Patient Privacy Notice

Patient privacy notice

We want you to be confident that your information is kept safe and secure and understand how and why we use it to support your care.  This privacy policy explains:

  • Who we are
  • Why we collect information about you
  • How your information will be used
  • How we keep it safe and confidential

Definitions

The following legislation will both be referred as, UK Data Protection Laws:

  • UK General Data Protection Regulation (UK GDPR)
  • DPA 18, Data Protection Act 2018

Personal data: Any information relating to an identifiable individual such as your name, NHS number, contact details. It can also be location data or an online identifier.

Special categories of personal data are defined as: Racial or ethnic origin, politics, religious or philosophical beliefs, trade union membership, genetics, biometrics (where used for identification) information concerning your health, sex life or sexual orientation.

Who are we?

HCRG Care Limited are commissioned to provide integrated sexual health services in Cheshire West and Chester, Oldham, Rochdale, Bury, Middlesbrough, Stockton, Redcar and Cleveland, Hartlepool and Northern Lincolnshire. HCRG Care group are the data controller’s for any personal information we hold about you.

For more information please visit: http://thesexualhealthhub.co.uk/

HCRG Care Limited is a limited company registered in England and Wales, number 5466033. Registered office: HCRG Care Group, The Heath Business and Technical Park, Runcorn, Cheshire, WA7 4QX.

Who can you contact regarding your personal information we hold

  • Service Manager

Karen Tipping

Service Manager

Oldham, Rochdale and Bury Integrated Sexual Health

 

Oldham Sexual Health

Oldham Integrated Care Centre

5th floor,

Sexual health Oldham,

Radcliffe St,

Oldham,

OL1 1NL

Tel: 0300 303 8565

 

Rochdale Sexual Health

Nye Bevan House

Maclure Road,

Rochdale,

OL11 1DN

Tel: 0300 303 8565

 

Bury Sexual Health

 3rd Floor, Townside Primary Care Centre,

1 Knowsley Place,

Knowsley Street,

Bury,

Lancashire,

BL9 0SN

Tel: 0300 303 8565

 

Bury Young People’s Service

 3rd Floor, Townside Primary Care Centre,

1 Knowsley Place,

Knowsley Street,

Bury,

Lancashire,

BL9 0SN

Tel: 0300 303 8565

 

Oldham’s Young People’s Service

 Oldham Integrated Care Centre

5th floor,

Radcliffe St,

Oldham,

OL1 1NL

Tel: 0300 303 8565

 

Rochdale Young People’s Service

 Nye Bevan House

Maclure Road

Rochdale

Ol11 1DN

Tel: 0300 303 8565

 

  • Service Manager

Bradley Pearson Barnard

Cheshire West and Chester Sexual Health Service

 

Fountains Health,

Delamere Street,

Chester, CH1 4DS

Tel: 0300 247 0020

 

  • Service Manager

Lauri McLaughlin

Teesside Sexual Health Service

 

2nd Floor,

Lawson Street Health Centre,

Stockton on Tees,

TS18 1HU

Tel: 0300 330 1122

 

Redcar & Cleveland Leisure & Community Heart

Ridley Street,

Redcar,

TS10 1TD

Tel: 0300 330 1122

 

The Fens Medical Centre

434 Catcote Road

Hartlepool

TS25 2LS

Tel: 0300 330 1122

 

Livewell Centre

Dundas Shopping Centre

Dundas Street

Middlesbrough

TS1 1HR

Tel: 0300 330 1122

  • Data Protection Officer

David Watkins

HCRG Care Group LTD

The Heath Business Park

Runcorn

Cheshire

WA7 4QX

Tel: 01925 302 514

Email: ask.IG@hcrgcaregroup.com

If you are not happy about the way your information is handled, you have the right to lodge a complaint with a supervisory authority.  In the UK, this is the Information Commissioners Office (ICO).

The Information Commissioner’s Office

Wycliffe House

Cheshire

SK9 5AF

Helpline: 0303 123 1113 (local rate)

Email: casework@ico.org.uk

Website: www.ico.org.uk

https://ico.org.uk/global/contact-us/

How to make a complaint to the ICO

 

What are your rights

If we need to use your personal information for any reasons beyond those stated above, we will discuss this with you and ask for your explicit consent. Under the UK Data Protection Laws, you have the following rights. If you have any queries around your rights, please contact the Data Protection Officer details in section 3 or use a link to our privacy portal in section 5.

