{"id":12026,"date":"2024-10-10T10:25:56","date_gmt":"2024-10-10T09:25:56","guid":{"rendered":"https:\/\/bnssghealthiertogether.org.uk\/?page_id=12026"},"modified":"2026-02-25T11:43:31","modified_gmt":"2026-02-25T11:43:31","slug":"privacy-notice","status":"publish","type":"page","link":"https:\/\/bnssghealthiertogether.org.uk\/gu\/integrated-care-board\/contact-us\/privacy-notice\/","title":{"rendered":"\u0a97\u0acb\u0aaa\u0aa8\u0ac0\u0aaf\u0aa4\u0abe \u0ab8\u0ac2\u0a9a\u0aa8\u0abe"},"content":{"rendered":"<div class=\"assembler_default-group assembler_module_group assembler_default-group_1 assembler_module_group_1\"><div class=\"assembler_module_area assembler_module_area_1\"><div class=\"assembler_table-of-contents-module assembler_module assembler_table-of-contents-module_1 assembler_module_1  transparent\"><a tabindex=\"-1\" title=\"Section titled module-1\" id=\"module-1\" href=\"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/pages\/12026\/#module-1\" class=\"anchor\"><span class=\"hidden\">Section titled module-1<\/span><\/a><!-- Template found for table-of-contents-module - Template: template-table-of-contents - Matched: _only -->\r\n<section class=\"w-full mx-auto max-w-content border-b border-pale-grey pt-6 sm:pt-12 pb-3 sm:pb-6\">\r\n    <div class=\"entry-content w-full\">\r\n    <h1>Privacy notice<\/h1>\n<p>Contents<\/p>\n    <div class=\"navigation-list\">\r\n                    <ul>\r\n                      <li class=\"text-sm\">\r\n                                                              Privacy notice                            <\/li>\r\n                                <li class=\"text-sm\">\r\n                              <a href=\"https:\/\/bnssghealthiertogether.org.uk\/gu\/integrated-care-board\/contact-us\/privacy-notice\/our-uses-of-information\/\" class=\"text-sm underline-offset-4 font-normal hover:!underline-4\">\r\n                                                                Our uses of information                                <\/a>\r\n                          <\/li>\r\n                      <li class=\"text-sm\">\r\n                              <a href=\"https:\/\/bnssghealthiertogether.org.uk\/gu\/integrated-care-board\/contact-us\/privacy-notice\/record-of-processing\/\" class=\"text-sm underline-offset-4 font-normal hover:!underline-4\">\r\n                                                                Population health management record of processing activities                                <\/a>\r\n                          <\/li>\r\n                  <\/ul>\r\n          <\/div>\r\n  <\/div>\r\n<\/section><\/div><!-- .assembler_table-of-contents-module.assembler_module.assembler_table-of-contents-module_1.assembler_module_1..transparent --><div class=\"assembler_text-module assembler_module assembler_text-module_2 assembler_module_2  transparent\"><a tabindex=\"-1\" title=\"Section titled module-2\" id=\"module-2\" href=\"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/pages\/12026\/#module-2\" class=\"anchor\"><span class=\"hidden\">Section titled module-2<\/span><\/a><!-- Template found for text-module - Template: template-text - Matched: _only --><section class=\"w-full mx-auto max-w-content pt-3 sm:pt-6 pb-12 sm:pb-24\">\r\n  <div class=\"entry-content w-full !px-0 max-w-small\">\r\n        <h2>Who we are and what we do<\/h2>\n<p>NHS Bristol, North Somerset and South Gloucestershire ICB use patient information to enable us to understand how patients use services and the care and treatment required so we can ensure we commission high-quality safe care that is both clinically and cost-effective.<\/p>\n<p>This Privacy Notice sets out how we use this information in the best possible way. For specific uses, data sources and the legal basis for data processing, see <a href=\"https:\/\/bnssghealthiertogether.org.uk\/integrated-care-board\/contact-us\/privacy-notice\/our-uses-of-information\/\">our uses of information<\/a>.<\/p>\n<p>This notice summarises how we use your information.<\/p>\n<p>It is part of how we ensure we are open and transparent how we collect and use information about you. It covers information we collect directly from you or receive from other individuals or organisations.<\/p>\n<p>We will keep our privacy notice under regular review. This privacy notice was last reviewed in December 2025.<\/p>\n<p>You can contact us if you have any questions or concerns about how we use your information.