR in maintaining a secure and effective website. We may ask you to agree to certain uses of cookies, but this is also subject to any relevant exceptions as set out in Schedule A1 of PECR. For further information on how we use cookies, please see our cookies policy here.

If you have queries or concerns about the way in which your data has been or is being processed, please contact us at huc.informationrequests@nhs.net or at our postal address listed above.

You can make a complaint about the way we process your personal information to the Information Commissioner’s Office (ICO) at: https://ico.org.uk/make-a-complaint/. We ask that you please attempt to resolve any issues with us first, although you have a right to contact the ICO at any time.

We will occasionally update our privacy information and therefore encourage you to periodically review this page from time to time to follow any updates made. For any further guidance or information around how your information is used, please reach out to our DPO at huc.informationrequests@nhs.net.