  • The right to be informed

As a data controller, we are obliged to provide understandable and transparent information about the way we process your data (this is provided by our privacy policy).

  • The right of access 

You are entitled to request a copy of the personal data we hold about you.

  • The right to rectification

You are entitled to request changes to information if it is inaccurate or incomplete

  • The right to erasure

Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that we delete the personal data.

  • The right to restrict processing

Under certain circumstances, you may ask us to stop processing your personal data. We will still hold the data, but will not process it any further.

  • The right to data portability

Subject to certain conditions, you may request a copy of your personal data to be transferred to another organisation.

  • The right to object to processing

You have the right to object to our processing of your data where:

  • Processing is based on legitimate interest
  • Processing involves automated decision-making and profiling
  • Processing would be for a purpose beyond your care and treatment, e.g. direct marketing and scientific or historic research; you can opt-out to the sharing of this information under the National Data Opt-Out. Further information can be found on the following website: https://digital.nhs.uk/national-data-opt-out/
  • Friends and Family Test

Please note that the above rights may not apply in all circumstances.

 Keep us updated of any changes

Please let us know if you change your address or contact details etc. so that we can keep your information accurate and up to date.

How to request a copy of your record

You can request a copy of your records via our Data Subject Access Requests (DSAR) portal.

Data Subject Rights Portal – Teesside

Data Subject Rights Portal – Oldham

Data Subject Rights Portal – Rochdale

Data Subject Rights Portal – Bury

Data Subject Rights Portal – Cheshire West and Chester

Our portal supports the management of requests with regards to records and/or alterations/concerns. Your request will be directed to our Privacy Team which will ensure that the correct service receives your request promptly.

To progress the request, you will need proof of identity as follows:

  • Driving license or passport or work ID badge or bus pass or a witness to your signature by someone who is over 18 and is not a relative, (preferably by your doctor/solicitor on their headed business paper) as proof of identity
  • Bank statement or pay slip or utility bill or a letter on headed paper from a local authority or similar as proof of residence.

If you are a Representative acting on a data subject’s behalf you will need proof of your identity as well as proof that the data subject is freely giving consent to the request, or you have the appropriate legal authority.

If you would like more information about your records, please ask at reception, speak to the person proving your care or contact our Data Protection Officer: David Watkins General Counsel, HCRG Care Group. Email: ask.IG@hcrgcaregroup.com

The information we collect and use

We will collect basic ‘personal data’ about you such as your name, date of birth (DOB).  We may also ask you for more sensitive data, called ‘special category data’ such as your ethnicity and information about your health and outcomes of needs assessments.  This information is held in written form and/or in digital form.

The types of information that will be collected by HCRG Care Group Ltd when you are using our online service are:

  • Name
  • Postcode (to receive your test, if requested)
  • Gender
  • DOB
  • Translator
  • Contact Preference Details
  • Learning Disability/Impairment
  • Sexual Orientation

Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you have received within any NHS organisation (e.g. information from Hospitals, GP surgeries etc.) These records help to provide you with the best possible healthcare and help us to protect your safety.

In carrying out this role we will collect information about you which helps us respond to your queries or secure specialist services.  We may collect the information from you, or other trusted parties involved in your care.

We will collect basic ‘personal data’ about you once you register with us such as:

This may include:

  • Details about you, such as your address, NHS number, next of kin and/or carer information

In addition to the above we may also hold more sensitive personal data, called ‘special category data’ which could include:

  • Any contact the service has had with you, such as appointments, clinic visits, emergency appointments, etc.
  • Notes and reports about your health and safeguarding
  • Details about your treatment and care
  • Results of investigations, such as laboratory tests, x-rays, etc.
  • Relevant information from other health professionals, relatives or those who care for you

How we use your information

Your records are used to:

  • Provide information to make health decisions made by care professional with and for you
  • To register you on our clinical system and book an appointment,
  • To send appointment reminders with your permission, to the mobile number you supplied
  • You will also have the option to add your appointment directly in to your mobile calendar at the end of the online booking process.
  • To post home sampling kits with your consent
  • Make sure your care is safe and effective
  • To issue treatments or supply contraception

Without your permission we will not:

  • Inform your GP or healthcare professional about the fact that you had the test or your results*
  • Refer you to other specialist services
  • Share your information

* The only time we may need to discuss your results with a GP or healthcare professional is if we are unable to contact you by your chosen method of communication and your test is positive. This is to help protect your health.