<\/p>\n<h2>Personal information we collect and hold<\/h2>\n<p>We do not routinely hold or have access to your medical records. However, we may need to hold some personal information about you, for example:<\/p>\n<ul>\n<li>if you have made a complaint to us about healthcare that you have received, and we need to investigate<\/li>\n<li>if you ask us to provide funding for Continuing Healthcare services<\/li>\n<li>if you are using our referral support service<\/li>\n<li>if you ask us for our help or involvement with your healthcare, or where we are required to fund specific specialised treatment for a particular condition that is not already covered in our contracts with organisations that provide NHS care<\/li>\n<li>if you ask us to keep you regularly informed and up-to-date about the work of the ICB, or if you are actively involved in our engagement and consultation activities or service user groups<\/li>\n<li>for safeguarding work, we would need to collaborate with other agencies and get specific patient data from your medical records to fulfil safeguarding legislative requirements<\/li>\n<li>to investigate outbreaks of infections or increasing trends of infections<\/li>\n<li>to enable the ICB to process payments, calculating costs for the members of the public involved in research, Research Capability Funding (RCF) awards and individuals collaborating on, or applying for National Institute for Health and Care (NIHR) and other non-commercial research grant awards through the ICB<\/li>\n<li>to ensure that individuals hold the appropriate skills\/qualifications to participate in research<\/li>\n<\/ul>\n<p>Our records may include relevant information that you have told us, or information provided on your behalf by relatives or those who care for you, or from health professionals and other staff directly involved in your care and treatment.<\/p>\n<p>The data may relate to Primary or Secondary care. Primary Care data relates to primary care services such as GPs, pharmacists and dentists, including military health services and some specialised services. Secondary care services include planned hospital care, rehabilitative care, urgent and emergency care community health services, mental health services and learning disability services.<\/p>\n<p>Our records may be held on paper or in a computer system. The types of information that we collect and use include:<\/p>\n<ul>\n<li><strong>Personal data<\/strong>: is defined in Data Protection Legislation as data or information about a living person, which also identifies that person or allows that person to be identified when combined with other information held by the organisation. Identifying information includes name, address, date of birth, postcode and NHS number.<\/li>\n<li><strong>Special Category Data<\/strong>: is defined in Data Protection Legislation as information about an identifiable individual\u2019s: race, ethnic origin. Politics, religion, trade union membership, genetics, biometrics, health, sex life, sexual orientation. Criminal offence data will also be included.<\/li>\n<li><strong>Confidential Information<\/strong>: including both information \u2018given in confidence\u2019 and \u2018that which is owed a duty of confidence\u2019 this also includes \u2018special category data\u2019 as defined in the Data Protection Legislation.<\/li>\n<li><strong>Pseudonymised Information<\/strong>: this is data that has undergone a technical process that replaces your identifiable information such as NHS number, postcode, date of birth with a unique identifier, which obscures the \u2018real world\u2019 identity of the individual patient to those working with the data.<\/li>\n<li><strong>De-Identified Data<\/strong>: this is Personal Data that has been de-identified, so that an individual can no longer be directly or indirectly identified in the data, but where the organisation holding the data does still have the means to identify the individual.<\/li>\n<li><strong>Anonymised Information<\/strong>: This is data rendered into a form which does not identify individuals and where there is little or no risk of identification.<\/li>\n<li>For specific uses, data sources and the legal basis for data processing, see our uses of information.<\/li>\n<\/ul>\n<h2>How do we use your information and what safeguards are in place?<\/h2>\n<p>We are committed to protecting your privacy and will only process personal confidential data in accordance with the UK General Data Protection Regulation (UK DPDR) and Data Protection Act 2018 (Data Protection Legislations).<\/p>\n<p>Bristol, North Somerset and South Gloucestershire ICB is a Data Controller under the terms of the Data Protection Legislation. We are legally responsible for ensuring that all personal information that we process i.e. hold, obtain, record, use or share about you, is processed in compliance with the Data Protection Principles.<\/p>\n<p>All data controllers (unless specifically exempted) must notify the Information Commissioner\u2019s Office (ICO) of all personal information processing activities. Our ICO Data Protection Register entry can be found in the Data Protection Register on the Information Commissioner\u2019s Office website.