Taurus Healthcare Logo Taurus Healthcare

Privacy Notice

Taurus Healthcare Privacy Notice

Data Protection Privacy Notice for Patients

Introduction:

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.

This privacy notice applies to personal information processed by or on behalf of the Taurus Healthcare.

This Notice explains

  • Who we are, how we use your information and our Data Protection Officer
  • What kinds of personal information about you do we process?
  • What are the legal grounds for our processing of your personal information (including when we share it with others)?
  • What should you do if your personal information changes?
  • For how long your personal information is retained by us?
  • What are your rights under data protection laws?

The General Data Protection Regulation (GDPR) became law on 24th May 2016. This is a single EU-wide regulation on the protection of confidential and sensitive information. It enters into force in the UK on the 25th May 2018, repealing the Data Protection Act (1998).

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"), and the Data Protection Act 2018 (currently in Bill format before Parliament) the business responsible for your personal data is Taurus Healthcare Ltd.

This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights

How we use your information and the law.

Taurus Healthcare Ltd will be what’s known as the ‘Controller’ of the personal data you provide to us.

We collect basic personal data about you which does not include any special types of information or location-based information. This does however include name, address, contact details such as email and mobile number etc.

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sex during the services we provide to you and or linked to your healthcare through other health providers or third parties.

Why do we need your information?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which Taurus Healthcare hold about you may include the following information;

• Details about you, such as your address, carer, legal representative, emergency contact details

• Any contact Taurus Healthcare has had with you, such as appointments, clinic visits, emergency appointments, etc.

• Notes and reports about your health

• Details about your treatment and care

• Results of investigations such as laboratory tests, x-rays etc

• Relevant information from other health professionals, relatives or those who care for you

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the business for clinical audit to monitor the quality of the service provided.

How do we lawfully use your data?

We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services, under the General Data Protection Regulation we will be lawfully using your information in accordance with: -

Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

Risk Stratification

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts, GP practices and from Taurus Healthcare. A risk score is then arrived at through an analysis of your de-identified information. It is only provided back to the data controller in an identifiable form. Risk stratification enables us to focus on preventing ill health and not just the treatment of sickness. If necessary, we may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way.

Medicines Management

Taurus Healthcare may conduct Medicines Management Reviews of medications prescribed to patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

Safeguarding

We are dedicated to ensuring that the principles and duties of safeguarding adults and children are holistically, consistently and conscientiously applied with the wellbeing of all, at the heart of what we do. 

Our legal basis for processing For the General Data Protection Regulation (GDPR) purposes is: -

            Article 6(1)(e) ‘…exercise of official authority…’.

For the processing of special categories data, the basis is: -

Article 9(2)(b) – ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’

Categories of personal data

The data collected by us in the event of a safeguarding situation will be as much personal information as is necessary or possible to obtain in order to handle the situation. In addition to some basic demographic and contact details, we will also process details of what the safeguarding concern is. This is likely to be special category information (such as health information).

Sources of the data

We will either receive or collect information when someone contacts the organisation with safeguarding concerns or we believe there may be safeguarding concerns and make enquiries to relevant providers.

Recipients of personal data

The information is used by Taurus Healthcare when handling a safeguarding incident or concern. We may share information accordingly to ensure duty of care and investigation as required with other partners such as local authorities, the police or healthcare professionals (i.e. their GP or mental health team).

How do we maintain the confidentiality of your records?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

  • Data Protection Act 2018
  • The General Data Protection Regulations 2016
  • Human Rights Act 1998
  • Common Law Duty of Confidentiality
  • Health and Social Care Act 2012
  • NHS Codes of Confidentiality, Information Security and Records Management
  • Information: To Share or Not to Share Review

 Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles.

Our policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors engaged by us are asked to sign a confidentiality agreement. We will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for Taurus Healthcare Ltd an appropriate contract (art 24-28) will be established for the processing of your information. 

In Certain circumstances you may have the right to withdraw your consent to the processing of data. Please contact the Data Protection Officer in writing if you wish to withdraw your consent. In some circumstances we may need to store your data after your consent has been withdrawn to comply with a legislative requirement.

Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – Taurus Healthcare will always gain your consent before releasing the information for this purpose in an identifiable format.  In some circumstances you can Opt-out of Taurus Healthcare sharing any of your information for research purposes.

With your consent we would also like to use your information to

We would however like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions were authorised research facilities would like you to take part on innovations, research, improving services or identifying trends.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place.
This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the DPO as below.

Where do we store your information Electronically?

All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance this information may be located on servers within the European Union.

No 3rd parties have access to your personal data unless the law allows them to do so and appropriate safeguards have been put in place. We have a Data Protection regime in place to oversee the effective and secure processing of your personal and or special category (sensitive, confidential) data.

