Privacy Notice Rugby Health Limited

PRIVACY NOTICE

Rugby Health Limited is a private company limited by shares, incorporated on 24th September 2020. Rugby Health Limited is wholly owned by the 12 Rugby GP Practices, who are shareholders. Rugby Health Ltd. fully appreciate the importance of protecting and managing your data and maintaining your privacy. To ensure that we comply with these requirements all our data management and clinical processes fully recognise the data protection law in force in the UK (e.g. the Data Protection Act 2018 which includes relevant Articles from the UK General Data Protection Regulation (GDPR).

Please read the following information carefully to understand how we process your personal data.

DATA CONTROLLER

For the purpose of the Data Protection Laws, the Data Controller is Rugby Health Ltd. whose registered address is Clifton Road Surgery, 26-28 Clifton Road, Rugby, CV21 3QF. When we refer to ‘we’, ‘us’ and ‘our’, we mean Rugby Health Ltd.

We are registered with the Information Commissioner’s Office and our registration number is ZA803820 Please note that all data captured will be used and held in accordance with the requirements of the Data Protection Act 2018 (DPA) and the EU General Data Protection Regulation (GDPR).

USE OF YOUR PERSONAL INFORMATION

Rugby Health Limited will process your personal data (including special categories of personal data) in accordance with our obligation under the 2018 Act. This privacy notice explains why we collect information about you and how that information may be used. Our health care professionals who provide you with services maintain records about your health and any treatment or care you may have received previously. These records help to provide our patients with the best possible healthcare. Your records may exist in several formats including electronic, paper or a mixture of both, and we deploy many working organisational approaches to ensure that such information is maintained within a confidential and secure environment.

The records which we could hold about you may include some of the following information: –

Identity Data includes first name, maiden name, last name, username or similar identifier, NHS number, marital status, title, date of birth and gender.
Contact Data includes email, postal address and telephone numbers.
Health Data includes information relating to our staff, and internal investigations due to complaints or internal whistleblowing. Information received relating to patient safety incidents.
Confidential Patient Information – this term describes information or data relating to health and other matters disclosed to another (e.g., patient to clinician) in circumstances where it is reasonable to expect that the information will be held in confidence. This includeds both information ‘given in confidence’ and ‘that which is owed a duty of confidence’.
Recruitment Data includes items of personal information such as your name, date of birth, address, qualifications, references and potentially special categories of data such as occupation health data (if provided) and disclosure and barring service self-declaration form details. Please refer to our Recruitment Privacy Notice for full details.
Special Categories of Personal Data (non-health) includes information about disability, race or ethnicity, religious or philosophical beliefs, sexual orientation or information about political opinions.
Other personal data which does not fall within any of these categories (such as employment status and contract type, criminal convictions and offences or bank details) is held to fulfil our functions in the recruitment, appointment, development, and appraisal of staff. This includes information and correspondence related to recruitment and appraisal, performance and development information for those who have either applied for roles that we advertise, have expressed an interest in applying for these roles or who have been appointed as chairs or non-executives of NHS trusts or as charitable trustees. To ensure you receive the highest levels of care, your records will be used to facilitate the care that we provide. Anonymised information held about you could, on occasions, be used to help protect the health and wellbeing of the general public and to help us manage our contracts with commissioners. Information could also be used within our organisation for the purposes of audits which in turn will provide monitoring of the quality of the services we provide. Some of this information will be used for statistical purposes and we will ensure that individuals cannot be identified.

CORONAVIRUS (COVID-19) PANDEMIC AND YOUR INFORMATION

We have an obligation to protect all our patients, suppliers and employees’ health. For this reason, it is reasonable for us to ask you to tell us if you are experiencing COVID-19 symptoms. In such circumstances we may need to collect specific health data about you. Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards.