<\/p>\n<p>Everyone working for the NHS has a legal duty to keep information about you confidential.<\/p>\n<p>The NHS Care Record Guarantee and NHS Constitution provide a commitment that all NHS organisations and those providing care on behalf of the NHS will use records about you in ways that respect your rights and support your health and wellbeing.<\/p>\n<p>If you are receiving services from the NHS, we share information that does not identify you (anonymised) with other NHS and social care partner agencies for the purpose of improving local services, planning, research, audit and public health.<\/p>\n<p>We only share information that identifies you when we have a fair and lawful basis.<\/p>\n<p>This includes:<\/p>\n<ul>\n<li>for the purposes of the provision of health or social care or treatment or the management of health or social care systems<\/li>\n<li>when we are lawfully able to for example to carry out our official functions as an ICB and in the public interest<\/li>\n<li>when we are lawfully required to report certain information to the appropriate authorities e.g. to prevent fraud or a serious crime<\/li>\n<li>to protect children and vulnerable adults<\/li>\n<li>you have given us permission<\/li>\n<li>when a formal court order has been served<\/li>\n<li>emergency planning reasons such as for protecting the health and safety of others<\/li>\n<li>when permission is given by the Secretary of State or the Health Research Authority to process confidential information without the explicit consent of individuals.<\/li>\n<\/ul>\n<p>Where we have a legal basis for sharing and using data without consent we will do so, this notice informs individuals about their information is shared.<\/p>\n<p>We will only share and use the minimum amount of information necessary is perform our duties. All information that we hold about you will be held securely and confidentially. We use administrative and technical controls to keep information secure including procedures and encryption. Only a limited number of authorised staff have access to information that identifies you where it is appropriate to their role and is strictly on a need-to-know basis. We have Role-Based Access Controls (RBAC) in place i.e. a security method that controls access to data or a system by assigning permissions to users defined roles rather than to individuals.<\/p>\n<p>All of our staff, which include employees, bank staff, interim staff, staff on non-payroll roles, contractors and committee members, receive appropriate and ongoing training to ensure they are aware of their personal responsibilities. Our staff have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures.<\/p>\n<p>We will only keep information in accordance with the schedules set out in the Records Management Code of Practice 2021. When appropriate we will confidentially and securely dispose of information in accordance with the Code of Practice.<\/p>\n<h2>Overseas transfers<\/h2>\n<p>Your information will not be sent outside of the United Kingdom where the laws do not protect your privacy to the same extent as the law in the UK. We will never sell any information about you.<\/p>\n<h2>What are your rights?<\/h2>\n<p>You have the right to privacy and to expect the NHS to keep your information confidential and secure. Under UK GDPR you have specific legal rights. These rights are:<\/p>\n<ul>\n<li>The right to be informed<\/li>\n<li>The right of access<\/li>\n<li>The right to rectification<\/li>\n<li>The right to erasure<\/li>\n<li>The right to restrict processing<\/li>\n<li>The right to data portability<\/li>\n<li>The right to object<\/li>\n<li>Rights in relation to automated decision making and profiling<\/li>\n<\/ul>\n<h2>Your right to opt out of data sharing and processing<\/h2>\n<p>The NHS Constitution states \u2018You have a right to request that your personal confidential information is not used beyond your own care and treatment and to have your objections considered\u2019.<\/p>\n<h3>Type 1 opt-out<\/h3>\n<p>If you do not want personal confidential information that identifies you to be shared outside your GP practice, you can register a \u2018Type 1 opt-out\u2019 with your GP practice. This prevents your personal confidential information from being used for research and planning, except for your direct health care needs and in particular circumstances required by law, such as a public health emergency like an outbreak of a pandemic disease. Patients are only able to register the opt-out at their GP practice and your records will be identified using a particular code that will stop your records from being shared outside of your GP Practice.<\/p>\n<p>To do this, you need to <a href=\"https:\/\/bnssghealthiertogether.org.uk\/wp-content\/uploads\/2026\/02\/Type1Opt-outform.docx\">fill in an opt-out form<\/a> and return it to your GP surgery.