Website privacy notice

Introduction

This privacy notice sets out how North Tees and Hartlepool NHS Foundation Trust as a ‘Data Controller’ under the General Data Protection Regulations uses and protects any information that you provide when you use this website in accordance with data protection principles.

This Trust is registered to the Information Commissioner’s Office; registration number
Z1142263

We are committed to ensuring that your privacy is protected. Should we ask you to provide certain information by which you can be identified when using this website; you can be assured that it will only be used in accordance with this privacy notice.

What types of information do we collect about you and for what purpose?

“Personal Information” is information that identifies you as an individual or relates to an
identifiable individual. Personal Information we may collect through our website includes:

your name, postal address, email address, phone number and other contact information;

• information regarding your experience with us;
• any queries you have in relation to our services; and
• any information you may voluntarily submit to us by completing any form on our websites

We may collect Personal Information in various ways:

• from any of the website forms you may complete and submit, for example information collected from the “General enquiries” or “Freedom of Information” pages of our website;
• from the content of surveys that you may complete on our website, for example Friends and Family Testing and Patient Hand Hygiene Survey.
• from self-referral forms you may complete to access services provided by the Trust
• from applications forms you may complete and submit, for example Trust membership application.

The information you provide via our website will help the Trust to;

• assess the quality of care we provide to patients and service users
• improve services we provide to patients / users of our services
• comply with legislation (Freedom of Information Act 2000)
• ensure we meet out statutory and legal obligations under the Health and Social Care Act

Legal Basis to Process Information?

We collect information on this website with your consent (Per GDPR Article 6(1)(a) ) when you complete and submit data entry forms on this site.

• None of the information you provide via this website is stored / retained on the website.
• All information submitted by you is sent securely direct to the relevant department within the Trust.
• Information submitted is recorded and stored within the relevant department handling
  your information in accordance with Trust policies and processed per the Trust Patient
  Privacy Notice.

Who might we share your information with?

Information you provide via the website will be shared with relevant departments within the Trust to enable us to respond to your queries and requests and provide you with healthcare services (smoking cessation).

Any information you provide via the Trust membership application will be shared with a third party data processor, information will only be shared with your consent.

Other information we may collect

Please see our cookies page for other information which may be collected as part of this
website.

Links to other websites

Our website may contain links to other websites of interest. However, once you have used these links to leave our site, you should note that we do not have any control over that other website. Therefore, we cannot be responsible for the protection and privacy of any information which you provide while visiting such sites and such sites are not governed by this privacy statement. You should exercise caution and look at the privacy statement applicable to the website in question.

How do we keep information safe?

We are committed to keeping your information secure and have operational policies and
procedures in place to protect your information. We ensure that we comply with current data protection legislation including the Data Protection Act 2018 (DPA) and General Data Protection Regulation (GDPR).

Do we process information overseas?

Your information is not currently processed overseas and we do not transfer personal
information to a country outside of the European Union (EU) and this is checked on a regular basis. If it is found that we intend to share information outside of the EU, appropriate and suitable safeguards will be put in place, which you will be told about.

How long do you we retain information?

Data will be retained in compliance with the Records Management Code of Practice for Health and Social Care 2016 which details retention periods for employment records. This is available on the NHS Digital website.

What are your rights as an individual?

Data Protection law gives individuals rights in respect of the personal information that we hold about you and these apply in circumstances where the relevant conditions are met.

These rights are, the right:

1. To be informed why, where and how we use your information.
2. To ask for access to your information.
3. To ask for your information to be corrected if it is inaccurate or incomplete.
4. To ask for your information to be deleted or removed where there is no need for us to
   continue processing it.
5. To ask us to restrict the use of your information.
6. To ask us to copy or transfer your information from one IT system to another in a safe
   and secure way, without impacting the quality of the information.
7. To object to how your information is used.
8. To challenge any decisions made without human intervention (automated decision
   making)

For further information on your rights please visit the ICO website www.ico.org.uk or contact the Trust Data Protection Officer.

As well as receiving a copy of the information that the Trust holds and processes, you are also entitled to the following:

• To be told whether any personal data is being processed.
• Given a description of the personal data, the reasons it is being processed, and whether it will be given to any other organisations or people.
• Given a copy of the personal data together with its source (where this is available).

How can I access my information?

You have the right to obtain from the Trust confirmation as to whether or not personal data concerning you is being processed, and, where that is the case, access to the personal data.

To submit a formal request for information collected from this website, please contact:

Once your request has been received and your identity / entitlement verified, your request will usually be completed within one calendar month. However, if your records are extensive we may take longer to process your request but will inform you from the outset where possible, and in any case within 30 days.

Data Protection Officer

The Trust’s Data Protection Officer (DPO) is responsible for ensuring that the Trust complies with the GDPR. The DPO is the person to contact if you would like to know more about how we use your information, if you require information in any accessible format or language, you wish to make a complaint or if (for any reason) you do not wish to have your information used in any of the ways described. The DPO contact details are:

Making a Complaint

Should you wish to lodge a complaint about the use of your information on this website, please contact our communications and marketing department.

Information Commissioners Office (ICO)

You have the right to lodge a complaint if you are not content with the outcome of your
confidentiality and data protection complaint and/or concern raised with the Trust.

Further Information

Should you have any further queries on the uses of your information, please speak to the
Human Resources Department or our Data Protection Officer.

Changes

It is important to point out that we may amend this Privacy Notice from time to time.