Our Data Protection Guarantee

In order to comply with data protection legislation, this notice has been designed to inform you of what you need to know about the personal information we process. This is your assurance that we are complying with our legal obligation to you and a good opportunity for you to understand or exercise your information rights.

We are legally required to tell you:

• What personal information we use
• Why we need your personal information
• The lawful basis for processing your personal information i.e. legitimate reasons for collecting, keeping, using and sharing it
• How we use, store, protect and dispose of your personal information
• How long we keep it for and who we may share it with
• About your information rights
• How to report a compliant or concern

Your Personal Information

When we mean personal information, we are referring to any information that can identify a specific person, either on its own or together with other information. The obvious examples are name, address and date of birth; however this could include other forms for data, such as email address, car registration, specific physical feature, NHS number, pictures, images and so forth.

This also includes Pseudonymisation which is the use of a random set of numbers or letters to generate a unique identifier (pseudonym), which can be matched with additional information (such as a ‘key’) to identify you. This does not reveal your identity, but allows the linking of different data. This is commonly used in research, where your identify is linked with a random number for the purpose of publishing research findings, the key is never shared but used to link your research data to you.

Most of the personal information we process is confidential or sensitive because of the nature of our business activities (health and social care). This could be used in a discriminatory way and is likely to be of a private nature, so greater care is needed to ensure this is processed securely. Confidential or sensitive information includes:

• your racial or ethnic origin of the data subject
• political opinions
• religious beliefs or other beliefs of a similar nature
• Trade Union membership
• physical or mental health or condition
• sexual life
• alleged commission of, or proceedings for any offence or criminal history

Anonymised data is not personal information. This is any information that cannot reasonably identify you, so it cannot be personal, confidential or sensitive. Anonymisation requires the removal of personal information that might identify you. This process allows personal information to be converted into an unidentifiable format to support processing your personal information without compromising data protection requirements or posing privacy risks. This is always the first thing we consider when we need to use your personal information, opting to use your personal information only when absolutely necessary.

We may collect and use the following personal information about you:

• contact details
• identity
• medical history
• qualifications
• financial details
• learning needs analysis
• employment records
• criminal records

or any other information which may be confidential or sensitive, which you have:

• provided to the Trust
• through a third party,
• other health and social care professionals
• local authorities
• voluntary organisations
• relatives or those who care for you

Processing Personal Information

Barking, Havering and Redbridge Hospitals NHS Trust (BHRUT, the Trust) is responsible for:

• planning
• procuring
• commissioning
• implementing and providing NHS services for administrative, direct care, and research purposes
• meet a legal and regulatory requirement.
• keep you and other service users safe on our premesis. 

This may require the use of personal data of our data subjects (staff, patients, service users or any individual whom the Trust hold information on). This is why data protection legislation under the Data Protection Act 2018 and UK General Data Protection Regulation 2016 (GDPR) requires the Trust to process your personal information:

• Fairly and lawfully with transparency
• For explicitly specified and legitimate purpose
• Adequately, relevant and limited to the specified purpose
• Ensuring its accuracy and integrity
• No longer than is necessary
• Securely
• In ways that comply with the law
• With adequate safeguards in place when agreed to be transferred outside of the UK

The personal information we collect may be used for any of the following specific purposes:

• Health care for patients – diagnosis, treatment and referral
• Accounting, financial management and auditing
• Commissioning and procuring services
• Education and training
• Consultancy and Advisory services
• Human resources and staff administration
• Crime prevention and prosecution
• Health administration and services management
• Business activity information and databank administration
• Contractual arrangements for data processing by third parties on behalf of the Trust
• Occupational Health referrals
• Research, national surveys
• Advertising, marketing and public relations or insurance
• Security services e.g. CCTV monitoring, confidentiality audits

Without your personal information, we cannot:

• Direct, manage and deliver the health care you may require
• Ensure we have accurate and up to date information to assess and provide what you require
• Provide the appropriate level of assistance or adequate guidance
• Refer you to a specialist or another service
• Protect the general public or promote public health
• Manage, develop or improve our services
• Investigate complaints or proceed with legal actions for claims
• Employ you to join our workforce
• Procure products and services
• Commission business activities
• Comply with a court order
• Comply with regulatory requirements
• Meet some of our legal obligations
• Compile statistics to review our performance
• Educate and train our workforce
• Standardise best practice across the Trust
• Undertake clinical trials and research studies you have or your next of kin has consented to
• Complete occupational health checks you have consented to
• Keep you and other service users safe on our premises

Please note: Child and Safeguarding data is managed in the same way as our other data subjects. 