<\/p>\n      <a href=\"https:\/\/bnssghealthiertogether.org.uk\/wp-content\/uploads\/2026\/02\/Type1Opt-outform.docx\"  class=\"btn-link flex w-[fit-content] \">Download the Type 1 opt-out form (docx)<\/a>\n\n<h3>National data opt-out<\/h3>\n<p>The National data opt-out enables individuals to opt-out from the use of their data for research or planning purposes. Your national data opt-out choice can be viewed or changed at any time by using an online service.<\/p>\n<p>If you choose this opt-out, NHS England and other health and care organisations will not be able to share any of your personal data with other organisations for research and planning, except in certain situations. For example, when required by law. There are some circumstances where there is a legal obligation for us to process your personal confidential information and you will not be able to opt-out. These include:<\/p>\n<ul>\n<li>to protect children and vulnerable adults<\/li>\n<li>when a formal court order has been served upon us<\/li>\n<li>when we are lawfully required to report certain information to the appropriate authorities e.g., to prevent fraud or a serious crime<\/li>\n<li>emergency planning reasons such as for protecting the health and safety of others<\/li>\n<li>when permission is given by the Secretary of State or the Health Research Authority to process confidential information without the explicit consent of individuals<\/li>\n<\/ul>\n<p>You have the right to refuse\/ withdraw consent to information sharing at any time\u00a0and your decision will not affect your individual care.<\/p>\n<p>Further information on the National Data Opt-Out and how to set a National Data Opt-Out can be found at:<a href=\"https:\/\/www.nhs.uk\/your-nhs-data-matters\/\" target=\"_blank\" rel=\"noopener\"> www.nhs.uk\/your-nhs-data-matters<\/a><\/p>\n<p>The ICB has put procedures in place to review uses and disclosures of confidential patient information against the national data opt-out guidance. The ICB is currently compliant with the national data opt-out policy.<\/p>\n<h2>Your Right of Access: Subject access requests<\/h2>\n<p>Individuals can find out if we hold any personal information about them by making a right to access (subject access request) under the Data Protection legislation. The ICB has a policy and standard operating procedures that set out the approach the ICB will take in responding to requests. If you choose to engage with the ICB through this route, then you consent to us using your information to process your enquiry.<\/p>\n<p>If we do hold information about you, we will:<\/p>\n<ul>\n<li>confirm that we are processing your personal data<\/li>\n<li>provide a copy of your personal information<\/li>\n<li>provide additional information, such as the reason why we hold your information, who we may have shared information with, how long we hold information<\/li>\n<\/ul>\n<p>If you would like to receive a copy of information we hold about you your please contact us:<\/p>\n<p><strong>Post:<\/strong> NHS Bristol, North Somerset and South Gloucestershire ICB, Floor 2, North Wing, 100 Temple Street, Bristol, BS1 6AG<br \/>\n<strong>Email:<\/strong> <a href=\"mailto:bnssg.foi@nhs.net\">bnssg.foi@nhs.net<\/a><\/p>\n<h2>Confidentiality advice and support<\/h2>\n<p>We have a Caldicott Guardian who is a senior member of staff responsible for protecting the confidentiality of service users and their information, as well as enabling appropriate and lawful information-sharing. If you need advice or support about data protection please <a href=\"https:\/\/bnssghealthiertogether.org.uk\/integrated-care-board\/contact-us\/\">contact us<\/a>.<\/p>\n<h2>Data Protection Impact Assessments<\/h2>\n<p>We routinely completed Data Protection Impact Assessments (DPIAs) which helps us to identify, assess and mitigate or minimise privacy risks with our data processing activities. DPIAs particularly relevant when a new data processing process, system or technology is being introduced. Details of our DPIAs are available on request from our Data Protection Officer by emailing <a href=\"mailto:bnssg.data.protection@nhs.net\">bnssg.data.protection@nhs.net<\/a>.<\/p>\n<h2>Complaints and suggestions<\/h2>\n<p>We try to meet the highest standards when collecting and using personal information. We encourage people to bring concerns to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We also welcome any suggestions for improving our procedures. Please see our <a href=\"https:\/\/bnssghealthiertogether.org.uk\/integrated-care-board\/contact-us\/\">Customer Services page<\/a> for more information.<\/p>\n<p>The Bristol, North Somerset and South Gloucestershire ICB Data Protection Officer is Paul Antony who can be contacted by email at <a href=\"mailto:bnssg.data.protection@nhs.net\">bnssg.data.protection@nhs.net<\/a><\/p>\n<p>You can contact the Information Commissioner&#8217;s Office (ICO) for independent advice about data protection, privacy and data-sharing issues.