Who we are
Privacy notice
How we use your information
Find out how Gloucestershire Health and Care NHS Foundation Trust uses your information.
The information we collect about you
Information which this Trust may hold about you may include the following:
- details about you; such as your name, address, email address, phone numbers and next of kin
- any contact the Trust has had with you; such as appointments, clinic visits, emergency appointments, etc.
- notes and reports about your health, treatment and care
- results of investigations such as laboratory tests and x-rays.
- relevant information from other health professionals, relatives or those who care for you
- video images, for example on CCTV, or recordings of consultations where you have consented to these recordings.
Other information we may hold about you
As well as information that you provide to us directly, we also use information from other sources to help us provide you with safe and effective health and social care. This may include, for example
- information from another NHS Trust, GP Connect, or your GP surgery about health care that you have received previously
- information from other partner organisations such as social care services, housing associations, and voluntary and community organisations.
- pseudonymised – about individuals, but with identifying details (such as name and/or NHS number) replaced with a unique code
- anonymised – about individuals, but with person identifiable details removed
- aggregated – anonymised information grouped together so that it doesn’t identify individuals.
How we use the anonymised, pseudonymised and aggregated information we hold
Why we collect your information
Our health care professionals and multi-disciplinary teams collect and use your information to enable us to provide you with the best possible health and social care.
Your information may also be collected for other purposes that you should be aware of, such as CCTV recordings used for crime prevention, or if you make a complaint/enquiry or complete a survey. We will also use your information to enable us to identify you through video conferencing facilities when they are used e.g. Attend Anywhere.
We will also use your information to contact you about your care or to see if you would like to be involved in medical research trials that might be relevant to you.
Our staff may check your details with you to ensure they are up-to-date and correct. This is important to avoid errors in your care or treatment. So, if your details have changed (such as your name, address, email address or phone number) you need to let us know.
More information on understanding patient data can be found here. .
Our legal basis for using your information
As an NHS organisation we also handle information about your mental and physical health. This is known as ‘special category data’.
We handle this type of information:
- to protect your vital interests
- for medical diagnosis, to provide health and social care and treatment to you, and to manage our health and social care systems and services
- for reasons of public interest, including protecting against serious threats to public health, and ensuring high standards of quality and safety of patient care and of medicinal products or medical devices.
Where your information is stored
Almost all electronic records are stored in the UK. However, for a very small minority of services some information is stored abroad. For example, functional family therapy information is stored electronically in the USA.
Before we send any information abroad, we make sure that it will have the same level of legal protection, security and confidentiality in the country where it will be stored as it would if it were stored here in the UK.
Who we might share your information with
Information that we collect about your healthcare will normally be made available to your GP. We may also share your information with other organisations or professionals involved in your care so that you receive good quality, joined-up care and support, and don’t need to be assessed again. These organisations include partner organisations such as social care services, educational bodies, housing associations, voluntary and community organisations. Your information will also be shared with the Trust’s Overseas Visitors Manager, in order to meet a legal obligation. Demographic information will be shared with the Home Office, Department of Health, and the Department for Work and Pensions.
Staff should discuss with you what information they are sharing, why and with whom. We will ask for your consent before sharing details about your care with your family or carers. If we ask for your consent to share your information, you can withdraw that consent at any time simply by telling your care coordinator.
We may also share information with other organisations for planning and costing purposes. When information is shared for these purposes it will be anonymised, and will not identify any individual service user.
There are exceptional circumstances whereby the Trust may share information about you without your knowledge, for example, in an emergency where you or someone else might suffer substantial harm or distress, where it relates to a ‘communicable disease’, a serious crime, or if information is required by law (such as a court order).
How long we keep your information
You can find further information on the rules that the Trust must follow here (click to download a document called ‘Records Management Code of Practice for Health and Social Care 2016’ provided by the Information Governance Alliance).
How the Trust ensures information is used appropriately
Covid-19 Privacy Notice
Last updated: 01/01/2024
This notice describes how we may use your information to protect you and others during the COVID-19 outbreak. It supplements our main Privacy Notice.
The health and social care system is facing significant pressures due to the COVID-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations.
Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak. Using this law the Secretary of State has required NHS Digital; NHS England and Improvement; Arms Length Bodies (such as Public Health England); local authorities; health organisations and GPs to share confidential patient information to respond to the COVID-19 outbreak. Any information used or shared during the COVID-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data. Further information is available on gov.uk here and some FAQs on this law are available here.
During this period of emergency, opt-outs will not generally apply to the data used to support the COVID-19 outbreak, due to the public interest in sharing information. This includes National Data Opt-outs. However in relation to the Summary Care Record, existing choices will be respected. Where data is used and shared under these laws your right to have personal data erased will also not apply. It may also take us longer to respond to Subject Access requests, Freedom of Information requests and new opt-out requests whilst we focus our efforts on responding to the outbreak.