MAINTAINING THE CONFIDENTIALITY OF YOUR PERSONAL DATA

Rugby Health Limited has internal policies and controls in place to ensure that your personal data is not lost; accidentally destroyed, misused or disclosed and is not accessed except by Rugby Health or our practices in the performance of their duties. Our staff are trained in data protection principles and understand they have a legal obligation to keep information about you confidential. They also understand that information about you will only be shared with other parties if there is an agreed need to do so or a legal reason. We will only share your data without your permission if there are very exceptional circumstances (i.e. life or death situations, urgent Safeguarding incident where consent cannot be gained or is not required), where the law requires information to be passed on and / or in accordance with the Caldicott Principle 7 e.g. to share or not to share. This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott Principles.

PARTNER ORGANISATIONS

It may be possible that we will share your information with other organisations, if this is required, we will apply robust controls.

These could include organisations such as: -

NHS Integrated Care Board (previously the Clinical Commissioning Group).
General Practices within Rugby Health Ltd.
Other NHS organisations or third party organisations commissioned to deliver or support the delivery of patient services.

It is noted that the above list is not exhaustive, and we may contract with other external organisations to undertake processing of your personal information to deliver services or support the operation of our organisation. These third party organisations will abide with contractual conditions regarding the protection of personal data under the Data Protection regulations. In some cases, you will be requested to provide positive consent if we intend to share your personal details with other organisations.

LEGAL BASIS FOR PROCESSING

Our legal basis for processing your data relies on certain conditions set out GDPR Articles 6 and 9 as part of the UK GDPR and the UK Data Protection Act. 2018.e.g.

- UK GDPR Article 6(1)(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; and

- UK GDPR Article 9(2)(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3; (of Article 9)

RETENTION OF YOUR DATA

Your data will be retained for no longer than is necessary and in accordance with Schedule of Retention.

YOUR DATA SUBJECT RIGHTS

You have a right under the Data Protection Act 2018, to request access to view or to obtain a copy of what information the organisation holds about you and to have it modified should it be inaccurate. The process to access your records is known as a Subject Assess Request (SAR) and the way it works is outlined below:

Your Subject Access Request must be made in writing to the Data Protection Officer at Rugby Health at the address shown below.
The latest regulations state that there is no charge to have a printed copy of your information provided.
The request will be reviewed and if possible, completed within one month (subject to our possible requests for further clarification from you).
You will need to provide adequate proof of your identity before we will release the requested details (e.g. full name, address, date of birth, NHS number and details of your request), you must also provide two forms of identification.

In addition, you have the following rights: -

You have the right to information about what personal data we process, how and on what basis as set out in this document.
You have the right to access your own personal data by way of a subject access request.
You can request for the correction of any inaccuracies in your personal data.
You have the right to request that we erase your personal data where we were not entitled under the law to process it or it is no longer necessary to process it for the purpose it was collected.
While you are requesting that your personal data is corrected or erased or are contesting the lawfulness of our processing, you can apply for its use to be restricted while the application is made.
You can object to data processing where we are relying on a legitimate interest to do so and you think that rights and interests outweigh our own and you wish us to stop.
You can object if we process your personal data for the purposes of direct marketing.
You have the right to receive a copy of your personal data and to transfer your personal data to another data controller. We will not charge for this and will in most cases aim to do this within one month.
You have the right to be notified of a data security breach concerning your personal data
With some exceptions, you have the right not to be subjected to automated decision making.

In most situations, we will not rely on your consent as a lawful ground to process your data. If we do however request your consent to the processing of your personal data for a specific purpose, you have the right not to consent or to withdraw your consent later.

If you would like to exercise any of these rights, or withdraw your consent please contact Liana Blake, Rugby Health Limited Data Protection Officer at the registered address (envelopes should be marked for the “Data Protection Officer” or by email liana.blake2@nhs.net If you believe that the Organisation has not complied with your data protection rights, you may contact the Information Commissioner’s office. The contact details can be found at www.ico.org.uk. This website has further information on your rights and our obligations.