General

DHU Health Care CIC (‘DHU’ or the ‘Company’) is a Community Interest Company and a ‘not for profit’ social enterprise, providing a wide range of integrated health services including but not limited to;

• Primary Care Out of Hours
• District Nursing Out of Hours
• Emergency Planning
• NHS 111
• Triage and Navigation
• Urgent Care Walk in Centres
• Healthcare Professional Support
• Special Patient Notes (Care Planning)
• Clinical Advice Service
• Home visiting Services
• A&E Streaming Services

DHU provides services to over 5 million patients and employs over 1,400 staff covering a range of skills and specialisms. 

DHU is the Data Controller for the information which it holds.

The Data Protection Officer (‘DPO’) can be contacted on: information.governance@dhuhealthcare.nhs.uk or DPO@regulatorysolution.co.uk

Information about the structure of the NHS in England is available from “About the NHS” pages of the NHS Choices website.

Information about the roles and functions of DHU is available from the About Us section of this website.

Information about the structure of DHU is available from the Board of Directors section of this website, as well as within our Annual and Quality Reports.

The names of the members of DHU Board are available from the Board of Directors section of the website. 

Browse the Services section of this website for detailed clinical information.

Information about the services delivered is available from the 'Contact Us' section of this website.

A Privacy Notice is a statement by DHU to patients, service users, visitors, carers, the public, and staff, that describes how the we collect, use, retain and disclose personal information which we hold.

It is sometimes also referred to as a Privacy Statement or Privacy Policy. This privacy notice is part of the DHU’s commitment to ensure transparency around the way that DHU process your personal information/data fairly and lawfully.

DHU recognises the importance of protecting personal and confidential information in all that it does and takes care to meet its legal and regulatory duties.

This notice is one of the ways in which the Company can demonstrate its commitment to the DHU values and being transparent and open in relation to its activities.

This notice also explains what rights you have to control how DHU use your information.

DHU may ask for or hold personal confidential information about you which will be used to support delivery of appropriate care and treatment. This is to support the provision of high quality care.

These records may include:

• Basic details, such as name, address, date of birth, next of kin, email address.
• Contact details, such as appointments and home visits.
• Details and records of treatment and care, including notes and reports about your health.
• Results of x-rays, blood tests, etc.
• Information from people who care for you and know you well such as relatives or carers.
• Information from other Health professionals such as your GP, hospital or carers
• NHS Number
• Identification documentation
• Feedback and complaints information

It may also include personal sensitive (Special Category) information such as:

• Physical, mental health, genetic data or biometric data
• Gender,
• Race
• Religion or beliefs
• Whether you have a disability, allergies or health conditions.
• Risk and safeguarding information
• Sexual life or sexual orientation

It is important for DHU to have a complete picture, as this information assists staff involved in your care to deliver and provide improved care, deliver appropriate treatment and care plans, to meet your needs.

Information is collected in a number of ways, via your healthcare professional, referral details from your GP or directly given by you including but not limited to the following,

• When you enquire about one of our services or treatments.
• When you provide information by filling in a form on registration or information provided at any other time at any other time.
• When you correspond with us by email, phone or other ways.
• During the course of the provision of services to you.
• When you contact us by email, telephone, social media or in any other way.
• When you visit our website.
• When you fill in a form or survey for us.
• Information from emergency services, local authority and other public organisations.
• Information from third parties including business partners, service providers, technical sub-contractors, payment and delivery services, when you have given permission to share it with us.
• From publicly available services to keep your information up to date for example the NHS national data base.

This information may be recorded in writing (i.e. in your medical notes), or electronically on a computer, or a mixture of both.

Please note that all calls made to and from DHU Health Care and its associated services are recorded for Training, Quality, Compliance and Regulatory Purposes.

We will also hold information provided to us by other sources such as,

• From your next of kin or other family member.
• Provided by doctors, other clinicians and health care professional, hospitals, clinics and other health care providers.
• Your employer when they provide information.
• Translators and interpreters.
• Any health professional or organisation who provides information for the continuity of your care.
• Information from a Local Authority or the Police.

We use the personal information to provide the direct health, or social care services to individual patients and to meet our contractual commitments to you.

