Patient Privacy Notice

We want you to be confident that your information is kept safe and secure and understand how and why we use it to support your care. This privacy policy explains:

Who we are?
Why we collect information about you
How your information will be used
How we keep it safe and confidential

Definitions

The following legislation will both be referred as, UK Data Protection Laws:

UK General Data Protection Regulation (UK GDPR)
DPA 18, Data Protection Act 2018

Personal data: Any information relating to an identifiable individual such as your name, NHS number, contact details. It can also be location data or an online identifier.

Special categories of personal data are defined as: Racial or ethnic origin, politics, religious or philosophical beliefs, trade union membership, genetics, biometrics (where used for identification) information concerning your health, sex life or sexual orientation.

Who are we?

HCRG Care Limited are commissioned to provide integrated sexual health services in Cheshire West and Chester, Oldham, Rochdale, Bury, Middlesbrough, Stockton, Redcar and Cleveland, Hartlepool and Northern Lincolnshire. HCRG Care group are the data controller’s for any personal information we hold about you.

For more information please visit: http://thesexualhealthhub.co.uk/

HCRG Care Limited is a limited company registered in England and Wales, number 5466033. Registered office: HCRG Care Group, The Heath Business and Technical Park, Runcorn, Cheshire, WA7 4QX.

Who can you contact regarding your personal information we hold

Service Manager

Karen Tipping
Oldham, Rochdale and Bury Integrated Sexual Health

Oldham Sexual Health
Oldham Integrated Care Centre
5th floor
Radcliffe St
Oldham
OL1 1NL
Tel: 0300 303 8565

Rochdale Sexual Health
Nye Bevan House
Maclure Road
Rochdale
OL11 1DN
Tel: 0300 303 8565

Bury Sexual Health
3rd Floor, Townside Primary Care Centre
1 Knowsley Place
Knowsley Street
Bury
BL9 0SN
Tel: 0300 303 8565

Bury Young People’s Service
3rd Floor, Townside Primary Care Centre
1 Knowsley Place
Knowsley Street
Bury
Lancashire
BL9 0SN
Tel: 0300 303 8565

Oldham’s Young People’s Service
Oldham Integrated Care Centre
5th floor
Radcliffe St
Oldham
OL1 1NL
Tel: 0300 303 8565

Rochdale Young People’s Service
Nye Bevan House
Maclure Road
Rochdale
Ol11 1DN
Tel: 0300 303 8565

Service Manager

Bradley Pearson-Barnard
Cheshire West and Chester Sexual Health Service

Fountains Health
Delamere Stree
Chester
CH1 4DS
Tel: 0300 247 0020

Service Manager

Lauri McLaughlin
Teesside Sexual Health Service

2nd Floor
Lawson Street Health Centre
Stockton on Tees
TS18 1HU
Tel: 0300 330 1122

Redcar & Cleveland Leisure & Community Heart
Ridley Street
Redcar
TS10 1TD
Tel: 0300 330 1122

The Fens Medical Centre
434 Catcote Road
Hartlepool
TS25 2LS
Tel: 0300 330 1122

Live well Centre
Dundas Shopping Centre
Dundas Street
Middlesbrough
TS1 1HR
Tel: 0300 330 1122

Service Manager

Elliott Fenton
Northern Lincolnshire Integrated Sexual Health

The Ironstone Centre
West Street
Scunthorpe
North Lincolnshire
DN15 6HX
Tel: 0300 330 1122

Stirling Street Medical Centre
Stirling Street
Grimsby
North East Lincolnshire
DN31 3AE
Tel: 0300 330 1122

Data Protection Officer

Deborah Tonkin
HCRG Care Group LTD

The Heath Business & Technical Park
Runcorn
Cheshire
WA7 4QX
Email: ask.IG@hcrgcaregroup.com

If you are not happy about the way your information is handled, you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioners Office (ICO).

The Information Commissioner’s Office
Wycliffe House
Cheshire
SK9 5AF

Helpline: 0303 123 1113 (local rate)
Email: casework@ico.org.uk
Website: www.ico.org.uk

https://ico.org.uk/global/contact-us/

How to make a complaint to the ICO

What are your rights

If we need to use your personal information for any reasons beyond those stated above, we will discuss this with you and ask for your explicit consent. Under the UK Data Protection Laws, you have the following rights. If you have any queries around your rights, please contact the Data Protection Officer details in section 3 or use a link to our privacy portal in section 5.

