Your information

Our privacy notice explains in detail what information we collect, how we use it, and who can access it. It includes information about the data collected directly from you or shared with us by other organisations. Our privacy notice is reviewed annually, or sooner if needed, to maintain transparency.

NHS Mid and South Essex is committed to protecting your privacy. We process all personal information in line with the Data Protection Act 2018, UK GDPR, the common law duty of confidentiality, and the Human Rights Act 1998. You can view our full privacy notice and supporting documents, including an easy-read version, here.

If you are receiving care from the NHS, we collect and use your health data (paper and electronic) to support your care and improve NHS services.

Data used for your care

We use your data directly to provide and support your individual care. This includes:

• Delivering effective treatment and monitoring the quality of care to ensure the best outcomes.
• Helping you make informed decisions about your health.

Secondary use of data

Beyond individual care, we also use health data to enhance services across the NHS and protect public health. This includes:

• Commissioning: Planning and designing the services needed in our area.
• Population health management: Analysing health and demographic data to address local health needs and inequalities.
• Risk stratification: Identifying people who may benefit from targeted care, ensuring resources reach those most at risk.
• Research: Supporting clinical research and developing new treatments in partnership with trusted organisations.
• Investigating and resolving complaints to uphold quality and service standards.
• Protecting public health and managing NHS resources responsibly.

By using your data responsibly, we can allocate resources effectively, improve patient care, and help the NHS plan for future needs.

How your data is used

The Data Protection Act 2018 and the UK GDPR is the main piece of legislation governing the way organisation can use identifiable data about individuals. Under this legislation, there are a range of legal basis under which organisations can justify their processing of information.

For all the purposes for which NHS Mid and South Essex would your data, the legal basis under GDPR are:

• Article 6(1)(e) – processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller.
• Article 9(2)(h) – processing is necessary for the purposes of the provision of health or social care or treatment or the management of health or social care systems and services.

While not in the form of written legislation, the common law duty of confidentiality is a legal obligation that arises from case law and tradition. It requires the protection of private information in circumstances where there’s an expectation of privacy.

This means that when someone shares private information with another person or organisation, that information must be kept confidential unless the person gives permission for it to be shared. This duty applies in situations where there’s an expectation of privacy, like between a doctor and their patient, or a lawyer and their client.

There are a few exceptions where confidential information might be shared without permission. These include if there’s a legal requirement (like a court order), if it’s necessary to protect someone’s safety, or if the public interest outweighs the duty of confidentiality. But in general, the person or organisation receiving the information must protect it and not misuse or disclose it without good reason.

Your privacy and data security are our priority. When we collect and use data, we take strong measures to protect your identity:

• De-identification (pseudonymisation): For most uses, we receive de-identified information, meaning any names, addresses, or personal identifiers are removed or replaced with anonymous codes. This process, known as pseudonymisation, ensures that individuals cannot be directly identified from the data we hold.
• Secure storage and access: We work closely with our data processors to store information securely, with strict access controls that allow only authorised personnel to view it. All personal information is encrypted to prevent unauthorised access.
• Limited use of identifiable data: If we ever need to use information that identifies you, we ensure a lawful basis for doing so and use it only when essential to complete a task.
• Data sharing restrictions: We never sell your information or share it with third parties for marketing without your explicit consent. Additionally, we do not transfer your data outside the UK unless the destination has legislation that protects your privacy.

There must be a legal basis to share personal information. NHS Mid and South Essex has signed sharing agreements and processing contracts with different partnering organisations in Mid and South Essex Integrated Care System, to enable services to run. These are detailed in the privacy notice in the section labelled sharing information with other organisations.

My Care Record is an information sharing framework that ensures that your data is processed in a consistent and secure manner. This agreement allows information to be shared for direct care purposes only. It is used throughout the NHS East of England region, and NHS Mid and South Essex is a signatory to this agreement.

Further information can be found on the My Care Record website. You can also see the My Care Record privacy notice here.

You are in control of how your NHS data is used for secondary purposes. We will not use your data for purposes outlined above if you have chosen to opt out.

There are various routes of opting out, each with different scope and outcomes.

Type 1 Opt-out

A Type 1 Opt-out will stop your data being shared by your GP practice. To do this you need to fill in an opt-out form and return it to your GP practice.

Only your GP practice can process your opt-out form. They will be able to tell you if, and when, you have been opted out.

If you choose a Type 1 Opt-out, your GP will not share your data for research and planning. However, NHS England will still be able to collect and share data from other healthcare providers, such as hospitals.

National Data Opt-out

The National Data Opt-out will stop NHS England, NHS Mid and South Essex and other health and social care organisations from sharing your data for research and planning.

To do this you can either complete an online form, or contact via phone, email or post. All these options are available via the NHS.uk Manage Your Choice page.

When your choice does not apply

If you choose to stop your confidential patient information being used for research and planning, your data might still be used in some situations:

• When required by law: If there’s a legal requirement to provide it, such as a court order.
• When you have given consent: If you have given your consent, such as for a medical research study.
• When there is an overriding public interest: In an emergency or in a situation when the safety of others is most important. For example, to help manage contagious diseases like COVID-19 and stop them spreading.
• When information that can identify you is removed: Information about your health care or treatment might still be used in research and planning if the information that can identify you is removed first.
• When there is a specific exclusion: Your confidential patient information can still be used in a small number of situations. For example, for official national statistics like a population census.

Data used for your care

If you choose to opt out of sharing your data for secondary purposes, your personal health information will still be used to make sure you get the treatment and care you need. For example, your data may be shared so that you can be referred to hospital or get a prescription.

You have the right to see or be given a copy of the personal data an organisation holds about you. This is known as a Subject Access Request. You can make request to the NHS Mid and South Essex by emailing [email protected]

Tell us your details, details of the records you would like and date ranges. Full details of how to raise a request can be found in our Access to Information Policy

You have further rights under the UKGDPR. To find out more please view the Privacy Notice here, or visit the Information Commissioners Office website

If you have any questions or concerns about how your data is being used, or if you would like to exercise your rights regarding your data, please contact us as:

NHS Mid and South Essex Integrated Care Board
PO Box 6483
Basildon
Essex SS14 0UG

Tel: 01268 594350

Email: [email protected]

Caldicott Guardian: Giles Thorpe

Data Protection Officer: Jane Marley – 01268 594350

Email: [email protected]