INTRODUCTION

By law, all organisations that use personal information (personal data) must provide a clear description of how it is used and also provide any related information to ensure the processing is carried out lawfully and fairly. Your NHS Trusts main Privacy Notice is available on their website. The additional information provided below describes only the use of your information when you use your NHS Trusts stent registry service. 

Please ensure you read your NHS Trusts main Privacy Notice and if you wish to use their stent registry service  here, please also read the supplementary information below:

Your Hospital/NHS Trust has engaged a specialised Stent Register supplier which is approved to NHS England technical standards and has gone through stringent scrutiny and achieved all necessary requirements to provide Stent Registers. NHS England, on behalf of your NHS Trust, contracts with the supplier and acts as a Joint Controller with your NHS Trust for this system. However, NHS England will not receive any of your personal information, so your NHS Trust remains responsible for your data and will ensure that any data you provide to use this service is used for Stent Register purposes only.

The name of the organisation we have engaged to provide this service is Capri Healthcare Ltd. (Stent Register), which will act as a Processor of your personal data under GDPR.

WHAT IS THE LAWFUL BASIS FOR YOUR stent registry service ?

The following legal bases set out in the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018 allow your NHS Trust to use your information when you use this stent registry service  provided by them:

1. When using your Personal Information (Personal Data): Article 6 (1) (e) of the GDPR, which permits us to process your personal information that is necessary to provide a service that is in the public interest
2. When using your Sensitive Personal Information (Sensitive Personal Data): Article 9(2) (h) of the GDPR permits us to process your health information which is necessary for the provision of health treatment.

WHAT ARE THE PURPOSES OF THE PROCESSING?

Stent Registers allow the NHS Trust’s patients to contact the Practice without having to wait on the phone or take time to come into the practice in person especially if a patient is not sure whether they need a face to face consultation. Stent Registers enable patients to use a secure online system to ask questions, report symptoms and we can then respond by signposting patients to the right person e.g. a Doctor or to appropriate service or support.

WHAT PERSONAL INFORMATION IS USED?

Because this service is online, your NHS Trust’s need to ensure that they continue to provide you with a confidential and high-quality service. To do so, they need to properly identify you, accurately note both your request and their responses. If they were prevented from using this essential information, then they would be unable to provide the service securely and confidentially.

The information which is not needed for the service is not collected by Stent Register.

Your NHS Trust uses the following information to identify and deal with your request.

1. Identity and Contact Information: includes name, date of birth, NHS number(optional), email address and telephone number, postal address. If you have created an NHS login account you will already have verified who you are and you can, if you wish, use those details from your NHS login account to save you time and avoid having to manually enter your details to re-identify yourself to use the stent registry service.
2. Special Categories of Personal Information: Your health information such as your symptoms, conditions, medication and other details which are already held in your NHS Trust records and/or which you provide through the Stent Register process.

DO WE SHARE YOUR PERSONAL INFORMATION?

YOUR NHS Trust CONTROLS YOUR INFORMATION

For Hospital/NHS Trusts, NHS England confirms that they will only use your information to provide you with health services.

As mentioned earlier, your NHS Trust has engaged Stent Register, a specialised organisation to provide this stent registry service on their behalf, so your personal data will be shared with them in order for them to provide this service to you.

If you are advised to seek urgent care, your information will not be shared with other health and care providers. 

Whenever your NHS Trust shares your information, they will always comply with the law.

WHERE IS YOUR INFORMATION PROCESSED AND STORED?

It is processed and stored within the United Kingdom.

HOW LONG IS YOUR PERSONAL INFORMATION KEPT?

Your Hospital/NHS Trust sets the retention periods for your information and instructs Stent Register, their engaged contractor that provides this service on your Hospital/NHS Trust’s behalf, to comply with these periods.  When your information has been copied to your NHS Trust’s own systems then your sensitive information will be deleted by Stent Register. Stent Register retains your contact details (name, email) for up to 6 weeks, in order to facilitate communication relating to the consultation, after which they are automatically deleted.

If you have been advised online to seek urgent care elsewhere, then your information will not be transferred to us and will not be retained after you have read the advice given.

YOUR DATA PROTECTION RIGHTS 

Under data protection law, you have rights including:

• Your right of access- You have the right to ask for copies of your personal information 
• Your right to rectification- You have the right to ask to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is complete 
• Your right to erasure- You have the right to ask us to erase your personal information in certain circumstances
• Your right to restriction of processing- You have the right to ask us to restrict the processing of your information in certain circumstances 
• Your right to object to processing- You have the right to object to the processing of your personal data in certain circumstances 
• Your right to data portability- You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances 

You are not required to pay any charge for exercising your rights. However, we can charge you a “reasonable fee” for the administrative costs of complying with your request if:

• it is manifestly unfounded or excessive; or
• you request further copies of your data following an initial request.

If you make a request, we have within one month to respond to you. If the request is complex or you have submitted a number of requests, we may inform you that we have extended this time period up to a maximum of a further two months. If you wish to make a request please contact us at:

Compliance Officer

Name: Capri Healthcare Ltd

Address: 20 Widney Lane, Solihull, B91 3LS

Phone Number: 0330 133 4047

E-mail: security@caprihealthcare.co.uk

HOW TO COMPLAIN 

We encourage you to bring concerns to our attention if you think that our collection or use of information is unfair, unlawful or misleading. If you wish to make a complaint please contact us in the first instance using the contact details referred to above.  You can also complain to the ICO if you are unhappy with how we have used your data. 

ICO – Registration Number  ZA543839

The ICO’s address is:

Information Commissioner’s Office

Wycliffe House

Water Lane, Wilmslow

Cheshire, SK9 5AF

Helpline number: 0303 123 1113