We may also use, or share, your information for the following purposes:

  • Looking after the health of the public
  • Making sure that our services can meet patient needs in the future
  • Preparing statistics on NHS performance and activity
  • Investigating concerns, complaints, or legal claims
  • Helping colleagues review the care they provide to make sure it is of the highest standards
  • Training and educating staff
  • For research purposes (we will always ask your consent for this)

Invoice Validation

Invoice validation enables us to identify which CCG is responsible for paying for your treatment.  Section 251 of the NHS Act 2006 provides a statutory legal basis to process data for invoice validation purposes and uses your NHS number to validate payment. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly. NHS Digital – how we use your information for invoice validation

SMS Text Reminder Service

The services provide a text messaging service which automatically sends SMS messages to you informing you of your results. We will always ask and record your communication preferences when you come into the service. All SMS messages are discreet, and we never use names of infections or use your clinic name. Services also have a results line that you can call to get your results. You’ll be told about this when you have your tests and how long you need to wait before calling. Details of the services are above. You also have the option to opt out of this service if you wish by contacting the team you are in contact with.

The Friends and Family Test (FFT)

NHS organisations including HCRG Care Ltd are required to use the Friends & Family Test (FFT) to capture feedback and submit response data to NHS England each month.  Patients can access the data which will then help them make informed choices about their future care. We collect feedback from several different channels, including SMS text messaging, online – via our HCRG Care Group website and paper questionnaires/feedback forms.  All personal information collected is processed and stored in accordance with the Data Protection Act 2018 / UK GDPR 2016.

Contacting our services via email

If you contact our services via email, this method of communication will not be secure. If you choose to use this method, you are agreeing to transferring your information in this way.

Lilie Touch self-check-in

We have installed Lille Touch self-check-in screens at some of our services. The information we collect on Lilie Touch is used to maintain the demographic information on your patient record. All the information you submit is secure.

 

Services we provide

  • Oldham Sexual Health
  • Rochdale Sexual Health
  • Bury Sexual Health
  • Cheshire West and Chester Sexual Health
  • Teesside Sexual Health

Oldham Sexual Health

We provide free and confidential sexual health services in Oldham including information and advice on all types of contraception and STI testing and treatment. Our service is confidential, non-judgmental and for people of all ages, genders, and orientations.

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 303 8565.

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/oldham/

Rochdale Sexual Health

We provide free and confidential sexual health services in Rochdale, Middleton, Heywood and Littleborough. This includes information and advice on all types of contraception, STI testing and treatment. Our service is confidential, non-judgemental and for people of all ages, genders, and orientations.

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 303 8565.

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/rochdale/

Bury Sexual Health

We provide free and confidential sexual health services in Bury, Radcliffe and nearby areas. This includes information and advice on all types of contraception and STI testing and treatment. Our service is confidential, non-judgemental and for people of all ages, genders, and orientations.

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 3038565.

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/bury/

Cheshire West and Chester Sexual Health

We provide free and confidential sexual health services in Cheshire West and Chester including Winsford, Blacon and Ellesmere Port. Our services include providing free information and advice on all types of contraception and STI testing and treatment. Our service is confidential, non-judgemental and for people of all ages, genders, and orientations.

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 247 0020

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/cheshire-and-chester/

Teesside Sexual Health

We provide free and confidential sexual health services across Teesside with clinics in Stockton on Tees, Redcar, Middlesbrough, and Hartlepool. Our services include information and advice on all types of contraception and STI testing and treatment. Our service is confidential, non-judgemental and for people of all ages, genders, and orientations. Our sexual health clinics can be found in Middlesborough, Redcar, Hartlepool, Stockton-on-Tees.

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 3301122.

