Purpose and legal basis for processing The CCGs actively seek to involve patients and the public in discussions about local service, including any changes, improvements and what is needed for future care. This can take place in a variety of ways, for example through the CCGs’ Worcestershire Involvement Network (WIN), contact via social media, voluntary community and social enterprise (VCSE) organisations, elected representatives and/or through formal consultations and meetings.
Everyone working for the NHS has a legal duty to keep information about you confidential. The NHS Care Record Guarantee and NHS Constitution provide a commitment that all NHS organisations and those providing care on behalf of the NHS, including the CCGs will use records about you in ways that respect your rights and promote your health and wellbeing.
If you have requested a service from the CCGs, for example you have requested to join the Worcestershire Involvement Network (WIN), then we will hold the details of the people who have requested the service in order to effectively provide it. However, we only use these details to provide the service the person has requested. For example, we might use information about people who have joined the Worcestershire Involvement Network (WIN) to send them information on the CCGs’ current workstreams or to invite them to an event.
Another example may be where you have opted to provide your details as part of a survey, in this case the CCG may contact you to ask if you are happy with the level of service received, or if the information is useful to you. Any personal data received in responses is removed before responses are collated, analysed or disseminated.
When people do subscribe to our services, they can cancel their subscription at any time by emailing
worcs.engagement@nhs.net and asking to unsubscribe. All information that we hold about you will be held securely and confidentially. We use administrative and technical controls to do this. We use strict controls to ensure that only a limited number of authorised staff are able to see information that identifies you where it is appropriate to their role and is strictly on a need-to-know basis. All of our staff, contractors and committee members receive role appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures.
We will only use the minimum amount of information necessary about you and will only retain information in accordance with the schedules set out in the Records Management Code of Practice for Health and Social Care 2016.
We are committed to protecting your privacy and will only process data in accordance with the Data Protection Legislation. This includes the General Data Protection Regulation (EU) 2016/679 (GDPR), the Data Protection Act (DPA) 2018, the Law Enforcement Directive (Directive (EU) 2016/680) (LED) and any applicable national Laws implementing them as amended from time to time.
In addition, consideration will also be given to all applicable Law concerning privacy, confidentiality, the processing and sharing of personal data including the Human Rights Act 1998, the Health and Social Care Act 2012 as amended by the Health and Social Care (Safety and Quality) Act 2015, the common law duty of confidentiality and the Privacy and Electronic Communications (EC Directive) Regulations.
The CCGs are Data Controllers as defined under the GDPR. We are legally responsible for ensuring that all personal information that we process i.e. hold, obtain, record, use or share about you, is done in compliance with the Data Protection Principles as set out in Article 5 under GDPR.
Sources of the data
The personal data is provided by data subjects when signing up to the Worcestershire Involvement Network, or if requesting one of our newsletters or expressing interest in an engagement event, either via our website or by completing one of our sign-up forms at one of the stakeholder events that we hold from time to time.
Categories of Personal data
We only require you to provide us with your name and email address or residential address so that we can send you our publications. Information regarding your gender, sexual orientation, marital status and disabilities is collected so that we can ensure that our patient involvement groups are representative of the population we serve. We may also use it to send you targeted information or news. However, it is not mandatory to provide this information.
Do we use any processors?
Yes - we use Survey Monkey to manage and populate our engagement programmes. For more information on Survey Monkey please visit their Privacy Policy.