GDPR and Privacy

Your personal data and privacy

What information do we collect and how do we use it?

Information may be obtained directly from you, from individuals acting on your behalf, and from organisations involved in your care including NHS organisations, GP practices, hospitals, local authorities and social care providers where appropriate and lawful to do so

We aim to provide you with the highest quality of health care. To do this we must keep records about you, your health and the care we have provided or plan to provide to you. Some information is necessary to allow us to provide safe and effective care and to meet our legal obligations. If you choose not to provide certain information, we may be unable to provide some services, treatments or advice, or may be limited in our ability to deliver safe and effective care.

These records may include:

  • Basic details about you, such as address, date of birth, next of kin
  • Contact we have had with you such as appointments and home visits
  • Notes and reports about your health
  • Details and records about your treatment and care
  • Relevant information from people who care for you and know you well, such as health professionals and relatives

We follow NHS good practice and will:

  • Discuss and agree with you what we are going to record about you
  • Give you a copy of letters we are writing about you
  • Show you what we have recorded about you, if you ask

How do we use your information?

We use your records to:

  • Provide a good basis for any treatment or advisory services we provide to you
  • Allow you to work with us when we provide treatment or advice
  • Make sure your treatment is safe and effective, and the advice we provide is appropriate and relevant to you
  • Work effectively with others providing you with treatment or advice

How do we keep your records confidential?

We have a duty to

  • Maintain full and accurate records of the care we provide to you
  • Keep records about you confidential, secure and accurate
  • Provide information in a format that is accessible to you (e.g. in large type if you are partially sighted).

We will not share information that identifies you for any reason, unless:

  • You ask us to do so
  • We ask and you give us specific permission
  • We have to do this by law
  • We have special permission because we believe that the reasons for sharing are so important that they override our obligation of confidentiality (e.g. to prevent someone from being seriously harmed)

Our guiding principle is that we are holding your records in strict confidence.

Who we may share information with?

We may share information about you with the following main partner organisations:

  • NHS commissioners of care – in particular the organisation that referred you to us for treatment, assistance or advice
  • Other providers involved in your care – such as a hospital or your GP

We use the Yorkshire and Humber Care Record to access some of your information, there is a leaflet at the bottom of this section explaining what it is and how you can opt out of its use.

We may also share your information with your consent and, subject to strict sharing protocols about how it will be used with:

  • Social Services (FOCUS)
  • Education Services
  • Local Authorities (North East Lincolnshire Council)
  • Voluntary Sector Providers
  • Private Sector

We may also share your information with your consent with others that need to use records about you to:

  • Check the quality of treatment or advice we have given you
  • Protect the health of the general public
  • Manage the health service
  • Help investigate any concerns or complaints you or your family have about your health care

Some information we have to share is used for statistical purposes, and in these instances we take strict measures to ensure that individual service users cannot be identified.

Sharing information during major incidents and emergencies

Care Plus Group will follow this NHS England guidance for sharing information during major incidents and emergencies

https://transform.england.nhs.uk/information-governance/guidance/sharing-information-during-major-incidents-and-emergencies/

Open Door and Quayside GP Practices are supporting vital health and care planning and research by sharing your data with NHS Digital. For more information about this see the GP Practice Privacy Notice for General Practice Data for Planning and Research

National Data Opt Out

Information may only be used for purposes beyond your care when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified, in which case your confidential information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters

You can find out more about how patient information is used for research at: https://www.hra.nhs.uk/ (which covers health and care research); and

https://understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made).

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Our organisation is able to apply your national data opt-out choice to any confidential patient information we may use or share with other organisations for purposes beyond your individual care.

Anyone who receives information from us also has a legal duty to keep it confidential.

If you do not wish personal data that we hold about you to be used or shared in the way that is described in this leaflet, please discuss the matter with us, contact details shown below. You have the right to object, but this may affect our ability to provide you with care or advice.

Closed-circuit television (CCTV)

We have CCTV systems on our sites for the purposes of public and staff safety, crime prevention and detection. Images captured by CCTV will not be kept for longer than necessary. However, on occasions there may be a need to keep images for longer, for example where a crime is being investigated. We operate CCTV and disclose in accordance with the codes of practice issued by the Information Commissioner.

CCTV images or other data held may be used in some circumstances where incidents require investigation by the data controller. This information is processed under article 6(1)(f) of the UK GDPR, as processing may be necessary for the purposes of legitimate interests pursued by the data controller or a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child; or article 6(1)(e) public task (UK GDPR), processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, dependent upon the specific processing which is necessary.

Your Rights

You have the right to confidentiality under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Human Rights Act 1998 and the common law duty of confidentiality (the Equality Act 2010 may also apply).

Transparency

You have the right to know what information we hold about you, what we use it for and if the information is to be shared, who it will be shared with.