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/teesside/

 

Who we share your information with

We may also share your information for the provision of your care or for another legal obligation with the following organisations and partners:

  • NHS Trusts/Foundations
  • GP’s
  • Ambulance Trusts
  • Clinical Commissioning Groups
  • NHS England (NHSE) and NHS Digital (NHSD)
  • Local Authorities
  • Police and Judicial Services
  • HCRG Care Group Support teams
  • Marie Stopes
  • Acculabs for management of samples for all services.
  • British Association for Sexual Health and HIV (BASHH)
  • Family Planning Association (Contraception)
  • British Pregnancy Advisory Service (BPA)
  • Terrence Higgins Trust
  • Brook
  • Early Break
  • SH24 for emergency hormonal contraception SH24 Privacy Policy
  • Pharmacies
  • SXT – Partner Notification Tool SXT Privacy Policy
  • Idox Health
  • Chat Health – SMS messaging application
  • Accurx – video consultation platform

When we share your information:

We may share information about you for the following purposes;

  • To support your health and care arrangements including referrals, pathology and other results
  • If it is in your best interests
  • To manage incidents that you have been involved in
  • To deal with complaints and investigations
  • Requests for information from official authorities or your representatives
  • Your records if the service is transferring to us under contract or if you are moving out of area
  • The prevention and detection of crime
  • Funding requests or payments
  • Legal advice or proceedings
  • Responding to legal requests and court orders
  • Public health notifications
  • Partner Notification to protect partners and the public
  • To gather feedback through the friends and family test

Our partners and other recipients:

  • We work in partnership with commissioners, other health and care providers such as primary care services, local authorities, NHS trusts, pathology providers etc.
  • Prison service relating to prison healthcare
  • Local Safeguarding Boards
  • Regulators
  • We may use trusted providers to host our IT, archiving, email and texting services and surveys
  • We may use corporate teams within the HCRG Care Group who provide ‘back office’ support on behalf of services within our group such as communications and marketing, information governance, clinical governance and IMT.

What is our legal basis for processing your information?

For the Sexual Health services to legally process your information a ‘lawful basis’ needs to be identified. Data protection law recognises the difference between personal data and that of a more sensitive nature known as special categories of data; such as racial or ethnic origin, political opinions, religious beliefs, trade union activities and physical or mental health.

Our Legal basis for processing your personal information falls under one of the following legal bases:

  • Providing and managing health and social cares services to our patient’s service users and clients
  • Performance of a task carried out in the public interest or in the exercise of official authority
  • Necessary for a legal obligation such as responding to a request from a coroner
  • Necessary for reasons in the area of public health such as in the event of an outbreak of a disease

Our Legal basis for processing special categories “sensitive” personal information falls under one of the following legal bases:

  • We need to use the data to provide medical diagnosis, health and social care treatment services to you
  • Social protection law for safeguarding purposes

How long do we keep your information

We will keep your healthcare records in accordance with the national guidance: Records Management Code of Practice for Health and Social Care 2021, after which records, and confidential information are securely destroyed in line with this code of practice. Please click on the link for the retention periods of the various medical records we hold. Records retention schedules

CCTV

We have installed CCTV systems in our premises for the purposes of public and staff safety and crime and prevention and detection. In all locations, signs are displayed notifying you that CCTV is in operation and providing details of who to contact for further information.

Images captured by CCTV will be deleted 30 days after the CCTV footage was taken. However, on occasions there may need to be a need to keep images for longer, for example where a crime is being investigated.

You have the right to see CCTV images of yourself and be provided with a copy of the images. We will only disclose images to authorised bodies such as the police, who intend to use it for the purposes stated above. You will find our contact details at the beginning of this privacy notice If you wish to request a copy of the CCTV recording, please contact your local service.

How we keep your information safe

We take the security of your personal data very seriously. We have operational policies and procedures in place to protect your information whether it is in hard copy or electronic format. We protect your information in the following ways:

Training:

Staff are trained to understand their duty of confidentiality and their responsibilities regarding the security of patient data; this includes their mandatory annual training in data security and confidentiality to demonstrate they understand and are complying with policies on confidentiality.

Access Controls:

Any member of staff who has access to personal confidential data will have a username and unique password. This will reduce the risk of unauthorised access to your personal data and all access is auditable.

Technical measures:

We complete due diligence and impose contractual obligations on our trusted providers and persons working under our instruction.

We have a duty to:

  • Maintain full and accurate records of the care we provide to you.
  • Keep records about you confidential and secure.
  • Provide information in a format that is accessible to you.