<\/p>\n<p><strong>Post:<\/strong> Information Commissioner, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF<br \/>\n<strong>Phone:<\/strong> 08456 30 60 60 or 01625 54 57 45<\/p>\n<p>Please <a href=\"https:\/\/bnssghealthiertogether.org.uk\/integrated-care-board\/contact-us\/\">contact us<\/a> if you have any questions or concerns about how we use your information.<\/p>\n<p>For independent advice about data protection, privacy and data-sharing issues, you can contact the Information Commissioner&#8217;s Office (ICO). You can also complain directly to the ICO.<\/p>\n<h2>Further information<\/h2>\n<p>You can find further information about how the NHS uses personal confidential data and your rights in:<\/p>\n<ul>\n<li>The <a href=\"https:\/\/www.gov.uk\/government\/publications\/the-nhs-constitution-for-england\" rel=\"noopener\">NHS Constitution for England<\/a><\/li>\n<li>An independent review of information about service users is shared across the health and care system led by Dame Fiona Caldicott was conducted in 2012. The report is called <a href=\"https:\/\/assets.publishing.service.gov.uk\/media\/5a7c4716e5274a2041cf2ebb\/9731-2901141-TSO-Caldicott-Government_Response_ACCESSIBLE.PDF\" rel=\"noopener\">Information: To share or not to share?<\/a><\/li>\n<li>The <a href=\"https:\/\/assets.publishing.service.gov.uk\/media\/5a7a035fe5274a34770e3a01\/2900774_InfoGovernance_accv2.pdf\" rel=\"noopener\">Information Governance Review<\/a><\/li>\n<li>Please visit the <a href=\"https:\/\/digital.nhs.uk\/\" rel=\"noopener\">NHS Digital website<\/a> for further information about their work. The <a href=\"https:\/\/digital.nhs.uk\/data-and-information\/looking-after-information\/data-security-and-information-governance\/codes-of-practice-for-handling-information-in-health-and-care\/a-guide-to-confidentiality-in-health-and-social-care\/a-guide-to-confidentiality\" rel=\"noopener\">Guide to Confidentiality<\/a> provides a useful overview of the subject.<\/li>\n<li>The <a href=\"https:\/\/ico.org.uk\/\" rel=\"noopener\">Information Commissioner\u2019s Office<\/a> is the Regulator for the UK General Data Protection Regulation and Data Protection Act 2018.<\/li>\n<li>The <a href=\"https:\/\/www.hra.nhs.uk\/\" rel=\"noopener\">NHS Health Research Authority<\/a> (HRA) protects and promotes the interests of patients and the public in health and social care research.<\/li>\n<\/ul>\n<p>You have the right to be informed of to be informed of automated decision making and profiling. Please see details of Risk Stratification below which explains any profiling that may take place, there is no automated decision making, no decision is taken about any individual without human intervention of the information.<\/p>\n  <\/div>\r\n  <\/section><\/div><!-- .assembler_text-module.assembler_module.assembler_text-module_2.assembler_module_2..transparent --><\/div><!-- .assembler_module_area.assembler_module_area_1 --><\/div><!-- .assembler_default-group.assembler_module_group.assembler_default-group_1.assembler_module_group_1  -->","protected":false},"excerpt":{"rendered":"<p>How NHS Bristol, North Somerset and South Gloucestershire ICB uses personal data and patient information to inform our functions.<\/p>","protected":false},"author":1,"featured_media":0,"parent":34142,"menu_order":0,"comment_status":"closed","ping_status":"closed","template":"","meta":{"_acf_changed":false,"footnotes":""},"tags":[968,969,966,967,911,964,915],"class_list":["post-12026","page","type-page","status-publish","hentry","tag-gdpr","tag-information","tag-patient-data","tag-personal-data","tag-population-health","tag-privacy-notice","tag-record-of-processing"],"acf":[],"_links":{"self":[{"href":"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/pages\/12026","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/pages"}],"about":[{"href":"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/types\/page"}],"author":[{"embeddable":true,"href":"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/comments?post=12026"}],"version-history":[{"count":17,"href":"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/pages\/12026\/revisions"}],"predecessor-version":[{"id":46999,"href":"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/pages\/12026\/revisions\/46999"}],"up":[{"embeddable":true,"href":"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/pages\/34142"}],"wp:attachment":[{"href":"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/media?parent=12026"}],"wp:term":[{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/bnssghealthiertogether.org.uk\/gu\/wp-json\/wp\/v2\/tags?post=12026"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}