Legal

If you want to request further information about this privacy notice or exercise any of your rights, you can email the Data Protection Officer at kentchft.dataprotectionofficer@nhs.net.

For Freedom of Information requests:

Freedom of Information Lead
Kent Community Health NHS Foundation Trust,
Trinity House, 110-120 Upper Pemberton
Eureka Park, Kennington
Ashford
Kent TN25 4AZ

kcht.foi@nhs.net

If you want access to your health record please contact us at:

IG SARS Team
Kent Community Health NHS Foundation Trust,
Trinity House, 110-120 Upper Pemberton
Eureka Park, Kennington
Ashford
Kent TN25 4AZ

kentchft.sar@nhs.net
0300 123 2079

We are committed to protecting and respecting your privacy, and we take your privacy very seriously and we recognise the trust placed in us by individuals whose information we process.

To enable us to provide the best healthcare we can, we collect different personal data and information required to undertake our NHS Trust activities and aims.

The information below sets out the basis on how any personal data we collect from you, or that you provide to us, or that we obtain about you will be processed by us. Please read the following carefully to understand our views and practices regarding your personal data and how we will treat it. We are committed to ensuring that we do so in a manner that is lawful and respects your privacy.

We take the protection of your personal data very seriously and respect your privacy in accordance with data protection legislation and best practice. You have rights relating to your personal information. You can find more information about your privacy rights on the Information Commissioner's Office website www.ico.org.uk.

The Data Protection Act 2018 and the UK General Data Protection Regulation (GDPR) directs how we must use the personal information we hold about you.

You have the right to be informed about how and why we process your personal information and any time you give us personal information you have the right to be informed about why we need it and how we'll use it.

You can find most of the information you need in this Privacy Notice.

If you make a formal Subject Access Request (SAR), we will respond to acknowledge your request and will first require you to prove your identity. We may also ask you for information about any specific information you are seeking to help us make sure we meet your request fully and speed up the process.

We will provide you the information that you are entitled to as soon as possible and without unreasonable delay and at the latest within one month of your identity been verified by us.

In exceptional cases we may extend the period of compliance by a further two months if the request(s) are complex or numerous. If this is the case, we will inform you within one month of the receipt of the request and explain why the extension is necessary.

In most circumstances there will be no charge for this right of this access.

IG SARS Team
Kent Community Health NHS Foundation Trust
110-120 Upper Pemberton
Eureka Business Park
Ashford, Kent TN25 4AZ

kentchft.sar@nhs.net
0300 123 2079

If you believe information we hold about you to be inaccurate or incomplete, you can ask us to correct it at any time for example the spelling of your name or your contact information.

For example, if you are contesting the accuracy of data we are using about you. In such cases we will restrict our processing while we verify the accuracy of the data that we hold.

In addition to the right to restrict the use of your data, you also have a right to object to how we process it in certain circumstances.

You can also ask for certain information about you to be deleted, although this does not apply to health data. In some cases, we will be unable to delete your information if there are statutory grounds to retain it (i.e. HMRC or other legal requirements).

As an NHS Trust we are a legal entity, set up by order of the Secretary of State under section 25 of, and Schedule 4 to, the National Health Service Act 2006, to provide goods and services for the purposes of the health service. We act as Health Care Providers and provide community health services.

As such our business is based upon statutory powers which underpin the legal bases that apply for the purposes of the UK GDPR. We collect and use your personal information under the following primary lawful bases:

Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us as a Data Controller, and the task or function has a clear basis in law;

Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which we as a Data Controller are subject, for example where we have a specific legal obligation that requires the processing of personal data such as processing Subject Access or Freedom of Information requests;

Article 6(1)(d) - where processing is necessary to protect the vital interests of the data subject or another person, for example the processing is necessary to protect someone’s life.

Article 6(1)(b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Article 6(1) (a) – where you have given us consent for us to process your personal data for a specific purpose;

Special category data

As part of the Kent Community Health NHS Foundation Trust’s statutory and corporate functions, we process special category data and criminal offence data in accordance with the requirements of Article 9 and 10 of the UK General Data Protection Regulation (‘GDPR’) and Schedule 1 of the Data Protection Act 2018 (‘DPA 2018’).

Where we process special categories data, for example data concerning including health, racial or ethnic origin, or sexual orientation, we need to meet an additional condition in the UK GDPR. Where we are processing special categories personal data for purposes related to the commissioning and provision of health services the condition is:

Article 9(2)(h) – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

Article 9(2)(c) – where processing is necessary to protect the vital interests of the data subject or of another natural person. An example of our processing would be using health information about a patient in a medical emergency.

Article 9(2)(b) – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.