This may include:

• Processing – this will include using the information to fulfil any request made by you or someone on your behalf to receive one of our health or care services.
• Consent – generally we will only ask for your consent to process your personal information if there is no other legal ground to process. Where we need your consent, we will ensure you are as fully informed as possible and use that consent solely for the reason you have given it to us. You will be able to change your mind at any time by contacting us at the address in paragraph 14.  Any email or text to you will have a link to let you do so.
• Public Interest Task – we will process your personal information when carrying out the performance of a task in the public interest which includes the provision of direct health care or social care. This also includes processing personal information for medical research, trials and to train and educate health care professionals.
• Necessary for the purpose of preventative or occupational medicine – to assess whether you are able to work, the provision to you of health or social care, a medical diagnosis, or the management of health and social care systems.
• Necessary to defend legal claims or a court action.
• Vital interests – where it is necessary to protect your vital interests or those of another person.
• Public interest – this is usually in line with any applicable laws such as protecting against dishonesty, malpractice or other seriously improper behaviour.
• Information you have made public.
• Profiling – we may make use of profiling and screening methods to provide a better service to patients. Profiling helps us target resources more effectively through gaining an insight into the background of patients and helping us build relationships that are appropriate to their needs.
• Legitimate Interests – DHU HealthCare also processes your data when it is in our legitimate interest to do this and when these interests do not override your rights. These legitimate interests include: -
  • providing you with information on services.
  • Keeping our records up to date.
  • For statistical research and analysis and to enable us to monitor and improve services.
  • To monitor how we are meeting our clinical and non-clinical performance in the case of health care providers.
  • Sharing your personal information with people or organisations to comply with any legal or regulatory obligations or to enable us to run our organisation.
  • To fulfil laws that apply to us and the third parties we work with.
  • To take part in or be the subject of any merger
  • Managing our relationships with you and third parties who assist us to provide the services to you.

In general DHU use information to,

• To help inform decisions that we make about your care. 
• To ensure that your treatment is safe and effective. 
• To work effectively with other organisations who may be involved in your care. 
• To support the health of the general public. 
• To ensure our services can meet future needs. 
• To review care provided to ensure it is of the highest standard possible. 
• To train healthcare professionals. 
• For research and audit. 
• To prepare statistics on NHS performance. 
• To monitor how we spend public money. 

It helps you because:

• Accurate and up-to-date information assists us in providing you with the best possible care.
• If you see another healthcare professional, specialist or another part of the NHS, they can readily access the information they need to provide you with the best possible care. 
• Where possible, when using information to inform future services and provision, non-identifiable information will be used.

There is huge potential to use your information to deliver care and improve health and care services across the NHS and social care. The information can be used to help:

• Improve individual care.
• Understand more about disease risks and causes.
• Improve diagnosis. 
• Develop new treatments and prevent disease.
• Plan & develop services. 
• Improve patient safety.
• Evaluate Government, NHS and Social Care policy. 

Information is retained in secure electronic and paper records and access is restricted to only those who need to know. It is important that information is kept safe and secure, to protect your confidentiality.

There are a number of ways in which your privacy is shielded;

• By removing your identifying information, 
• Using an independent review process, 
• Adhering to strict contractual conditions, and 
• Ensuring strict sharing or processing agreements are in place. 

The Data Protection Act 2018 & General Data Protection Regulation 2018 regulates the processing of personal information. Strict principles govern the use of information and DHU’s duty to ensure it is kept safe and secure. 

DHU is registered with the Information Commissioners Office (ICO). Details of our registration can be found on https://ico.org.uk/esdwebpages/search

Enter our registration number (Z9765227) and click ‘search register’.

Technology allows DHU to protect information in a number of ways, in the main by restricting access. The guiding principle is that DHU is holding your information in strict confidence.

Everyone working for DHU is subject to the Common Law Duty of Confidentiality, the Data Protection Act 2018 and the UK General Data Protection Regulation 2018.

Information provided in confidence will only be used for the purposes to which you consent to, unless there are other circumstances covered by the law.

Under the NHS Confidentiality Code of Conduct, all staff are required to protect information, inform you of how your information will be used and allow you to decide if and how your information can be shared. This will be noted in your records.

All DHU staff are required to undertake annual training in data protection, confidentiality, IT/cyber security, with additional training for specialists, such as healthcare records management, data protection officers and IT staff.

Teaching clinicians – Some medical files are needed to teach student clinicians about rare cases. Without such materials, new doctors and nurses would not be properly prepared to treat you. 

Clinical placements – Clinical placements for students commonly take place within the DHU Health Care services. 

Students, such as student nurses, medical students, social work students, could be receiving training in the service that is caring for you. This may be when you are in a community setting, such as in clinics, or when you are being visited by health care staff at home. 

If staff would like a student to be present they will always ask for your permission before that meeting or episode of care. The treatment or care you receive will not be affected if you refuse to have a student present during your episode of care. 

Occasionally, for assessment purposes, students may request that their supervisor be present. You may refuse this if it makes you feel uncomfortable.

To provide best care possible, sometimes DHU will need to share information about you with others. 

DHU may share your information with a range of Health and Social Care organisations and regulatory bodies. You may be contacted by any one of these organisations for a specific reason; they will have a duty to tell you why they have contacted you. 

