Who we are

At One Recovery Bucks, we provide free advice and support to over 18’s living in Buckinghamshire, who are affected by their own or someone else’s use of drugs or alcohol.

One Recovery Bucks is provided by Inclusion, as part of  Midlands Partnership University NHS Foundation Trust, working with Aquarius, Connection Support and Build on Belief.

Inclusion, part of the Midlands Partnership NHS Foundation Trust privacy notice

This page explains why information is collected about you and the ways in which this information may be used: this is called a Fair Processing Notice or Privacy Notice. It is designed to inform you about how Inclusion (part of Midlands Partnership University NHS Foundation Trust) is complying with the General Data Protection Regulation (GDPR) 2018, the UK Data Protection Act 2018 and the Access to Health Records Act 1990. We aim to update this information from time to time to reflect any changes. It also explains how you can access or get copies of your information held by the Trust. For further information about the type of information we hold about you, how we use this and how you can access it. This page describes how Inclusion (MPFT) collects, uses, retains and discloses personal information. Different organisations sometimes use different terms, and it can be referred to as a privacy statement, a fair processing notice or privacy notice. This privacy notice tells you what to expect us to do with your personal information.

• Contact details
• What information we collect, use, and why
• Lawful bases and data protection rights
• Where we get personal information from
• How long we keep information
• Who we share information with
• How to complain

Contact Details

We, Midlands Partnership University NHS Foundation Trust (the Trust), are a data controller. Our address for communications is:
Trust Headquarters
St George’s Hospital
Corporation Street
Stafford
ST16 3SR
Our telephone number is 0300 790 7000

We are registered to process personal and sensitive information under the Data Protection Act 2018 – our registration number is ZA523971.

Our Caldicott Guardian (senior person responsible for sharing of patient information) is Dr Abid Khan. He is also the Responsible Officer and Chief Medical Officer.

Our Senior Information Risk Owner (SIRO) is Richard Morris (Director of Corporate Affairs and Communications).

Our Data Protection Officer is responsible for information and advising on data protection regulations and national law. The Data Protection Officer can be contacted by email infogov@mpft.nhs.uk.

What information we collect, use, and why

We ask you for information about you so you can receive care and treatment. We keep this information, together with details of your care, because it may be needed if we see you again and allows continuity of your care. If you have a complaint regarding this care, we will also collect any data you provide to us. We collect your personal information if you apply for a job or to volunteer with the Trust. We also collect your information if you work for us. As data controllers under the GDPR we process personal data (under Article 6) and sensitive data which the GDPR terms as Special Categories (under article 9). Personal data is defined as information relating to a living individual that can identify them. Examples include name, date of birth, NHS Number or a combination that can also identify an individual. Special Categories are defined as: race, ethnic origin, politics, religion, trade union membership, genetics, biometrics (where used for ID purposes), health, sex life and sexual orientation. We act as joint data controllers with Staffordshire County Council to deliver services in relation to Learning Disability, Older People. Physical and Sensory Disability and Mental Health. As part of this agreement data may need to be shared with them. This applies in Staffordshire only and mental health in the north of the county does not fall within this remit.

 

Records about you are used by those caring for you to:
• Provide a good basis for all healthcare decisions by you and care professionals
• We may offer you services, referrals or information based on your profile Enable you to work in partnership with those providing care
• Make sure the care we provide is safe and effective care
• Work effectively with others providing you with care
• To provide chaplaincy and pastoral care services
• Remind you about appointments.

Others within the Trust and the NHS may also need to access records about you to:
• Check the quality of care (called clinical audit)
• Protect the health of the general public
• Keep track of NHS spending including goods and services the Trust provides
• Manage the health service
• Help investigate untoward incidents, complaints or legal claims
• Teach healthcare staff
• Help with research. If we need to use information that identifies you, for more than your direct care or to check the quality of that care we will always seek your consent beforehand.
• To keep you informed of the work of the Trust such as new services and to carry out surveys.