Everyone working for our organisation is subject to the Common Law Duty of Confidence.  Information provided in confidence will only be used for the purposes advised with consent given by the patient, unless there are other circumstances covered by the law.

The NHS Digital Code of Practice on Confidential Information applies to all NHS staff and they are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared.  All our staff are expected to make sure information is kept confidential and receive regular training on how to do this.

The health records we use will be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure.  Your records are backed up securely in line with NHS standard procedures.  We ensure that the information we hold is kept in secure locations, is protected by appropriate security and access is restricted to authorised personnel.

We also make sure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed.

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

  • Data Protection Act 2018
  • UK General Data Protection Regulation
  • Human Rights Act
  • Common Law Duty of Confidentiality
  • NHS Codes of Confidentiality and Information Security
  • Health and Social Care Act 2015
  • And all applicable legislation

We maintain our duty of confidentiality to you at all times. We will only ever use or pass on information about you if we reasonably believe that others involved in your care have a genuine need for it.

We will not disclose your information to any third party without an appropriate legal basis and there are exceptional circumstances (such as a risk of serious harm to yourself or others) or where the law requires information to be passed on.

When booking appointments online, HCRG Care Group Ltd. will not share your information (other than for direct care) without your permission unless there are exceptional circumstances, such as where the health and safety of others is at risk, or where we are legally obliged to pass on information.  Like all health providers,

we reserve the right to disclose your personal information to comply with applicable laws and government or regulatory bodies’ lawful requests for information.

Any other agency receiving information from us is also under a legal duty to keep your information confidential.

When ordering a home sampling kit for sexually transmitted infections, your information will be shared with a third party provider, namely Acculabs Diagnostics UK LTD. Acculabs will send the home sampling kits to you, and when returned, carry out the testing and return results to HCRG Care Group Ltd. via a secure link.  This information will not be processed further by Acculabs, but will be stored on their IT servers within the UK.  HCRG Care Group Ltd. and Acculabs have comprehensive agreements in place to ensure the secure and confidential processing on your information.

Without your permission we will not:

  • inform your GP or healthcare professional about the fact that you have had the test or your results*
  • refer you to other specialist services
  • share your information

* The only time we may need to discuss your results with a GP or healthcare professional is if we are unable to contact you by your chosen method of communication and your test is positive. This is to help protect your health.

What if you’re under 16?

Under 16’s have the same rights to confidentiality as anyone else and will not be treated any differently. However, if you are under 13, we are likely to be more worried about you having sex.

What if you test positive for a sexually transmitted infection?

Confidentiality is no different if you test positive unless we’re completely unable to contact you to inform you of your infection.

In some instances, we may not be able to contact you due to incorrect contact details. It is important that you regularly inform us of any changes to your contact details, especially new mobile phone numbers.  We always recommend if you have not received your results within 2 weeks of your test you contact your local clinic.

How the NHS and care services use your information

Sexual health services are one of many organisations working in the health and care system to improve care for patients and the public.

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service.

Collecting this information helps to ensure you get the best possible care and treatment. The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

  • improving the quality and standards of care provided
  • research into the development of new treatments
  • preventing illness and diseases
  • monitoring safety
  • planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

Social media and our website

When you contact us through social media such as Facebook and Twitter, we hold your information and reason for contact in our social media management portal to enable us to easily access and manage our engagement with you.  This may result in us sharing your information with other parties within the HCRG Care Group e.g. individuals involved in your care, managing your complaint etc.

When you visit our websites we collect standard internet log information and details of visitor behaviours. This is statistical data only which we collect in order to find out the numbers of visitors to the site and the pages visited. The information is collected in such a way that does not identify individuals and we do not make any attempts to identify visitors this way.

Where we do collect personal information on our website, this will be made obvious to you through the relevant pages.

Contract end provisions

In the event of the contract with the service and HCRG Care Group Ltd coming to an end, all relevant documentation and records will be transferred to the new provider (s).

The transfer of records will be conducted in accordance with the current UK Data Protection Law.

Changes to our privacy notice

We will update this privacy notice from time to time to reflect any changes to our ways of working. Please contact our Data Protection Officer if you would like more information.

Date privacy notice last updated: March 2024

Back to top