Privacy notice for Patients and Service Users

Who we are

We are Shropshire Community Health NHS Trust . The Trust provides a range of community-based health services for adults and children in Shropshire, Telford and Wrekin, and some services to people in surrounding areas.

The Trust is registered with the Information Commissioner’s Office (registration number Z2709115

Our legal basis for processing your personal and special category information

As a healthcare provider the lawful basis for processing your personal information is:

• to process this data in the performance of a task carried out in the public interest or in the exercise of the data controller’s official authority

The lawful basis for processing special category data (for example sensitive information such as your health information) is:

• preventative medicine; and/or
• to enable the provision of health or social care or treatment or the management of health of social care systems and services

What personal information we collect about you and how do we obtain it

The personal information we collect might include your name, weight, height, date of birth, health conditions and treatments you receive. This will be collected when you access any of our services e.g. a stay in hospital or attendance at a clinic.

Why we collect your personal information and what do we do with it

We collect your personal information to help us provide and manage your health and social care needs. We keep full and accurate records about the healthcare and treatment you receive as one of our patients.

Who we share your personal information with and why

We share your relevant personal information for “direct care” purposes to ensure you receive high quality health and social care. This can include sharing your information if you are referred to a specialist or another part of the NHS/Social Care.

Sometimes we share personal identifiable information for “non-direct care” purposes to enable us to understand the health needs of our local population, to monitor and manage services, and for research. This does not always need to identify you, for example the information can be anonymised or pseudonymised (given a code). We will always comply with the data protection legislation.

When we use third party providers and suppliers (e.g. purchasing/delivering medicines and healthcare products) we have a local contract, appropriate agreements and instructions regarding the use and security of your information in place. This ensures that your information is used for the right purpose and that your privacy is protected. We never share your information for insurance or marketing purposes.

How we keep your information safe and maintain your records

All staff working in the Trust can only access information when authorised to do so, when there is a legitimate reason or on a need-to-know basis. They are trained to handle your information correctly, protect your privacy and keep your information secure. We do not keep your records for longer than necessary. Records are retained in accordance with the Department of Health and Social Care guidance and at the end of the life cycle records are destroyed in a safe manner.

What are your data protection rights?

Under the data protection legislation, you have the right to request access and receive a copy of your personal information by contacting the Trust as the data controller.

You can also contact us to raise any concerns regarding the handling of your information, for example, you may feel the information needs to be rectified or you may have an objection to how it is being used or shared.

Planning and Research

Your health records contain a type of data called confidential patient information. This data can be used to help with research and planning. You can choose to stop your confidential patient information being used for research and planning. Please visit the National data opt-out - NHS Digital

One Health & Care - Integrated Care Record (ICR)

Data will be viewed via the One Health & Care system, a “shared care record”, to ensure that all the organisations who provide “direct care” for you have the information that they need. It will only be shared securely and accessed on a need-to-know basis. For more information in One Health and Care please access the following information One Health and care - NHS Shropshire, Telford and Wrekin (shropshiretelfordandwrekin.nhs.uk)

Closed Circuit Television (CCTV)

We operate CCTV systems on our premises for the purposes of security and the safety of our patients, visitors, and staff. CCTV recordings may capture images of individuals as they move through or around our facilities. These recordings are processed in accordance with data protection laws and are stored securely. Access to footage is strictly limited to authorised personnel, and recordings are retained only for as long as necessary before being securely deleted. Footage may be shared with law enforcement or other relevant authorities where required by law.

Complaints and Feedback

If you submit a complaint or provide feedback, we will use the information you supply to investigate, respond to, and manage your concern in line with NHS procedures. This may include sharing relevant details with staff members involved in your care. Where other Trust's/organisations are subject to the complaint then we will share the complaint with them in order to coordinate and investigate complaints as required under NHS Complaints Regulations. All personal data provided during this process is treated and processed in accordance with data protection legislation. We retain this information only for as long as necessary and in line with our records management policy.

Friends and Family Test (FFT)

We collect feedback through the NHS Friends and Family Test to help us understand and improve patient experience. When you respond to the FFT, we may process personal data such as your age group, gender, and any free-text comments you choose to provide. Participation is voluntary and your responses are anonymised. All information is handled in line with data protection laws and is used solely to enhance the quality of care we provide. Your feedback may be shared with relevant staff and teams responsible for service improvement.

Further Information

Please visit our Trust website: Managing your records and Your Data Matters to the NHS

If you have concerns

If you have queries or concerns you can contact:
Data Protection Officer (IG Dept)
Shropshire Community Health NHS Trust
Ground Floor, Mount McKinley,
Shrewsbury Business Park,
Anchorage Ave,
Shrewsbury SY2 6FG
Email: shropcom.IGQ@infreemation.co.uk

You can also raise concerns to the ICO:
Information Commissioner’s Office Wycliffe House,
Water Lane, Wilmslow,
Cheshire SK9 5AF
www.ico.org.uk