We collect or use the following information to provide patient care:
• Name, address and contact details
• Gender
• Pronoun preferences
• Date of birth
• Emergency contact details
• Health information (including medical conditions, allergies, medical requirements and medical history)
• Information about care needs (including disabilities, home conditions, medication and dietary requirements and general care provisions)
• Test results (including psychological evaluations, scans, bloods, x-rays, tissue tests and genetic tests)

We also collect the following information to provide patient care:
• Racial or ethnic origin
• Religious or philosophical beliefs
• Health information
• Sexual orientation information

We collect or use the following personal information for recruitment purposes:
• Contact details (eg name, address, telephone number or personal email address)
• Date of birth
• National Insurance number
• Copies of passports or other photo ID
• Employment history (eg job application, employment references or secondary employment)
• Education history (eg qualifications)
• Right to work information
• Details of any criminal convictions (eg Disclosure Barring Service (DBS), Access NI or Disclosure Scotland checks )

We also collect the following information for recruitment purposes:
• Racial or ethnic origin
• Religious or philosophical beliefs
• Trade union membership

Lawful bases and data protection rights

The Trust processes personal information only when it has a legal basis for doing so.

The primary purpose for which the Trust processes personal information is in order to support its healthcare activities as set out in the National Health Service and Community Care Act 1990. This is the Trust’s source of “official authority.”

The basis for the Trust processing your information is described in Article 6 (Lawfulness of processing) and Article 9 (processing of special categories of personal data) of the General Data Protection Regulation.

Under UK data protection law, we must have a “lawful basis” for collecting and using your personal information. There is a list of possible lawful bases in the UK GDPR. You can find out more about lawful bases on the ICO’s website.

Which lawful basis we rely on may affect your data protection rights which are in brief set out below. You can find out more about your data protection rights and the exemptions which may apply on the ICO’s website:
• Your right of access – You have the right to ask us for copies of your personal information. You can request other information such as details about where we get personal information from and who we share personal information with. There are some exemptions which means you may not receive all the information you ask for. You can read more about this right here.
• Your right to rectification – You have the right to ask us to correct or delete personal information you think is inaccurate or incomplete. You can read more about this right here.
• Your right to erasure – You have the right to ask us to delete your personal information. You can read more about this right here.
• Your right to restriction of processing – You have the right to ask us to limit how we can use your personal information. You can read more about this right here.
• Your right to object to processing – You have the right to object to the processing of your personal data. You can read more about this right here.
• Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you. You can read more about this right here.
• Your right to withdraw consent – When we use consent as our lawful basis you have the right to withdraw your consent at any time. You can read more about this right here.

If you make a request, we must respond to you without undue delay and in any event within one month.

To make a data protection rights request, please contact us using the contact details at the top of this privacy notice.

 

Our lawful bases for the collection and use of your data

Our lawful bases for collecting or using personal information to provide patient care are:
• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

Our lawful bases for collecting or using personal information for recruitment purposes are:
• Consent – we have permission from you after we gave you all the relevant information. All of your data protection rights may apply, except the right to object. To be clear, you do have the right to withdraw your consent at any time.

For statistics and research data the lawful basis is Article 9.2(j) processing is necessary for archiving purposes in the public interest, scientific or historical research purposes in accordance with Article 89(1) and DPA Schedule 1 part 1(4).

Where we get personal information from:
• Directly from you

How long we keep information

We retain health records for at least eight years from the last date that you presented at the Trust and until 25th birthday for children.

These are the minimum times for which we keep information; we may keep it for longer if we believe doing so will be of benefit to you or in regard to any other legal obligation. We have a duty to:
• Maintain full and accurate records of the care we provide to you
• Keep records about you confidential and secure

Who we share information with

Others we share personal information with:
• Other health providers (eg GPs and consultants)
• Care providers
• Organisations we need to share information with for safeguarding reasons
• Organisations we’re legally obliged to share personal information with

Duty of confidentiality

We are subject to a common law duty of confidentiality. However, there are circumstances where we will share relevant health and care information. These are where:
• you’ve provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses);
• we have a legal requirement (including court orders) to collect, share or use the data;
• on a case-by-case basis, the public interest to collect, share and use the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime);
• If in England or Wales – the requirements of The Health Service (Control of Patient Information) Regulations 2002 are satisfied; or
• If in Scotland – we have the authority to share provided by the Chief Medical Officer for Scotland, the Chief Executive of NHS Scotland, the Public Benefit and Privacy Panel for Health and Social Care or other similar governance and scrutiny process.

National data opt-out

We comply with England’s national data opt-out because we’re using confidential patient information for purposes beyond individual care. To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters.

How to complain

If you have any concerns about our use of your personal data, you can make a complaint to us using the contact details at the top of this privacy notice.
If you remain unhappy with how we’ve used your data after raising a complaint with us, you can also complain to the ICO.
The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Helpline number: 0303 123 1113
Website: https://www.ico.org.uk/make-a-complaint

What rights you have over your data

See our Trust’s privacy notice.