Right to be Informed

You have the right to be informed about how your personal information is collected, used, stored and shared. This privacy notice explains how Care Plus Group processes your information and the rights available to you.

Right of Access

You have the right to request a copy of the personal information we hold about you, commonly known as a Subject Access Request (SAR).

You may:

  • Obtain a copy of your information;
  • Receive information in an accessible and understandable format;
  • Request an explanation of information contained within your records where required.

Right to Rectification

  • You have the right to request that inaccurate or incomplete personal information is corrected.
  • Where information is considered accurate, but you disagree with it, we may add a statement to the record explaining your view.

Right to Erasure (“Right to be forgotten”)

In certain circumstances, you may request the deletion of personal information. However, health and social care organisations are generally required by law to retain health records and therefore this right will not usually apply to clinical records.

Right to Restrict Processing

In certain circumstances, you have the right to request that we temporarily restrict the processing of your personal information, for example where you contest its accuracy or object to its use

Right to Object

You have the right to object to some or all the information being processed under UK GDPR Article 21.

Please contact the Data Controller (contact information shown below). You should be aware that this is a right to raise an objection, but this is not the same as having an absolute right to have your wishes granted in every circumstance.

Right to Data Portability

Your information will be provided to you in a structured format that will make it easy to transfer to another data controller (such as another healthcare provider).

Right in Relation to Automated Decision-Making

Care Plus Group does not make decisions which produce legal or similarly significant effects solely through automated processing. Where technology supports decision-making, appropriately trained staff remain responsible for reviewing and approving outcomes.

If this position changes, we will provide you with information about the processing involved, its consequences, and the rights available to you under UK GDPR.

Right to Withdraw Consent

Where Care Plus Group relies on your consent to process personal information, you have the right to withdraw that consent at any time. This will not affect any processing already carried out before consent was withdrawn.

Right to Complain

If you have any concerns about how we use your personal information, you can make a complaint to us using the contact details below.

We will acknowledge and investigate complaints in accordance with Care Plus Group’s complaints procedure.

You can contact us at:

EmailCPG.CareplusAssure@nhs.net
Post: Care Plus Group Quality, Regulation and Improvement Team
Westgate Park
Charlton Street
Grimsby
N E Lincolnshire
DN31 1SQ

Telephone: 01472 266999

If you remain dissatisfied after raising your complaint with us, you also have the right to complain to the Information Commissioner’s Office (ICO): https://ico.org.uk/make-a-complaint/

Obtaining a copy of your record

Please contact the Data Controller (contact information shown below), to request guidance on how to obtain a copy of your record. Also note that:

Your request will need to include sufficient information to enable us to correctly identify your records (e.g. full name, address, date of birth, NHS number (if known))

Subject access requests are normally provided free of charge. A fee may only be charged where permitted by law, for example where requests are manifestly unfounded, excessive or repetitive.

We will respond to you within one month of receiving your request

You will be required to provide a form of ID before any information is released to you

You can download and complete this form here to request access to your records.

Legal Information

We are required by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. to provide you with the following information relating to the processing of your personal information:

Data Controller

Care Plus Group,
Company number – IP031272
c/o Business Unit
Westgate Park
Charlton St
Grimsby DN31 1SQ

Email us at cpg.businessunit@nhs.net
or telephone 01472 266974

You can contact the Data Protection Officer using the details below:

Data Protection Officer

c/o Business Unit
Westgate Park
Charlton St
Grimsby DN31 1SQ

Email us at cpg.businessunit@nhs.net
or telephone 01472 266974

International Transfers

We do not routinely transfer personal information outside the United Kingdom. Where personal information is processed by suppliers or systems that involve access from outside the UK, Care Plus Group ensures that appropriate safeguards are in place to protect your information and comply with UK GDPR requirements.

Lawful basis for processing

The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this organisation and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the UK GDPR:

Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.

Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”

Use of Artificial Intelligence (AI) Scribing Tools (Heidi Health)

Care Plus Group may use an Artificial Intelligence (AI) scribing tool called Heidi Health (“Heidi”) to support clinicians with documenting consultations and clinical interactions. Read More

Use of Patient Communication Systems (Postworks)

Care Plus Group uses a system called Postworks to support the secure sending and management of patient communications, such as appointment letters, clinical correspondence, and other information related to your care. Read More.

Retention Period

The data will be retained in line with the law and national guidance.

Click here for NHS Code of Practice.

Supplementary Documents

  • Click here for a copy of How, When and Why we use your Health and Social Care Records
  • Click here for a copy of our UK GDPR and Privacy leaflet.
  • Click here for a copy of our Easy Read Privacy Notice.
  • Click here for a copy of the Yorkshire and Humber Care Record leaflet.
  • Click here for a copy of the Federal Data Platform (OPTICA Acute) Privacy Notice

Our Latest News