1.0 What is a data protection notice also known as a Privacy Notice?
A Data Protection Notice explains how NHS Ayrshire & Arran uses your personal information, like your name, address, date of birth and all of the notes the doctor or nurse makes about you in your health record.
In some situations, we should ask your permission if we want to do anything with your information (this is known as processing).
2.0 Why do we need one?
We need a data protection notice to make sure we meet the rules which are written in a law called the UK General Data Protection Regulation (UK GDPR for short).
3.0 What is the UK GDPR?
The UK GDPR is a law that gives us guidelines to follow and provides you with a list of your rights, such as:
- The right to be told how we use your information
- The right to be told how we make sure that the information is kept safe
- The right to ask to see the information we hold
- The right to ask us to change information you think is wrong
4.0 What information do we collect about you and what do we do with it?
Improving the Cancer Journey (ICJ) is a service delivered by NHS Ayrshire & Arran and the three Health and Social Care Partnerships (HSCP) in collaboration with Macmillan Cancer Support.
If you choose to take part in the ICJ service you will receive direct assistance, advice and information, including:
- A Holistic Needs Assessment (HNA) which will be completed with you
- An individual Care and Support Plan which will be designed to help you, carers or your family members
- Support from a dedicated Macmillan Project Support Facilitator
- Appropriate support solutions, based on the HNA outcomes
- Signposting to other services which can help you
NHS Ayrshire & Arran will collect personal information about you to complete the HNA and Care and Support Plan. This information is detailed below:
- Your name, address, contact details
- Information about your health and wellbeing
- Information about your specific circumstances, including any physical, practical, emotional, family, relationship, spiritual or religious concerns
- Any additional information that supports our understanding of your particular needs and enables us to develop an HNA and Care and Support
We also use your information to verify your identity where required, contact you by post, email or telephone and to maintain our records.
Why do we have your information?
The information is required to allow us to complete the HNA and Care and Support Plan for you and provide access to services which could enhance the support and care which you will receive as part of ICJ.
It is important that we hold accurate and up to date information about you in order to provide you with a service. If any of your details have changed, or change in the future, please ensure that you tell us as soon as possible so that we can update your records.
How will we use information we hold about you?
We will use the information we hold about you to develop the HNA and Care and Support Plan. We may also use anonymised statistics to evaluate the use of the service.
5.0 Do we always need to ask your consent to share your information?
We provide the ICJ service to you as part of our statutory function as your regional (NHS) Health Board. If we need to share information from the ICJ service with other doctors or clinical staff, the UK GDPR allows us to do this without asking for your consent, as we are providing health and social care.
We need to have a lawful basis to share your information. We normally rely on what is known as our public task (article 6 (1) (e) of the UK GDPR). Public task – covers public functions and powers that are set out in law; or to perform a specific task in the public interest that is set out in law – for example providing a treatment.
When sharing more sensitive information like health data we need to have an additional reason and we rely on article 9 (2) (h) as we are providing a health and/or social care function.
We may need to share your personal data with the Ayrshire & Arran local authorities (North, South or East Ayrshire Council) to provide you with access to services which could enhance the support and care which you will receive as part of ICJ. We may also signpost/refer you to other support services after receiving your consent.
This will allow our service to make referrals to and share your personal data, with partner agencies to secure services. For example, we might use your information to secure appropriate benefits and/or the provision of support from Ayrshire Cancer Support or the Ayrshire Hospice.
You will be told about information exchanges with these external bodies as part of our ongoing dialogue with you; we only share information relating to you with partner agencies who are (or will be) directly involved in your care and support. You will also be informed about how your information will be collected, held and shared.
We take your privacy seriously and will only use your personal information to provide the services you have requested from us and to send you information about support services you may be interested in.
This data sharing is in accordance with our Information Sharing Agreements and the NHS Ayrshire & Arran Data Protection Notice – covered in our full privacy statement.
Your details will be recorded on NHS Ayrshire and Arran patient information systems and care planning web-based system.
We may also anonymise your data and use this information to evaluate the Improving the Cancer Journey Service. We may also provide anonymised information to Macmillan Cancer Support for the purpose of evaluation and review. If we do anonymise your data you will not be identifiable in any way. See the MacMillan privacy policy.
6.0 How do we keep your personal information safe?
Everyone working in the NHS knows that they need to keep your information safe. Especially the information which identifies you; this might be your name or address and anything that you come to see us about. We are not allowed to share this type of information with others unless permitted. This includes talking to them about it.
7.0 How can you see the information we hold about you?
We maintain a retention schedule as part of our Records Management policy detailing the minimum retention period for the information and procedures for the safe disposal of personal information. View our data protection notice for more information.
Under the UK GDPR you are allowed to ask to see your health records whenever you like, we call this a Subject Access Request (SAR for short). This is normally free.
To be able to see your records you will need to contact us. You can phone, email or write to us. We will ask you for some basic details so that we can make sure that we are giving this information to the right person. We will check with the doctor that it is okay for us to give you your health record and once the doctor has agreed we will give you the information within one month of you asking us.
After seeing your health record if you think that any of the information you see is not correct, you can ask for this information to be taken out or corrected. This can only be done if we are 100% sure that the information is NOT correct.
For more details on how we process your personal information, please read the NHS Ayrshire & Arran Data Protection Notice.
If you do not have access to the internet you can contact us via telephone to request hard copies of our documents.
8.0 What if you don’t want us to share your information?
All of our patients, no matter what their age, can in some circumstances say that they don’t want us to share their information.
9.0 What if I have any questions
NHS Ayrshire & Arran employ a Data Protection Officer (DPO) to check that we handle personal information in a way that meets all the rules. If you want to ask any question you can ask a member of medical staff or the DPO:
Head of Information Governance & DPO
14 Lister Street
University Hospital Crosshouse
Email: InformationGovernance@aapct.scot.nhs.uk
Tel: 01563 825831
10.0 Your right to complain
If you are unhappy with the way we have used, shared or managed your personal information, you can complain to the DPO using the contact details noted above.
If you are still unhappy and are 12 or over, you have the right to complain to the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
45 Melville Street
Edinburgh
EH3 7HL
Email: scotland@ico.org.uk
Telephone: 0303 123 1113
ICO registration reference number: Z8437002