Lawful Basis for Processing your Personal Information

We do not rely on consent to use your personal information as a ‘lawful basis for processing’. We rely on the following specific provisions under Article 6 (Lawful Processing) and 9 (Processing of Special Categories of Personal Data) of the GDPR:

• Article 6 (1c) ‘processing is necessary for compliance with a legal obligation…’
• Article 6 (1e) ‘a task carried out in the public interest or in the exercise of official authority vested in the controller.’
• Article 9 (2b) ‘carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law’
• Article 9 (2h) ‘processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis,
• the provision of health or social care or treatment or the management of health or social care systems and services’
• Article 9 (2i) ‘processing is necessary for reasons of public interest in the area of public health. This could be protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices’

This means that the Trust will:

• Use your personal information to provide you with your care or for legitimate administrative purposes without seeking your consent. However, you do have the right to say no to our use of your personal information but this may have an impact on our ability to provide appropriate care or services. Please speak to your healthcare professional, the team providing your care or contact our Data Protection Officer.
• collect and use your personal information to provide care and run our hospitals but will not use it for anything else that is not considered by law to be for this purpose
• use enough of your personal information that will be relevant and necessary to carry out various tasks within the delivery of your care and running our services
• Keep your personal information accurate and up to date when using it and if it is found to be wrong, make it right, where appropriate, as soon as possible
• Keep your information in a way that will identify you for as long as legally required, whilst ensuring your rights
• Have secure processes in place to keep your personal information safe when it is being used, shared, and when it is being stored.

We will always secure your unambiguous, freely given, specifically expressed and fully informed consent to share your personal information, if we do not have a lawful basis to do so. In circumstances where it is not practical to inform you of the intended use, we are informing you through this notice.

We never use your personal information for advertising, marketing and public relations or insurance purposes without your consent.

You reserve the right to restrict, refuse or withdraw consent at any time, where there’s no lawful basis for processing your personal information without your consent. We will fully explain the possible consequences to you, which may affect the care or service you receive from the Trust.

Retention and Disposal of Personal Information

Your personal information may be written down (manual), digitised or held on computers (electronic) centrally within or outside of the Trust. These may be paper records, scans, photographs, slides, CCTV images, microform (i.e. fiche/film), audio, video, emails, computerised records on IT systems, or scanned documents etc. which we process securely in accordance with data protection legislation.

In addition, the following are bound by a legal duty of confidential in their professional code of practice and/or under contractual obligations.

• NHS staff
• anyone that works for or volunteers
• third party organisations (suppliers, service providers and data processors)

We follow national guidelines in the current national retention and disposal schedulefor the Records Management Code of Practice 2021. This is referenced in our Trust Health Records Management Policy and Corporate Records ManagementPolicy. This determines how long we must store your personal information for and when, or if to dispose of it securely.

Keeping your Personal Information Safe

We are committed to keeping your information secure and have operational policies, procedures and technical measures in place to protect your information whether it is in a hardcopy, digital or electronic format.

We are registered to the Information Commissioner’s Office: registration number Z8284051

All of the Information Systems used by our Trust are implemented with robust information security safeguards to protect the confidentiality, integrity and availability of your personal information. The security controls adopted by the Trust are influenced by a number of sources including the 10 National Data Guardian Standards and guidelines produced by NHSDigital and other government standards.

Mandatory training and regular audits are in place to ensure that only authorised personnel with the absolutely necessary need to know your personal information can use it. We have also implemented best practice and information security controls to reduce the risk of unauthorised access to your personal information. If any of your personal information is to be processed overseas (i.e. outside the UK) a full risk assessment would be undertaken to ensure the security of the information.

When there are data protection breaches, for example

• unauthorised access
• inappropriate use
• failure to secure and keep personal information secure or accurate

These are reported and investigated, with appropriate action (disciplinary, legal, lessons learned, re-training etc.) taken.

You can email our Data Protection Officer to find more information about how we keep your information safe or for copies of our Trust policies and procedures.

Sharing Personal Information

We may need to share your personal information with another organisations. For example:

• NHS organisations
• health and social care organisations
• public bodies (Social Services, Probation Service, Police, Regulatory Authorities)
• third party providers commissioned to process personal information on our behalf, when anonymisation or pseudonymisation is not viable.

