Barts Health NHS Trust is committed to protecting your privacy when you use our services. This privacy notice explains how we use information about you and how we protect your privacy.
We have a data protection officer who makes sure we respect your rights and follow the law. If you have any concerns or questions about how we look after your personal information, please contact the data protection officer or by calling 020 7480 4892. Alternatively, you could write to:
Data Protection Officer
Barts Health NHS Trust
9 Prescot Street
Barts Health NHS Trust is required to comply with the laws and regulations that apply to protecting your data and how it is used. They are the General Data Protection Regulation 2016 (GDPR) and the Data Protection Act 2018.
Barts Health NHS Trust is committed to protecting your privacy when you use our services. This privacy notice explains how we collect and use personal information about you and how we protect your privacy. It will tell you:
Personal information can be:
Depending on your circumstances and the nature of the health care you require, we may collect the following information about you:
The information we collect about you may be written down in a paper file (manual record), or held on a computer system (electronic record). We may also record CCTV images in public areas as part of the Trust’s security arrangements and for crime prevention.
You have the right to receive a copy of your medical records via a Subject Access Request.
A lot of the personal information provided to us comes directly from our patients. In certain circumstances, we may also receive personal data from:
To provide your care
The doctors and other health professionals caring for you need to keep records about your health and the treatments you have received from the NHS and other healthcare providers, in order to be able to provide you with the most effective care. It is in your interests as a patient for a full and complete record to be collected, so that we have accurate, up to date information about you.
To carry out medical research
We may also process your data to carry out scientific or historical research. The Health Research Authority sets standards for NHS organisations to make sure they protect your privacy and comply with the law when they do research work. When Barts Health uses your data for research purposes we will ensure that appropriate safeguards are in place, such as using the minimum amount of data needed or making sure you cannot be identified by the data.
Sometimes a member of your care team may review your health records to see if you might be a good candidate for any research we have planned. However, except in very specific circumstances, we are required to inform you first and get your explicit consent before we are allowed to use any of your information for research. We will not use data from private or non-NHS patients for research purposes.
If you do not want your personal information to be used for planning and research, you may express your preference under the National Data Opt-Out Programme. You can use this service to request that your confidential patient information is not used for anything other than your own individual care.
To help run our hospitals and improve our service
We may also need to use some information about you to:
After you attend one of our hospitals you may receive a text message asking you to rate how happy you were with your visit. This is a national service called the Friends and Family Test, and it gives NHS users an opportunity to give feedback on their experience. When you receive a Friends and Family Test message by text, you will have the option to opt out of any future messages from this service if you wish to do so.
How do we protect your information?
Everyone working for the NHS has a legal duty to maintain the highest levels of confidentiality, and all Barts Health staff receive training in how to handle your information securely. Except in certain specific circumstances, your records will generally only be seen by those involved in providing or administering your care.
Your paper healthcare records are stored in physically secure areas and electronic records held on computer systems are protected by appropriate technology (such as data encryption and access controls).
If you decide to send or receive personal information by email, please be aware that Barts Health cannot be responsible for the security of the information during its transfer to or from our email system, or for any loss or compromise of the information due to technical or security issues occurring outside our computer networks.
How long will we keep your information?
There is often a legal reason for keeping your personal information for a set period of time. Our policy for keeping information is based on Appendix 3 of the NHS Records management Code of Practice for Health and Social Care 2016. Please see this document to find out how long we will keep different kinds of information about our patients.
Why are we allowed to process your information?
Under the General Data Protection Regulation (GDPR) most of the Trust’s processing of personal information is carried out under the lawful basis of ‘Public Task’, because the processing is necessary for the performance of a task carried out in the public interest (GDPR Article 6(1)(e)). This allows us to process your information because it is necessary for public health purposes and for the purposes of preventative or occupational medicine.
We will also process more sensitive information (such as your medical history) because it is necessary for the purposes of preventative or occupational medicine, medical diagnosis, and the provision of healthcare (GDPR Article 9(2)(h)) or for scientific research and statistical purposes (GDPR Article 9(2)(j)).
Can you object to our processing of your personal information?
In addition to your other rights as a data subject (see below), you have the right to object to the processing of your personal information, although you must give specific reasons for your objection based upon your particular concerns. This is not an absolute right and depending on the circumstances we may decide that there are compelling and legitimate grounds for us to continue to process your information. If we do decide to continue processing your information we will let you know and explain the reasons for our decision to you. You would also have the right to challenge our decision, for example, with the Information Commissioner’s Office (ICO).
If you wish to object to the processing of your personal information by Barts Health then please get in touch with the Trust’s Data Protection Officer (their contact details are given at the end of this notice).
What are your rights as a data subject?
Under the General Data Protection Regulation you have a number of rights as a data subject. These are:
The right to be informed
We are required to inform you about how we collect and use your personal information (for example, by the information given in this Privacy Notice).