The right to be informed

As a data controller, we are obliged to provide understandable and transparent information about the way we process your data (this is provided by our privacy policy).

The right of access

You are entitled to request a copy of the personal data we hold about you.

The right to rectification

You are entitled to request changes to information if it is inaccurate or incomplete

The right to erasure

Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that we delete the personal data.

The right to restrict processing

Under certain circumstances, you may ask us to stop processing your personal data. We will still hold the data, but will not process it any further.

The right to data portability

Subject to certain conditions, you may request a copy of your personal data to be transferred to another organisation.

The right to object to processing

You have the right to object to our processing of your data where:

Processing is based on legitimate interest
Processing involves automated decision-making and profiling
Processing would be for a purpose beyond your care and treatment, e.g. direct marketing and scientific or historic research; you can opt-out to the sharing of this information under the National Data Opt-Out. Further information can be found on the following website: https://digital.nhs.uk/national-data-opt-out/
Friends and Family Test

Please note that the above rights may not apply in all circumstances.

Keep us updated of any changes

Please let us know if you change your address or contact details etc. so that we can keep your information accurate and up to date.

How to request a copy of your record

You can request a copy of your records via our Data Subject Access Requests (DSAR) portal.

Data Subject Rights Portal – Teesside

Data Subject Rights Portal – Northern Lincolnshire Sexual Health

Data Subject Rights Portal – Oldham

Data Subject Rights Portal – Rochdale

Data Subject Rights Portal – Bury

Data Subject Rights Portal – Cheshire West and Chester

Our portal supports the management of requests with regards to records and/or alterations/concerns. Your request will be directed to our Privacy Team which will ensure that the correct service receives your request promptly.

To progress the request, you will need proof of identity as follows:

Driving license or passport or work ID badge or bus pass or a witness to your signature by someone who is over 18 and is not a relative, (preferably by your doctor/solicitor on their headed business paper) as proof of identity
Bank statement or pay slip or utility bill or a letter on headed paper from a local authority or similar as proof of residence.

If you are a Representative acting on a data subject’s behalf you will need proof of your identity as well as proof that the data subject is freely giving consent to the request, or you have the appropriate legal authority.

If you would like more information about your records, please ask at reception, speak to the person proving your care or contact our Data Protection Officer: Deborah Tonkin, HCRG Care Group. Email: ask.IG@hcrgcaregroup.com.

The information we collect and use

We will collect basic ‘personal data’ about you such as your name, date of birth (DOB). We may also ask you for more sensitive data, called ‘special category data’ such as your ethnicity and information about your health and outcomes of needs assessments. This information is held in written form and/or in digital form.

The types of information that will be collected by HCRG Care Group Ltd when you are using our online service are:

Name
Postcode (to receive your test, if requested)
Gender
DOB
Translator
Contact Preference Details
Learning Disability/Impairment
Sexual Orientation

Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you have received within any NHS organisation (e.g. information from Hospitals, GP surgeries etc.) These records help to provide you with the best possible healthcare and help us to protect your safety.

In carrying out this role we will collect information about you which helps us respond to your queries or secure specialist services. We may collect the information from you, or other trusted parties involved in your care.

We will collect basic ‘personal data’ about you once you register with us such as:

This may include:

Details about you, such as your address, NHS number, next of kin and/or carer information

In addition to the above we may also hold more sensitive personal data, called ‘special category data’ which could include:

Any contact the service has had with you, such as appointments, clinic visits, emergency appointments, etc.
Notes and reports about your health and safeguarding
Details about your treatment and care
Results of investigations, such as laboratory tests, x-rays, etc.
Relevant information from other health professionals, relatives or those who care for you

How we use your information

Your records are used to:

Provide information to make health decisions made by care professional with and for you
To register you on our clinical system and book an appointment,
To send appointment reminders with your permission, to the mobile number you supplied
You will also have the option to add your appointment directly in to your mobile calendar at the end of the online booking process.
To post home sampling kits with your consent
Make sure your care is safe and effective
To issue treatments or supply contraception

Without your permission we will not:

Inform your GP or healthcare professional about the fact that you had the test or your results*
Refer you to other specialist services
Share your information

* The only time we may need to discuss your results with a GP or healthcare professional is if we are unable to contact you by your chosen method of communication and your test is positive. This is to help protect your health.