This is because of our duty to share which is equally as important as our duty of confidentiality. We also may also share your personal information for planning services across the NHS. This is vital to delivering better healthcare and improving our services.

New models of service delivery are being implemented across the NHS. There is closer working with GPs and other health and social care providers, facilitated by the use of electronic patient record systems to share your personal information. As a university hospitals Trust, teaching may not be effective or possible without sharing your personal information.

You have the right say no and to opt-out of or restrict this sharing. Your right to opt-out for reasons other than direct care (e.g. planning and research purposes) is managed through the National Data Opt-Out Programme (search online or contact NHS Digital on 0300 303 5678 to find out more).

When we are required by law to report certain personal information to the appropriate authorities where formal permission has to be given. This is done by our:

1. Caldicott Guardian (Associate Medical Director)
2. Data Protection Officer (Head of Information Governance)
3. Senior Information Risk Owner (Chief Digital Transformation Officer)

Acting as the 'conscience' of the Trust, they actively supports work to enable information sharing where it is appropriate to share, and advise on options for lawful and ethical disclosure of personal information.

Your personal information will only be shared if there is a lawful basis to do so and under contractual agreements (for third parties), with strict conditions to keep it confidential and secure in the same way that the Trust must comply with its legal obligation to you. We have a legal process in place known as a Data Protection or Privacy Impact Assessment which is required when a new or change to an existing process, product, project, system or service is proposed, which will use or access your personal information. An information sharing agreement is also drawn up to ensure information is shared in a way that complies with relevant legislation, especially with non-NHS organisations.

However, your right to confidentiality is not absolute which means that we will not require your consent to share your personal information:

• If there is a concern that you are putting yourself at risk of serious harm
• If there is concern that you are putting another person at risk of serious harm
• If there is concern that you are putting a child at risk of harm
• If we have been instructed to do so by a Court
• If the information is essential for the investigation of a serious crime
• If you are subject to the Mental Health Act (1983), there are circumstances in which your ‘nearest relative’ must receive information even if you object
• If your information falls within a category that needs to be notified for public health or other legal reasons, such as certain infectious diseases

Your Information Rights

You have the right to:

• Be informed about the processing of your personal information by the Trust (done through this notice)
• Access the information we hold about you (paper, digital or electronic copies)
• Ask the Trust to correct or complete your personal information
• Ask the Trust to erase your personal information under certain circumstances, if the Trust does not have a lawful basis to process it.
• Ask the Trust to restrict the processing of your personal information under certain circumstances
• Ask the Trust to move, copy and transfer your personal information which you have provided to the Trust, , in a portable, common used/machine readable format and securely, for your own purpose
• Ask us not to process your personal information
• Ask us not to use your personal information for public interests, direct marketing, automated decision-making, profiling, research or statistical purposes
• Receive a response to your access or change request within a calendar month*

*The Trust may extend the time limit to respond to your request by two calendar months if your request is complex or where a number of requests have been received from you. However, the Trust will acknowledge your request within one calendar month of receiving it and explain if/why an extension is required.

Your rights are not absolute; we may refuse to comply with your request under certain circumstances permitted by law.

For example, where your personal information:

• Was provided by someone else who hasn’t given permission for you to see it
• Relates to criminal offences
• Is being used to detect or prevent crime
• Could cause physical or mental harm to you or someone else

Your request must be made in writing and we will require proof of identity before we can disclose any personal information. You can find out more about accessing your personal information by contacting our Subject Access Requests Team or writing to us:

Subject Access Team
Health Records Department
1st Floor Blue Zone,
Queen’s Hospital
Romford
RM7 0AG

Telephone: 01708 435 000

Report a complaint or concern

We try to meet the highest standards when processing personal information. You should let us know when we get something wrong by contacting the Complaints Department or our Data Protection Officer or writing to us:

Complaints Department
1st Floor Neutral Zone,
Queen’s Hospital
Romford
RM7 0AG

Telephone: 01708 435 000

Information Governance Department
Queens Hospital Stores
4 Lyon Road
Romford
RM1 2BA

Telephone: 01708 435 000

You may prefer to contact the Information

Commissioner’s Office (ICO):
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: www.ico.gov.uk

Telephone: 0303123 1113

The ICO will not normally consider an appeal until you have exhausted your rights of redress and complaint to the Trust.