The right to access
By law you are entitled to request a copy of the information we hold about you. This is known as a Subject Access Request. We will aim to provide the requested information to you within 30 days, but if we are unable to do so then we will explain the reasons to you. In most cases we will provide a copy of the information to you for free but there are some circumstances where we will need to charge.
At times we may not be able to share your whole record with you, particularly if the record contains confidential information about other people, information which could cause harm to your or someone else’s physical or mental wellbeing, or which might affect a police investigation.
More information about making a request can be found on our health records page.
The right to rectification
You may request that we make changes to any data we hold about you that is incorrect or incomplete. We will take action to rectify inaccuracies in the personal information we hold about you when it is drawn to our attention. Sometimes it may be necessary to add an explanatory note to your information (an addendum) rather than change the original record. We would do this to ensure that we have all necessary information available to provide your care (your complete medical history, for example).
The right to erasure
In most cases you are not able to request that we erase the medical information that we hold about you for your direct care and public health purposes, under our lawful basis for processing your data as set out in the GDPR.
The right to restrict processing
You may request that we restrict the processing of your information in certain circumstances, for example if you believe it to be inaccurate. In most cases a restriction of processing is a temporary measure while we investigate your concerns. The right to restrict processing is not an absolute right, and we may decide not to restrict the processing of your information if we consider that processing to be necessary for the purpose of the public interest or for the purpose of your legitimate interests.
The right to data portability
The Trust’s basis for processing your data under the GDPR means that we are not legally required to provide your information in a machine-readable form, although we will try to provide information that you have asked us for (such as under a Subject Access Request) in the format you prefer if it is practical for us to do so.
Rights related to automated decision making (including profiling)
Barts Health does not make automated decisions about patients or carry out evaluations based on any automated processes (profiling).
Do we pass your information on to other people or organisations?
When we are required to do so, we will ensure that we seek your consent before sharing your personal information with other people. We will not pass your personal information to your friends, relatives or carers without your explicit consent. If you are unable to consent for any reason, we will only share information where it is clearly in your best interests to do so or it is required by law.
The Trust sometimes needs to share the personal information we process with other organisations. When we do this we are required to comply with all aspects of the General Data Protection Regulation. Where necessary we also have data sharing agreements in place with our partner organisations which will state the specific ways in which the shared data can be used.
The organisations we share information with can include:
The reasons why we would share your information can include:
The Trust may sometimes use service providers who process information in other countries, both within and outside the European Economic Area (EEA). Because of this it may sometimes be necessary for personal data to be transferred overseas. However, before any transfer is made Barts Health will make sure that appropriate safeguards are in place so that the transfer of the data, its processing, storage and retention are securely controlled and in full compliance with the requirements of the GDPR.
Data Protection Impact Assessments
Under GDPR regulations we are required to carry out a Data Protection Impact Assessment (DPIA) when undertaking new projects which involve the processing of personal data. Completing a DPIA helps us to identify any data risks at an early stage and to take steps to minimise these risks as part of the project development process.
Data Protection Impact Assessments were completed for the following projects during 2018/19:
Please contact the Data Protection Officer should you require any further information regarding these DPIAs.
The Trust has a Data Protection Officer who makes sure we respect your rights and follow the law. If you have any concerns or questions about how we look after your personal information, please contact the Data Protection Officer, Derek Peacock, at firstname.lastname@example.org or by calling 020 7480 4892 and asking to speak to the Data Protection Officer. If you prefer you can write to:
Data Protection Officer
Barts Health NHS Trust
3rd Floor, 9 Prescot Street
London E1 8PR
For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:
Information Commissioner’s Office
Wycliffe House, Water Lane
Cheshire SK9 5AF
Telephone: 0303 123 1113 (local rate) or 01625 545 745 (if you prefer to use a national rate number)
By using this website you are implying consent for these cookies to be placed on your computer. If you would like to remove these cookies and opt-out of the services that use them you can by selecting the appropriate settings on your browser.
What is a cookie?
A cookie is a simple text file that is stored on your computer or mobile device by a website’s server and only that server will be able to retrieve or read the contents of that cookie. Each cookie is unique to your web browser. It will contain some anonymous information such as a unique identifier and the site name and some digits and numbers. It allows a website to remember things such as your preferences or remembers your details when filing out a form. They are controlled by your computer. If you visit the Tools section in your browser menu, you will find details of your cookies settings.
Cookies may come with or without an expiry date. Cookies without an expiry date exist until the browser is closed, while cookies with an expiry date may be stored by the device until the expiry date passes.
You can set your browser to warn you before accepting cookies, or you can set it to automatically reject them. Please note that by rejecting cookies it may inconvenience you in browsing our website. See your browser 'help' button for how to change your cookie settings.
By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.
Links to other websites