Article 9(2)(f) – for the establishment, exercise or defence of legal claims. Examples of our processing include processing relating to any tribunal or other litigation. Kent Community Health NHS Foundation Trust may also process personal data for the purpose of, or in connection with, legal proceedings (including prospective legal proceedings), for the purpose of obtaining legal advice, or for the purpose of establishing, exercising or defending legal rights.

Article 9(2)(g) – processing is necessary for reasons of substantial public interest.

Article 9(2)(a) – explicit consent - in circumstances where we seek consent, we make sure that the consent is unambiguous and for one or more specified purposes, is given by an affirmative action and is recorded as the condition for processing. For example, for some special projects that we may undertake.

Criminal conviction data

Article 10 UK GDPR covers processing in relation to criminal convictions and offences or related security measures. In addition, section 11(2) of the DPA 2018 specifically confirms that this includes personal data relating to the alleged commission of offences or proceedings for an offence committed or alleged to have been committed, including sentencing. This is collectively referred to as ‘criminal offence data’.

It is important that we inform you about the information we collect and why we collect it. The information we collect and the reason for collecting it are different for different groups of individuals.

Information can be classed as 'personal' for example your name, address or date of birth or 'sensitive' e.g. details about your health, race or ethnic origin, sexual orientation.

We do not collect more information than we need to fulfil our stated purposes and will not retain for longer than is necessary.

The list below provides a general overview of the types of information we collect and why, it is not an exhaustive list but gives an indication of the general types of information we collect.

In general, the personal information that we collect, hold and share includes:

• personal information (such as name, date of birth, NHS number, addresses, contact details);
• characteristics (such as gender, ethnicity, language, medical conditions, nationality, country of birth);
• details of the medical records and health of patients including current and previous GP practice details;
• specific information relation to child protection or safeguarding.

By providing us with your contact details, you are agreeing for us to use these ways to communicate with you about your care, i.e. by letter (address), by voice-mail or voice message (telephone or mobile number), by text message (mobile number) or by email (email address).

Your information will be passed, with all identifiers removed, to a collaborative programme called the Kent and Medway Shared Health and Care Analytics Board. It will be used for population health management purposes beyond your individual care, including, for example, planning services, managing finances, early treatment of illnesses (known as risk stratification), co-ordinating and improving patient and service user’s movement through the health and care system, research, and public health enhancement.

We also use tracking technology to monitor the location and safety of our employees while attending appointments away from our premises. Our staff are aware of when they are being used and the only people who have access to this information are those monitoring the lone worker’s safety.

The information collected about you can also be used for and shared with other organisations for purposes beyond your individual care. This is known as data processing for Secondary (indirect) care purposes.

Examples include:

• Planning, implementing and evaluating population health strategy - Describing population health needs, understanding where the gaps are, the levels of ill health and reasons for them, and designing and implementing services to improve health.
• Managing finances, quality and outcomes - Understanding costs of services delivered, allocating budgets to invest and improve them, and using information to ensure those services are fit for purpose.
• Risk stratification for early intervention and prevention - Identifying which of our residents are in greatest need and ensuring our services are delivered in a timely and effective manner to improve their health.
• Co-ordinating and optimising patient or service user flows - Using service activity data and contact data to optimise health care use by citizens of hospitals and other care facilities whilst improving health and care outcomes.
• Undertaking research - Working with approved researchers to utilise the best possible methods to analyse data and give useful recommendations for planning and delivery of services.
• Public Health including analysis and reduction of healthcare inequalities - Ensuring that delivery of health and healthcare services is equal and equitable for the whole population, for example: Health Checks Equity Audit (audit of access to relevant health services, and how related outcomes are distributed across the population).

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters. On this web page you will:

• See what is meant by confidential patient information
• Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• Find out more about the benefits of sharing data
• Understand more about who uses the data
• Find out how your data is protected
• Be able to access the system to view, set or change your opt-out setting
• Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
• See the situations where the opt-out will not apply.

You can also find out more about how patient information is used at:

https://www.hra.nhs.uk/information-about-patients/ (which covers health and care research); and https://understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made)

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Our organisation is compliant with the national data opt-out and apply your choice to any confidential patient information we use or share for purposes beyond your individual care.

We understand that sharing information is a sensitive topic, however on occasions it is necessary for us to allow others to see your personal data. We will never sell your information and are committed to being transparent with you about where we legally share information, the reason why and who with. The information below gives an overview of the most frequent sharing that we undertake.

We routinely share information with internal and external health professionals directly involved with your care. We may share your personal information with other NHS organisations, or the Local Authority for health and care purposes. This may include other NHS Trusts, or other providers of NHS services including for example general practitioners (GPs), ambulance services and primary care agencies.

Kent Community Health Foundation Trust (KCHFT) are one of the partner organisations to the Kent and Medway Care Record (KMCR). The KMCR is an electronic care record which links your health and social care information held in different provider systems, to one platform. This allows health and social care professionals who have signed up to the KMCR to access the most up to date information to ensure you receive the best possible care and support by those supporting you. In order to enable this sharing of information, organisations who use the KMCR have agreements in place that allow the sharing of personal and special category data.