We may also use, or share, your information for the following purposes:

Looking after the health of the public
Making sure that our services can meet patient needs in the future
Preparing statistics on NHS performance and activity
Investigating concerns, complaints, or legal claims
Helping colleagues review the care they provide to make sure it is of the highest standards
Training and educating staff
For research purposes (we will always ask your consent for this)

Invoice validation

Invoice validation enables us to identify which CCG is responsible for paying for your treatment. Section 251 of the NHS Act 2006 provides a statutory legal basis to process data for invoice validation purposes and uses your NHS number to validate payment. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly. NHS Digital – how we use your information for invoice validation

SMS messages – in clinic tests

We will ask you to update your contact preferences when you book an appointment or visit the service. This is to understand how you wish to be contacted about your results. If you need to update your contact preferences or opt out of receiving SMS messages, please contact your local service. Some of our services have a dedicated results line for you to contact. If this service is available in your area, details will be provided when you take your test. If you choose to be informed by SMS text, you will receive one of the SMS messages in the link below depending on your results.

SMS messages – in clinic tests

SMS messages – recalls

Sometimes during your consultation, the need for further testing or follow up appointment is identified. If this is required, you will receive one of the SMS messages in the link below depending on your results:

SMS messages – recalls

SMS messages – postal testing

When you order a postal kit on our website, we will send out your results via SMS text. If you do not wish to be contacted via SMS text, please visit your local service to have a test. If your contact details have changed following completion of your postal order, please contact your local service for support. If you complete a postal test, you will receive one of the SMS messages in the link below depending on your results

SMS messages – postal testing

SMS text reminder service

When you book an appointment or visit the service we will also ask if you wish to receive SMS reminders for your appointment. If you wish to change your preferences, you can do so by contacting your local service or by logging into your online account.

The Friends and Family Test (FFT)

NHS organisations including HCRG Care Ltd are required to use the Friends & Family Text (FFT) to capture feedback and submit response data to NHS England each month. Patients can access the data which will then help them make informed choices about their future care. We collect feedback from several different channels, including SMS text messaging, online – via our HCRG Care Group website and paper questionnaires/feedback forms. All personal information collected is processed and stored in accordance with the Data Protection Act 2018 / UK GDPR 2016.

Contacting our services via email

If you contact our services via email, this method of communication will not be secure. If you choose to use this method, you are agreeing to transferring your information in this way.

Lilie touch self-check-in

We have installed Lille Touch self-check-in screens at some of our services. The information we collect on Lilie Touch is used to maintain the demographic information on your patient record. All the information you submit is secure.

Services we provide

Oldham Sexual Health
Rochdale Sexual Health
Bury Sexual Health
Cheshire West and Chester Sexual Health
Teesside Sexual Health
Northern Lincolnshire Sexual Health

Oldham Sexual Health

We provide free and confidential sexual health services in Oldham including information and advice on all types of contraception and STI testing and treatment. Our service is confidential, non-judgmental and for people of all ages, genders, and orientations.

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 303 8565.

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/oldham/

Rochdale Sexual Health

We provide free and confidential sexual health services in Rochdale, Middleton, Heywood and Littleborough. This includes information and advice on all types of contraception, STI testing and treatment. Our service is confidential, non-judgemental and for people of all ages, genders, and orientations.

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 303 8565.

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/rochdale/

Bury Sexual Health

We provide free and confidential sexual health services in Bury, Radcliffe and nearby areas. This includes information and advice on all types of contraception and STI testing and treatment. Our service is confidential, non-judgemental and for people of all ages, genders, and orientations.

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 3038565.

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/bury/

Cheshire West and Chester Sexual Health

We provide free and confidential sexual health services in Cheshire West and Chester including Winsford, Blacon and Ellesmere Port. Our services include providing free information and advice on all types of contraception and STI testing and treatment. Our service is confidential, non-judgemental and for people of all ages, genders, and orientations.

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 247 0020

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/cheshire-and-chester/

Teesside Sexual Health

We provide free and confidential sexual health services across Teesside with clinics in Stockton on Tees, Redcar, Middlesbrough, and Hartlepool. Our services include information and advice on all types of contraception and STI testing and treatment. Our service is confidential, non-judgemental and for people of all ages, genders, and orientations. Our sexual health clinics can be found in Middlesborough, Redcar, Hartlepool, Stockton-on-Tees.

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 3301122.

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/teesside/

Northern Lincolnshire Integrated Sexual Health

We provide free and confidential sexual health services in North and North East Lincolnshire, with clinics in Grimsby and Scunthorpe. This includes information and advice on all types of contraception and STI testing and treatment. Our service is confidential, non-judgemental and for people of all ages, genders, and orientations.