In order to look after your health and care needs we may share your confidential patient information including health and care records with clinical and non clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111. We may also use the details we have to send public health messages to you, either by phone, text or email.
During this period of emergency we may offer you a consultation via telephone or videoconferencing. By accepting the invitation and entering the consultation you are consenting to this. Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation.
We will also be required to share personal/confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak. Further information about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the COVID-19 response is here.
NHS England and Improvement and NHSX have developed a single, secure store to gather data from across the health and care system to inform the COVID-19 response. This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital. New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patients themselves. All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.
In such circumstances where you tell us you’re experiencing COVID-19 symptoms we may need to collect specific health data about you. Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards.
NHS Digital has agreed to share with GHC :
- NHS Number
- Date of Birth
- CCG Name and ODS Code
for patients on the Shielded Patient List who are resident in our geographical area for the purpose of supporting GHC to identify and ensure that those patients recently under their care who were advised to shield are receiving optimal care during the COVID-19 pandemic.
We may amend this privacy notice at any time so please review it frequently. The date at the top of this page will be amended each time this notice is updated.
If you would like more information about how the NHS uses patient data, click here.
How you can be sure we handle your information correctly
It is a legal requirement to ensure that all information about you is kept confidential. The Trust has to complete a data security and protection declaration for NHS Digital every year, and the Trust board also has to make a declaration to its regulator, NHS Improvement, that the Trust complies with the national data security standards.
The Trust has policies and procedures to make sure that staff know how to handle your information properly, and keep it confidential.
Our staff only look at your information when it is absolutely necessary.
Staff have to complete data security training once a year to make sure that they understand what is required of them. Staff also have regular training so that they understand how to use computerised record systems
The Trust audits patient health records to check how staff access patient information on our computer system.
Your rights
The Data Protection Act gives you certain rights in respect of the information we hold about you.
Select a topic below for further information about each of your rights.
The Trust may refuse your request (in full or in part) where there is a legal basis to do so, and you will be notified of this.
You have the right to set up a national opt-out so that your data is not used for research or planning purposes. You can find out more, and set your opt-out preferences, by visiting www.nhs.uk/your-nhs-data-matters. If you do set up a national opt-out, your data will still be used to provide you with individual care.
Gloucestershire Health and Care NHS Foundation Trust is committed to data subject rights under the Data Protection Act 2018.
However, the NHS is facing unprecedented challenges relating to the coronavirus (COVID-19) pandemic at the current time. Understandably, our resources have been diverted to support our front-line colleagues who are working tremendously hard to provide care for our patients, and to those in need of our services.
We strive to be transparent, fair and to work with an open culture. At this time, whilst care of our patients and the safety of our staff takes precedent, it is likely that responses to some requests will be delayed. We apologise for this position in advance, we will endeavour to provide you with a response to your request, as soon as we are able.
The Information Commissioners Office has recognised the current situation in the NHS; please visit the ICO website here to see their advice.
How you can request a copy of information that we hold about you
You are entitled to a copy of information that we hold about you. Normally this is available to you free of charge, but we may charge a reasonable fee to cover administrative costs such as copying, or if you request another copy of the same information.
We must provide you with the requested information (where it is appropriate to do so) within 1 month once we have sufficient details to be able to process the request. However, we may extend this period for a further 2 months if the request is particularly complex. We may also refuse to respond to requests which are bulky, complex or repetitive.
If you want to see a copy of your health record, you will need to fill in a form so that we have the details we need to find your information. You can ask for a form either by emailing subjectaccess@ghc.nhs.uk
Or by post to:
Information Governance and Records Team
Gloucestershire Health and Care NHS Foundation Trust
Edward Jenner Court
1010 Pioneer Avenue
Brockworth
Gloucester
GL3 4AW
If you don’t want to see your health record, but you would like a copy of any other information we hold about you, you should contact the Data Protection Officer at InfoGov@ghc.nhs.uk.
Asking to have your personal data corrected
You are entitled to have personal data corrected if it is inaccurate or incomplete.
We must respond to your request within 1 month. However, we may extend this period by up to a further 2 months for complex requests.
We may refuse the request if we believe the information is accurate/complete or there is a legal basis to do so. If that is the case, you will be notified of this. You have the right to complain to the Information Commissioner’s Office and to seek correction by order of a Court.
If you believe your information is inaccurate or incomplete, you should contact the Health Records Department to ask for it to be corrected.