Further information about the Kent and Medway Care Record and the ways in which your data is used for this system.

We may need to share information from your health records with other non-NHS organisations, such as Social Services if you are also receiving care or support from them, to ensure that the services you receive are appropriate.

These non-NHS organisations may include, but are not restricted to:

• Social Services
• Education services
• Local authorities
• The police
• Voluntary sector providers
• Private sector providers.

All members of staff employed by these agencies are bound by the common law duty of confidentiality which means that information that you provide to us must be held in confidence and not shared with anyone else.

On occasions the Trust will share information with organisations who can provide additional services to deliver positive outcomes for our patients and families, providing substantial benefits and opportunities. We share the minimum information necessary to allow the other organisation (e.g. food banks, meal delivery services, self-management support etc.) to deliver these services. These partners are a key element in helping us to deliver integrated care and meet our common law duty of care.

We will only share information once we have discussed this with you.

We may need to share information from your health record for the purposes of evaluating the quality of care that we provide, for example with professional bodies and regulators in accordance with our statutory obligations.

We may also be asked by other statutory bodies to share basic information about you, such as your name and address – but not sensitive information from your health records. When this happens, it is normally because it will assist them to carry out their statutory duties and it is lawful for us to do so.

On occasions we may be required by law to provide information about you for any of the following purposes:

• the prevention or detection of crime,
• the apprehension or prosecution of offenders, or
• the assessment or collection of any tax or duty or of any imposition of a similar nature.

We are not obliged to inform you when this happens.

Your information may be accessed and shared internally by our staff in the event of routine enquiries, complaints about us or where we are required to do so by law, for example processing subject access requests or Freedom of Information requests, financial transactions, maintaining our accounts and prevention of fraud. This may include members of different departmental admin teams and our IT staff if access to the data is necessary for performance of their roles, the nature of the enquiry or request and it is within the above lawful bases.

Information about the use of our IT systems is shared with technical suppliers for the purposes of support and system administration.

In the event that we share personal data with third parties, we will provide the minimum amount of personal data necessary to fulfil the purpose for which we are required to share the data.

Kent Community Health NHS Foundation Trust has a Closed-Circuit Television (CCTV) surveillance system ("the system") in operation with images being monitored and recorded. The system is owned, operated and managed by Kent Community Health NHS Foundation Trust. It is used for maintaining public safety, the security of property and premises and for the detection, prevention and investigating of crime. Disclosure of recorded material will only be made to third parties in accordance with the purposes of the system and in compliance with Data Protection legislation.

The Trust telephone systems record incoming and outgoing calls for training and monitoring purposes. Access to recordings are restricted. Disclosure will be made in accordance with the Data Protection Act.  See the Legal Services Department contact details at the top of this notice.

All personal information is stored on our IT systems on secure servers or in secure cabinets in protected areas and offices etc. We operate a suite of IT and security policies to ensure your information is kept secure, including appropriate access and auditing controls.

We use anti-virus software and firewalls to protect against cyber-attack. Unfortunately, the transmission of information via the internet isn't completely secure. Although we'll do our best to protect your personal information, we cannot guarantee the security of information you may send to us that is outside of our security arrangements, for example via your personal email accounts etc.

We also operate strict physical security at all our sites and our employees all receive annual security and data protection awareness training.

Your information is not sent outside the United Kingdom or the European Union unless the recipient has the same level of legal responsibility as we do.

We only keep information for as long as necessary in accordance with legislation or relevant regulations. Once we no longer need to keep your information, we remove it from our systems or securely dispose of it.

All patient records are destroyed in accordance with the Records Management Code of Practice for Health and Social Care which sets out the appropriate length of time each type of NHS record is retained for.

The Trust does not keep personal records for longer than necessary and all records are destroyed confidentially once their retention period has been met, and the Trust has made the decision that the records are no longer required.

CCTV images are kept for one calendar month. Access to ensure that images are deleted is restricted to key individuals.

Telephone call recordings are kept for three calendar months.

This privacy notice may change from time to time, for example, if the law around privacy or personal information changes or for operational purposes. We encourage you to check for updates to this notice from time to time.

Kent Community Health NHS Foundation Trust tries to meet the highest standards when collecting and using personal information. For this reason, we take any complaints we receive about this very seriously. We encourage people to bring it to our attention if they think that our collection or use of information is unfair, misleading or inappropriate. We would also welcome any suggestions for improving our procedures.

If you believe that Kent Community Health NHS Foundation Trust has not complied with your data protection rights, you can complain to the Information Commissioner's Office, their address is Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AFor by calling 0303 123 1113.