Who we are and what we do
We are contracted by the NHS to provide local care services. Our services are currently formed of unscheduled primary care, urgent care services, NHS 111 services, pharmacy, GP led Surgeries, health centres and walk in centres, ED support, roving GP service, community nursing, health and justice services and integrated technology solutions.
GDPR and DPA 2018
Our legal bases for processing personal data under the General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018) are:
Please note the NHS 111 online service are providing self-isolate notes.
NHS Digital has more in depth information on how all health care services are sharing and using data at this time to ensure a combined and thorough response to the coronavirus. See their website for more information: https://digital.nhs.uk/coronavirus/coronavirus-covid-19-response-information-governance-hub
Data we collect and have shared with us
The data that we collect and that is shared with us is needed to enable us to provide you with direct care.
This includes data not only from the call you are placing at the time with our services, but also data you have previously provided, data we retrieve from the NHS Spine and Summary Care Record and data shared with us from your other health providers to ensure you receive a fast and effective integrated service.
We do not hold your full health and care (medical) records as your GP would, but do hold the following:
How and why we use your data
Data Protection law allows us to use your data for specific purposes where we have a legal basis to do so. We have set out the reasons and lawful basis below:
Our main reasons
Providing healthcare in the public interest on behalf of the NHS
As a healthcare provider we are performing a task carried out in the public interest on behalf of the NHS. We are subject to statutory duty to collect (process) and to share information about our patients for their direct care.
As most of the information by its very nature of being health related is sensitive personal (special category) data we only use this for medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems.
This includes local administrative tasks which support this purpose such as:
It also covers instances where we participate in activities with a statutory basis such as responding to a public health emergency. For example we encounter infectious diseases which may endanger the safety of others, such as meningitis or measles (but not HIV/AIDS).
Safeguarding children and vulnerable adults under a task carried out in the public interest
Personal and health data is collected and shared with appropriate local authorities, other NHS bodies and if necessary the police. This is done to ensure patients receive the right services at the right time.
We will always be open and honest with patients and their family (where appropriate) from the outset about why, what, how and with whom information will, or could be shared, and seek their agreement, unless it is unsafe or inappropriate to do so.
We hare data where it is necessary for IC24 to comply with a legal obligation by assisting Commissioners.
NHS 111
The NHS 111 service is staffed 24 hours a day, 7 days a week by a team of fully trained advisers. They will ask questions to assess your symptoms and, depending on the situation, will then:
Phone numbers given will be used for IC24's automated comfort calling process; it ensures all patients are contacted if there are delays within the services. It will be in the form of a text or call with a message being read.
You can stop text messages at any time, by replying 'STOP' to the message that was sent. Please note this will stop all messages being sent from IC24 until you request for them to start again. You can do this by emailing IT.servicedesk@ic24.nhs.uk with 'Cancel STOP' and your mobile telephone number in the subject line. Example; 'Cancel STOP 07123456789'.
Calls to 111 and our offices are recorded and most calls made from us to you across our services are recorded.
Sometimes, calls may not be record if;
We record on screen pathways assessments during calls for the primary purpose of improving clinical safety, improving patient experience, for the reporting and management of software issues.
All calls and the records created are maintained securely and will only be shared with others directly involved with your care and IC24’s Clinical Governance Team,n the unlikely event that you are unhappy with your experience and they are investigating a complaint on your behalf.
You are able to advise that you do not want for them to do this, but this may restrict the investigation and therefore affect the outcome.
For more information on complaints, visit our contact page for contact details.
Data is also shared where appropriate and necessary with NHS Digital to improve NHS 111, for further information on how NHS Digital use your data see the following website:
https://www.nhs.uk/using-the-nhs/nhs-services/urgent-and-emergency-care/nhs-111/
NHS 111 Online
If you use the NHS 111 online service they will pass your answers and personal details to us as the healthcare service you have selected if you (or the person you are contacting them about), choose to be referred.
By agreeing to NHS 111 online referring you to another healthcare provider you are also agreeing that your data can be forwarded to us so that we can provide care.
For more information on this please see their website: https://111.nhs.uk/Help/Privacy
Your completed notes will be passed onto your registered GP to ensure continuity of care and ensure that there is a full record of your care held centrally.
You are able to object to this sharing of data as we have an obligation to consider the common law duty of confidentiality. However, if we feel that not sharing the data would cause you serious harm we will consider your vital interests. This will be fully explained to you at the end of each period of care.
We are continuously striving to improve our services and your feedback is paramount to this.
We do this by sending out patient experience questionnaires to randomly selected patients via mail and text message.
We only send a text where we have received consent to do so. You can also complete an online questionnaire within the base you visit or via our website.
Your response via text or online will be matched back to you and your incident of care and so will not be anonymous, should you wish to give anonymous feedback you can do so by writing in to our main office.
EPS
Please note that if you access our service for the use of EPS, the Electronic Prescription Service is managed by NHS Digital. NHS Digital is the controller for any personal information you provide to enable the transmission of a prescription electronically from a prescribing system through to a dispensing system, and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS Digital (as the “controller”) when using this service.
To see NHS Digital’s Privacy Notice and Terms and Conditions, please visit: https://digital.nhs.uk/about-nhs-digital/terms-and-conditions
This restriction does not apply to any personal information you provide to us separately which is managed in accordance with our Privacy Policy.
Secondary uses
Commissioners
Clinically-led statutory NHS bodies responsible for the planning and commissioning of health care services for their local area use this data to assess local needs, decide priorities and strategies and then buy services on behalf of the local population from providers such as hospitals, clinics etc to meet the need.