Northern Lincolnshire and Goole NHS Foundation Trust are now providing the pathology services on behalf of HCRG Care Group and will be capturing limited information from you to support the management of your test and results. All information will be kept securely and will be managed with strict confidence. For more information on how North Lincs and Goole NHS FT manage your data please visit their website: https://www.nlg.nhs.uk/

Everyone is welcome and you don’t need to see a GP first. You can attend one of our walk-in clinics, book an appointment online 24/7 or speak to us on 0300 330 1122.

More information can be found on their website: https://www.thesexualhealthhub.co.uk/services-near-you/north-east-lincolnshire/

Who we share your information with

We may also share your information for the provision of your care or for another legal obligation with the following organisations and partners:

NHS Trusts/Foundations
GP’s
Ambulance Trusts
Clinical Commissioning Groups
NHS England (NHSE) and NHS Digital (NHSD)
Local Authorities
Police and Judicial Services
HCRG Care Group Support teams
Marie Stopes
Acculabs for management of samples for all services.
British Association for Sexual Health and HIV (BASHH)
Family Planning Association (Contraception)
British Pregnancy Advisory Service (BPA)
Terrence Higgins Trust
Brook
Early Break
SH24 for emergency hormonal contraception SH24 Privacy Policy
Pharmacies
SXT – Partner Notification Tool SXT Privacy Policy
Idox Health
Chat Health – SMS messaging application
Accurx – video consultation platform

When we share your information:

We may share information about you for the following purposes;

To support your health and care arrangements including referrals, pathology and other results
If it is in your best interests
To manage incidents that you have been involved in
To deal with complaints and investigations
Requests for information from official authorities or your representatives
Your records if the service is transferring to us under contract or if you are moving out of area
The prevention and detection of crime
Funding requests or payments
Legal advice or proceedings
Responding to legal requests and court orders
Public health notifications
Partner Notification to protect partners and the public
To gather feedback through the friends and family test

Our partners and other recipients:

We work in partnership with commissioners, other health and care providers such as primary care services, local authorities, NHS trusts, pathology providers etc.
Prison service relating to prison healthcare
Local Safeguarding Boards
Regulators
We may use trusted providers to host our IT, archiving, email and texting services and surveys
We may use corporate teams within the HCRG Care Group who provide ‘back office’ support on behalf of services within our group such as communications and marketing, information governance, clinical governance and IMT.

What is our legal basis for processing your information?

For the Sexual Health services to legally process your information a ‘lawful basis’ needs to be identified. Data protection law recognises the difference between personal data and that of a more sensitive nature known as special categories of data; such as racial or ethnic origin, political opinions, religious beliefs, trade union activities and physical or mental health.

Our Legal basis for processing your personal information falls under one of the following legal bases:

Providing and managing health and social cares services to our patient’s service users and clients
Performance of a task carried out in the public interest or in the exercise of official authority
Necessary for a legal obligation such as responding to a request from a coroner
Necessary for reasons in the area of public health such as in the event of an outbreak of a disease

Our Legal basis for processing special categories “sensitive” personal information falls under one of the following legal bases:

We need to use the data to provide medical diagnosis, health and social care treatment services to you
Social protection law for safeguarding purposes

How long do we keep your information

We will keep your healthcare records in accordance with the national guidance: Records Management Code of Practice for Health and Social Care 2021, after which records, and confidential information are securely destroyed in line with this code of practice. Please click on the link for the retention periods of the various medical records we hold. Records retention schedules

CCTV

We have installed CCTV systems in our premises for the purposes of public and staff safety and crime and prevention and detection. In all locations, signs are displayed notifying you that CCTV is in operation and providing details of who to contact for further information.

Images captured by CCTV will be deleted 30 days after the CCTV footage was taken. However, on occasions there may need to be a need to keep images for longer, for example where a crime is being investigated.

You have the right to see CCTV images of yourself and be provided with a copy of the images. We will only disclose images to authorised bodies such as the police, who intend to use it for the purposes stated above. You will find our contact details at the beginning of this privacy notice If you wish to request a copy of the CCTV recording, please contact your local service supplier.

How we keep your information safe

We take the security of your personal data very seriously. We have operational policies and procedures in place to protect your information whether it is in hard copy or electronic format. We protect your information in the following ways:

Training:

Staff are trained to understand their duty of confidentiality and their responsibilities regarding the security of patient data; this includes their mandatory annual training in data security and confidentiality to demonstrate they understand and are complying with policies on confidentiality.

