Privacy

The Social Prescribing services forms part of the five-year framework for GP contract reform as an NHS commitment to provide additional roles through the personalised care service. The Primary Care Network (PCN) lead Surrey Heath Community Providers (SHCP) are delivering the social prescribing service by building on the already in existence service provided by Surrey Heath Borough Council (SHBC), Citizens Advice Surrey Heath (CASH) and directly through Surrey Heath Community Providers (SHCP).

What information do we collect from you?

We may collect, use, store and transfer different kinds of personal data about you which we have grouped together as follows:

• Identity data; includes first name, maiden name, last name, marital status, title, nationality, date of birth, gender and next of kin.
• Contact data; includes your address, email address and telephone numbers, next of kin and other contact person data.
• Marketing and Communications data; includes your preferences in receiving marketing from us and our third parties and your communication preferences.

We also collect where required information which is categorised as Special Category Data under the General Data Protection Regulation. This includes:

• Health Information [NHS number, medical conditions and needs, carer needs, GP surgery]
• Ethnicity
• Religion
• Sexual Orientation

We use different methods to collect data from and about you including through direct interactions. You may give us your Identity, Contact, Marketing and Communications Data and Special Category Data by filling in forms or by corresponding with us by post, phone, email or in person. This includes personal data you provide when you or someone on your behalf refers you to our service using the online form or forms embedded in IT systems such as EMIS for GP Surgeries.

We may also collect data from Adult Social Care teams, Multi Disciplinary Teams and other Health and Social Care providers that refer you to the service.

Purposes for which we will use your personal data

We have set out below, in a table format, a description of all the ways we plan to use your personal data, and which of the legal bases we rely on to do so. We have also identified what our public task category is being used for data handling where appropriate.

Note that we may process your personal data for more than one lawful ground depending on the specific purpose for which we are using your data. Please contact us at shcp.socialprescribing@nhs.net if you need details about the specific legal ground we are relying on to process your personal data where more than one ground has been set out in the table below.

Who we will share your data with

We may have to share your personal data with the parties set out below for the purposes set out in the table above.

• Specific third parties including Citizen’s Advice Surrey Heath, Surrey Heath Primary Care Network and Surrey Heath GP Federation with whom we deliver the Social Prescribing Service in partnership with.
• The Surrey Heath Integrated Care Partnership with whom we have a Data Sharing Agreement. This includes: NHS Surrey Heath Clinical Commissioning Group; Surrey and Borders Partnership NHS Foundation Trust; Surrey County Council Adult Social Care; Virgin Care Services Ltd; Frimley Health NHS Foundation Trust; South East Coast Ambulance Service NHS Foundation Trust; North Hampshire Urgent Care; NHS Surrey Downs Clinical Commissioning Group; Phyllis Tuckwell Hospice. Information will only be shared with your explicit consent.
• Monitoring information is sometimes required to be provided to partners such as Adult Social Care, Clinical Commissioning Groups (CCG), Commissioning Support Units (CSU) and Frimley Health Integrated Care System (ICS).
• We share anonymised data with R Outcomes to monitor / evaluate project and CAB/RO also send anonymised data to Ecorys who monitor /evaluate for the HWB Fund In addition we may share your information with other borough councils and voluntary sector organisation where services you request or express an interest in are not provided directly by Surrey Heath Borough Council.
• In addition we may share your information with other borough councils and voluntary sector organisation where services you request or express an interest in are not provided directly by Surrey Heath Borough Council.
• If a change happens to our service, then the alternative provider may use your personal data in the same way as set out in this privacy notice.

We require all third parties to respect the security of your personal data and to treat it in accordance with the law. We do not allow our third-party service providers to use your personal data for their own purposes and only permit them to process your personal data for specified purposes and in accordance with our instructions.

Data Controller/Processor

• SHCP, CASH & SHBC will individually and collectively act as data controllers in their own right for the separate information they collect in connection to their contracts.
• SHBC will be the data controller for their website and online referral page for the service
• GP Practices will remain Data Controllers for Clinical records held on EMIS.
• SHBC have commissioned the system, Elemental who act as a data processor, to store and assist with the processing of patient data for those patient referred into the service.

Transferring data outside of the EEA

We do not transfer your personal data outside the European Economic Area (EEA).

How we handle data security

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal data to those employees, agents, contractors and other third parties who have a need to know. They will only process your personal data on our instructions and they are subject to a duty of confidentiality.

How we handle data breaches

We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

How long will we retain your information for?

We will only retain your personal data for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. 

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

By law we have to keep basic information about our customers (including Contact and Identity data) for 6 years after they cease being customers for internal administration purposes.

What are my rights with regards to data?

You have the right to opt out of the Social Prescribing Service at any time, to do this please email shcp.socialprescribing@nhs.net or phone 01276 707253.

In some circumstances you can ask us to delete your data, contact the Data Protection Officer at SHBC by emailing data.protection@surreyheath.gov.uk.

In some circumstances we may anonymise your personal data (so that it can no longer be associated with you) for research or statistical purposes in which case we may use this information indefinitely without further notice to you.

To see more about your rights regarding data please visit the ‘Your Legal Rights’ section of the main Privacy Notice.