You will need to fill in a form so that we have the details we need to find your information. You can ask for a form either by emailing subjectaccess@ghc.nhs.uk
Or by post to:
Information Governance and Records Team
Gloucestershire Health and Care NHS Foundation Trust
Edward Jenner Court
1010 Pioneer Avenue
Brockworth
Gloucester
GL3 4AW
Blocking the use of your personal data
You can ask us to block the use of your personal data in some circumstances:
- Where you think your personal data is incorrect
- Where you have objected to us using your personal data
- When our use of your personal data is unlawful but you don’t want us to erase your data completely
- If we no longer need the personal data but you need us to keep it in connection with a legal claim.
Where use of your information is blocked temporarily (for example, while we check whether it is accurate) we will inform you when that block is lifted.
If you want to block the use of your information, you should contact the Health Records Department.
You will need to fill in a form so that we have the details we need to find your information. You can ask for a form either by emailing SubjectAccess@ghc.nhs.uk.
Or by post to:
Information Governance and Records Team
Gloucestershire Health and Care NHS Foundation Trust
Edward Jenner Court
1010 Pioneer Avenue
Brockworth
Gloucester
GL3 4AW
Asking to have your personal data erased
This is more commonly known as the ‘right to be forgotten’. You may ask to have your data erased where:
- It no longer needs to be kept by us (when it has gone beyond the minimum retention period)
- You withdraw your consent or object to the use of your data and there is no requirement for us to retain the data
- It has been used unlawfully
- There is a legal obligation that we must comply with
- You are under 16 and data has been stored electronically by us at your request
We may refuse your request (in full or part) where there is a legal basis to do so. If that is the case, you will be notified of this.
You will need to fill in a form so that we have the details we need to find your information. You can ask for a form either by emailing SubjectAccess@ghc.nhs.uk
Or by post to:
Information Governance and Records Team
Gloucestershire Health and Care NHS Foundation Trust
Edward Jenner Court
1010 Pioneer Avenue
Brockworth
Gloucester
GL3 4AW
Objecting to us using your personal data
You have the right to object to us using/sharing your information, however, there is no automatic right to prevent us using/sharing your information.
Objections will be considered and you will be notified of our decision and the reason for it.
Where we have asked for your consent to collect and use your information, you have the right to withdraw that consent at any time.
You will need to fill in a form so that we have the details we need to find your information. You can ask for a form either by emailing SubjectAccess@ghc.nhs.uk
Or by post to:
Information Governance and Records Team
Gloucestershire Health and Care NHS Foundation Trust
Edward Jenner Court
1010 Pioneer Avenue
Brockworth
Gloucester
GL3 4AW
Cookies
We are committed to protecting your privacy and developing technology that gives you the most powerful and safe online experience. Our log files do not contain any personal information (other than that freely given by you) or information about other sites you have visited.
Any personal details provided by you to the Gloucestershire Health and Care NHS Foundation Trust website must be true, correct and complete. Personal information attached to our website will not be passed on to third parties without the person’s prior consent.
We use Google Analytics software to collect information to help make sure the website is meeting the needs of its users and to help us make improvements.
Google Analytics stores information about
- The pages you visit on ghc.nhs.uk
- How long you spend on each page on our website
- How you got to the site
- What you click on while you’re visiting the site
We don’t collect or store your personal information and we don’t allow Google to use or share our analytics data.
For information on Google analytics cookies please follow this link.
Other websites linked from this site do not necessarily follow the same policies.
Further information on your rights under the Data Protection Act 1998 can be found on the Information Commissioner’s website.
What are Cookies?
A cookie is a small amount of data that is sent to your computer or mobile device from a particular website. This enables the website to recognise your specific computer or mobile device if you should return to the same site.
Cookies are used to improve services for you through, for example:
- enabling a service to recognise your device so you don’t have to give the same information during one task
- recognising that you have already given a username and password so you don’t need to enter it for every web page requested
- measuring how many people are using services, so they can be made easier to use and that there is enough capacity to ensure they are fast
A cookie often includes a unique identifier, which is a randomly generated number. This is stored on your device’s hard drive. Many cookies are automatically deleted after you finish using a website. Cookies are not programs and do not collect information from your device.
What are log files?
Every time the website is accessed an entry is made in the web server’s log file. This tells us broadly where an access is coming from, when it was made, which file was requested and whether the request was successful or not. It usually does not allow us to identify individual users. The data is used to assess usage levels and spot technical problems (such as broken pages or web server errors).
For further information visit www.allaboutcookies.org
You can set your browser not to accept cookies and the above websites tell you how to remove cookies from your browser. However in a few cases some of our website features may not function as a result.
What to do if you have concerns about the use of your information
You can contact the Trust’s Data Protection Officer, Paul Griffith-Williams, at Infogov@ghc.nhs.uk
If we can’t resolve your concern, you have the right to lodge a complaint with the Information Commissioner’s Office, whose contact details can be found here