Access controls:

Any member of staff who has access to personal confidential data will have a username and unique password. This will reduce the risk of unauthorised access to your personal data and all access is auditable.

Technical measures:

We complete due diligence and impose contractual obligations on our trusted providers and persons working under our instruction.

We have a duty to:

Maintain full and accurate records of the care we provide to you.
Keep records about you confidential and secure.
Provide information in a format that is accessible to you.

Everyone working for our organisation is subject to the Common Law Duty of Confidence. Information provided in confidence will only be used for the purposes advised with consent given by the patient, unless there are other circumstances covered by the law.

The NHS Digital Code of Practice on Confidential Information applies to all NHS staff and they are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared. All our staff are expected to make sure information is kept confidential and receive regular training on how to do this.

The health records we use will be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Your records are backed up securely in line with NHS standard procedures. We ensure that the information we hold is kept in secure locations, is protected by appropriate security and access is restricted to authorised personnel.

We also make sure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed.

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

Data Protection Act 2018
UK General Data Protection Regulation
Human Rights Act
Common Law Duty of Confidentiality
NHS Codes of Confidentiality and Information Security
Health and Social Care Act 2015
And all applicable legislation

We maintain our duty of confidentiality to you at all times. We will only ever use or pass on information about you if we reasonably believe that others involved in your care have a genuine need for it.

We will not disclose your information to any third party without an appropriate legal basis and there are exceptional circumstances (such as a risk of serious harm to yourself or others) or where the law requires information to be passed on.

When booking appointments online, HCRG Care Group Ltd. will not share your information (other than for direct care) without your permission unless there are exceptional circumstances, such as where the health and safety of others is at risk, or where we are legally obliged to pass on information. Like all health providers,

we reserve the right to disclose your personal information to comply with applicable laws and government or regulatory bodies’ lawful requests for information.

Any other agency receiving information from us is also under a legal duty to keep your information confidential.

When ordering a home sampling kit for sexually transmitted infections, your information will be shared with a third party provider, namely Acculabs Diagnostics UK LTD. Acculabs will send the home sampling kits to you, and when returned, carry out the testing and return results to HCRG Care Group Ltd. via a secure link. This information will not be processed further by Acculabs, but will be stored on their IT servers within the UK. HCRG Care Group Ltd. and Acculabs have comprehensive agreements in place to ensure the secure and confidential processing on your information.

Without your permission we will not:

inform your GP or healthcare professional about the fact that you have had the test or your results*
refer you to other specialist services
share your information

What if you’re under 16?

Under 16’s have the same rights to confidentiality as anyone else and will not be treated any differently. However, if you are under 13, we are likely to be more worried about you having sex.

What if you test positive for a sexually transmitted infection?

Confidentiality is no different if you test positive unless we’re completely unable to contact you to inform you of your infection.

In some instances, we may not be able to contact you due to incorrect contact details. It is important that you regularly inform us of any changes to your contact details, especially new mobile phone numbers. We always recommend if you have not received your results within 2 weeks of your test you contact your local clinic.

How the NHS and care services use your information

Sexual health services are one of many organisations working in the health and care system to improve care for patients and the public.

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service.

Collecting this information helps to ensure you get the best possible care and treatment. The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

improving the quality and standards of care provided
research into the development of new treatments
preventing illness and diseases
monitoring safety
planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

Social media and our website

When you contact us through social media such as Facebook and Twitter, we hold your information and reason for contact in our social media management portal to enable us to easily access and manage our engagement with you. This may result in us sharing your information with other parties within the HCRG Care Group e.g. individuals involved in your care, managing your complaint etc.

When you visit our websites we collect standard internet log information and details of visitor behaviours. This is statistical data only which we collect in order to find out the numbers of visitors to the site and the pages visited. The information is collected in such a way that does not identify individuals and we do not make any attempts to identify visitors this way.

Where we do collect personal information on our website, this will be made obvious to you through the relevant pages.

Contract end provisions

In the event of the contract with the service and HCRG Care Group Ltd coming to an end, all relevant documentation and records will be transferred to the new provider (s).

The transfer of records will be conducted in accordance with the current UK Data Protection Law.

Changes to our privacy notice

We will update this privacy notice from time to time to reflect any changes to our ways of working. Please contact our Data Protection Officer if you would like more information.

Date privacy notice last updated: Dec 2023