Information sharing is governed by specific rules and law and information outside of these relating to you or your care will only be shared with your consent.

We will never sell your information or let other organisations use it for their own.

Where a third-party data processor is used, we ensure they operate under a contract which includes confidentiality and security of personal data and their obligations under the Data Protection legislation.

For your benefit, DHU may also need to share information from your records with non-NHS organisations, from whom you are also receiving care, such as social services or private healthcare organisations. However, DHU Healthcare will not disclose any health information to third parties without your explicit consent, unless there are exceptional circumstances, such as when the health or safety of others is at risk or where the law requires the disclosure of information.

DHU may also be asked to share basic information about you, such as your name and parts of your address, which does not include sensitive information from your health records. Generally, DHU would only do this to assist them to carry out their statutory duties (such as usages of healthcare services, public health or national audits).

In these circumstances, where it is not practical to obtain your explicit consent, DHU is informing you through this notice, which is referred to as a Privacy Notice, under the Data Protection Act.

Where patient information is shared with other non-NHS organisations, an information sharing agreement is drawn up to ensure information is shared in a way that complies with relevant legislation. 

Non-NHS organisations may include, but are not restricted to:

• Social services. 
• Education services. 
• Local authorities. 
• Police. 
• Voluntary sector providers. 
• Private sector providers.

National Opt-Out

Whenever you use a health or care service, important information about you is collected in a patient record. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be provided to other organisations for purposes beyond your individual care, for instance to help with:

• • improving the quality and standards of care provided
  • research into the development of new treatments
  • preventing illness and diseases
  • monitoring safety
  • planning services

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information is not needed.

Sometimes, for research and planning your confidential patient information will be needed. You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of your information you do not need to do anything. If you do not wish your information to be used, you can opt out. If you do choose to opt out your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters.  On this web page you will:

• See what is meant by confidential patient information
• Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• Find out more about the benefits of sharing data
• Understand more about who uses the data
• Find out how your data is protected
• Be able to access the system to view, set or change your opt-out setting
• Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
• See the situations where the opt-out will not apply

You can change your mind about your choice at any time.

Our organisation [is / is not currently] compliant with the national data opt-out policy.

Security

The security of your personal information is very important to us. We protect all personal data we hold and ensure we have appropriate organisational and technical measures in place to prevent unauthorised access or unlawful processing of personal data and to prevent data being lost, destroyed or damaged.

All information you provide to us is stored on secure servers.

Unfortunately, the transmission of information via the internet is not completely secure. Although we will do our best to protect your personal data, we cannot guarantee the security of your data transmitted to our site; any transmission is at your own risk. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access.

All the personal data is processed in the UK however for IT hosting and maintenance your information may be situated outside the European Economic Area (EEA).

You might find links to third party websites on our website. These websites should have their own privacy policies, which you should check. We do not accept any responsibility or liability for their policies whatsoever as we have no control over them.

Under the GDPR and Data Protection Act, you have the following rights:

• The right to request a copy of your personal data which DHU holds about you. 
• The right to request that DHU corrects any personal data if it is found to be inaccurate or out of date.
• The right to request your personal data is erased where it is no longer necessary for DHU to retain such data.
• The right to withdraw your consent to the processing at any time, where DHU have sought your consent for this processing. 
• The right to request that the data controller provide the data subject with his/her personal data and where possible, to transmit that data directly to another data controller, (known as the right to data portability, where certain conditions are met.
• The right, where there is a dispute in relation to the accuracy or processing of your personal data, to request a restriction is placed on further processing.
• The right to object to the processing of personal data.
• The right to lodge a complaint with the Information Commissioners Office. 

If you would like further information about any of these rights, please contact DHU’s Data Protection Officer or visit our website.

DHU endeavour to meet the highest standards when collecting and using personal information and encourage people to bring concerns to the Company’s attention.

DHU takes any complaints received very seriously.

You can submit a complaint through DHU’s Complaints Procedure, which is available on the Company’s web site, or you can write to:

Should DHU wish to use your personal data for a new purpose, not covered by this Data Protection Privacy Notice, then the Company will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions.

DHU endeavour to meet the highest standards when collecting and using personal information and encourage people to bring concerns to the Company’s attention.

DHU takes any complaints received very seriously.

You can submit a complaint through DHU’s Complaints Procedure, which is available on the Company’s web site, or you can write to:

The Complaints Department

Freepost:
DHU Health Care CIC
Roundhouse Road
Derby
DE24 8GE
Tel: 0300 1000 407
Email: dhulclinical.governance@nhs.net

If you remain dissatisfied with DHU’s decision following your complaint, you may wish to contact:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Their web site is at www.ico.gov.uk