Only the minimum data necessary is shared for each purpose and this is reviewed regularly. Where it is possible to offer a choice over this sharing of data under the common law duty of confidentiality we will make this clear.
Sharing and using data for research purposes in the public and our legitimate interests
IC24 shares data with other NHS bodies and Clinical Commissioning Groups to assist health research for scientific research purposes, statistical purposes to develop and monitor NHS performance.
Where data is used for statistical purposes, stringent measures are taken to ensure individual patients cannot be identified.
Where it is not sufficient to use anonymised information, personal or sensitive (special category) data will be used, but only for essential NHS purposes.
In these circumstances, where it is not practical to obtain your explicit consent, we are informing you through this notice.
Where research is being conducted by IC24 it is in line with our legitimate interests as a business to enable us to be innovative and assist the NHS in creating new systems and services. You will be fully informed and asked for your consent under the common law duty of confidentiality, in these circumstances to proceed.
Duty of Confidentiality
Everyone working for the NHS is subject to the Common Law Duty of Confidentiality. Information provided in confidence will only be used for the purposes described below, unless there are other circumstances covered by the law.
Under the NHS Confidentiality Code of Conduct, all our staff are also required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared.
Organisations with whom we share your personal information
Unless you tell us not to, we will share information with the following main partner organisations:
As we cover a number of different geographical locations we work with a number of CCGs and they require us to share data with specific services within your local area, however you will be informed of the exact local service that your data is shared at the time of contact and can ask for data not to be shared in circumstances where we are not legally bound to share.
We are one of the partner organisations to the Kent and Medway Care Record (KMCR). The KMCR is an electronic care record which links your health and social care information held in different provider systems, to one platform. This allows health and social care professionals who have signed up to the KMCR to access the most up to date information to ensure you receive the best possible care and support by those supporting you. In order to enable this sharing of information, organisations who use the KMCR have agreements in place that allow the sharing of personal and special category data.
For further information about the Kent and Medway Care Record and the ways in which your data is used for this system please click here.
Your individual rights
The following will explain your rights over your data with IC24.
You have a right to be informed about the collection and use of your data. This notice is one of the ways that we are informing you but if at any time you wish to have further details on the categories of data we’re processing or the purposes for a specific instance then you have a right to ask for this.
You have the right to obtain confirmation that we are processing your personal data and a copy of that data.
This includes the right to ask for supplementary information about the third parties it is shared with, the parties we have collected it from, if any and how long it is stored for.
We will provide you with the information within one month of your request.
You should be aware that in certain circumstances your right to see some details in your health records may be limited in your own interest or where it adversely affects the rights and freedoms of other (e.g. another person’s confidentiality). We will however, tell you if we can’t meet your request for that reason.
If you want to access your health records you should make a written request to the Clinical Governance Team at IC24, Kingston House, The Long Barrow, Orbital Park, Ashford, Kent, TN24 0GP or via email to CG.admin@nhs.net
National Data Opt Out
Information about you can also be used and provided to other organisations for purposes beyond your individual care, for research and planning to help provide better health and care for you, your family and future generations. This may only take place when there is a clear legal basis to use this information.
Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.
You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out, your confidential patient information will still be used to support your individual care.
To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters. On this web page you will:
You can also find out more about how patient information is used at:
The right to rectification
You have a right for to have inaccurate personal data rectified, or completed if it is incomplete. You can make a request verbally or in writing and we will respond to you within a month.
This right is to have personal data erased; however, where we are processing data for public health purposes in the public interest this right does not apply. You can make a request and we will advise accordingly.
You have the right to request the restriction or suppression of your personal data.
You have a right to have your data transferred to another service, if we are technically able to do so.
The right to object
You have the right to object to the processing of your personal data in certain circumstances. We will adhere to this in circumstances where we do not believe we have a compelling reason for doing so.
You can make an objection verbally or in writing and we have one calendar month to respond to an objection.
You have the right to lodge a complaint regarding our use of your data
Please tell us first, so we have a chance to address your concerns. If we fail in this, you can address any complaint to the UK Information Commissioner’s Office, either by calling their helpline 0303 123 1113or directed on their website at www.ico.org.uk or via post:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
How secure is the data we collect?
We have physical, electronic, and Information Governance procedures in place to safeguard and secure the information we collect.
We take responsibility and are accountable for ensuring that the data we collect and use is done so in a lawful and ethical manner. They ensure that all of the relevant and most up to date security measures are taken to protect the data and question each secondary use regularly.
The Information Governance Team, including the Data Protection Officer, a Caldicott Guardian and a Senior Information Risk Officer (SIRO).
All new, or changes to existing, information systems or information sharing processes, for healthcare purposes, will undergo a Data Protection Impact Assessment to ensure the security and confidentiality of personal confidential data. These are reviewed throughout the use of the data to ensure that the data remains the same as does the purpose of the use.
With all of the above in place we hope to reduce the possibility of any breaches of data however if you believe your privacy has been breached please contact us immediately on IGteam.ic24@nhs.net
For further information see our Security Policy.
Retention
In general we don't transfer your data outside the UK. We may transfer data outside the UK in exceptional circumstances and only under contract or with agreed principles in line with confidentiality, privacy and all relevant UK data protection legal protections.
IC24 has adopted the retention periods set out in the Records Management Code of Practice for Health and Social Care 2016, Appendix 3.
The retention schedule will be reviewed annually or as necessary to reflect changes in law.
The retention schedule as set out in the Records Management Code of Practice for Health and Social Care 2016 can be found here: https://digital.nhs.uk/data-and-information/looking-after-information/data-security-and-information-governance/codes-of-practice-for-handling-information-in-health-and-care/records-management-code-of-practice-for-health-and-social-care-2016
Last updated: January 2024