Who are our partner organisations?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;

  • NHS Trusts / Foundation Trusts
  • GP’s
  • NHS Commissioning Support Units
  • Independent Contractors such as dentists, opticians, pharmacists
  • Private Sector Providers
  • Voluntary Sector Providers
  • Ambulance Trusts
  • Clinical Commissioning Groups
  • Social Care Services
  • NHS England (NHSE) and NHS Digital (NHSD)
  • Multi Agency Safeguarding Hub (MASH)
  • Local Authorities
  • Education Services
  • Fire and Rescue Services
  • Police & Judicial Services
  • Voluntary Sector Providers
  • Private Sector Providers
  • Other ‘data processors’ which you will be informed of

You will be informed who your data will be shared with and in some cases asked for consent for this to happen when this is required.

Computer System

Taurus Healthcare operates a Clinical Computer System on which NHS Staff record information securely. This information can then be shared with other clinicians so that everyone caring for you is fully informed about your medical history, including allergies and medication.

To provide around the clock safe care, unless you have asked us not to, we will make information available to trusted organisations. Wherever possible, their staff will ask your consent before your information is viewed.

 We consider patient consent as being the key factor in dealing with your health information.

Shared Care Records

To support your care and improve the sharing of relevant information to our partner organisations when they are involved in looking after you, we will share information to other systems. The general principle is that information is passed to these systems unless you request this does not happen, but that system users should ask for your consent before viewing your record.  

We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by Taurus Healthcare are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor for Taurus Healthcare Ltd an appropriate contract (art 24-28) will be established for the processing of your information.

Herefordshire One Record

Patients in Hereford are able to benefit from the sharing of information to better manage their care via the Herefordshire One Record.

This includes sharing; contact details, diagnosis, medications, allergies, test results, referrals & letters and care plans between health professionals in Hereford.

GP information is shared with:

· Wye Valley NHS Trust (including community services)

· St Michaels Hospice

· 2Gether NHS Foundation Trust

· Taurus Healthcare Ltd (Federation of GP’s)

Further information about Herefordshire One Record can be found by going to the following link
https://www.herefordshireccg.nhs.uk/your-services/herefordshire-one-record

Sharing your information without consent

We will normally ask you for your consent, but there are times when we may be required by law to share your information without your consent, for example:

  • where there is a serious risk of harm or abuse to you or other people;
  • where a serious crime, such as assault, is being investigated or where it could be prevented;
  • notification of new births;
  • where we encounter infectious diseases that may endanger the safety of others, such as meningitis or measles (but not HIV/AIDS);
  • where a formal court order has been issued;
  • where there is a legal requirement, for example if you had committed a Road Traffic Offence.

How long will we store your information?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements.

More information on records retention can be found online at (https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016)

How can you access, amend move the personal data that you have given to us?

Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.

Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example for a research project), or consent to market to you, you may withdraw your consent at any time.

Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to "erase" your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will Delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data are collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so.

Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this with a GP to GP data transfer and transfer of your hard copy notes.

Access to your personal information

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information Taurus Healthcare holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

• Your request should be made to Taurus Healthcare – for information from the hospital you should write direct to them

• There is no charge to have a copy of the information held about you

• We are required to respond to you within one month

• You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.

What should you do if your personal information changes?

You should tell us so that we can update our records please contact us as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), Taurus Healthcare will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.

Objections / Complaints

Should you have any concerns about how your information is managed, please contact the Quality Department or the Data Protection Officer as below.

Quality Department
Suite 1, Berrows Business Centre,
Bath Street,
Hereford,
HR1 2HE

Data Protection Officer:

Taurus Healthcare Ltd Data Protection Officer is Paul Couldrey of PCIG Consulting Limited. Any queries regarding Data Protection issues should be addressed to him at: -

Email:   Couldrey@me.com

Postal: PCIG Consulting Limited

            7 Westacre Drive

            Quarry Bank

            Dudley

            West Midlands

            DY5 2EE

If you are still unhappy following a review by the Quality Department, you have a right to lodge a complaint with a supervisory authority: You have a right to complain to the UK supervisory Authority as below.

Information Commissioner:

Wycliffe house

Water Lane

Wilmslow

Cheshire

SK9 5AF

Tel: 01625 545745

https://ico.org.uk/

If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have any concerns about how your data is shared, then please contact the Data Protection Officer.

If you would like to know more about your rights in respect of the personal data we hold about you, please contact the Data Protection Officer as below.

Changes:

It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Data Protection Officer.

 

Staff Privacy Notice

Taurus Healthcare is committed to protecting and safeguarding your data privacy rights.

The General Data Protection Regulations (GDPR) became law on the 24th May 2016. This is a single EU-wide regulation on the protection of confidential and sensitive information. It enters into force in the UK on the 25th May 2018, repealing the Data Protection Act (1998).

 

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the "GDPR"), and the Data Protection Act 2018 (currently in Bill format before Parliament) the company responsible for your personal data is Taurus Healthcare.

This privacy notice describes how we collect, use and process your personal information before, during and after your working relationship with us, in accordance with data protection law, including the General Data Protection Regulation (GDPR). It applies to all prospective employees, employees, workers and contractors.

Taurus Healthcare is a “data controller”. This means that we are responsible for deciding how we hold and use personal information about you. We are required under data protection legislation to notify you of the information contained in this privacy notice.

This notice applies to applicants, current and former employees, workers and contractors. This notice does not form part of any contract of employment or other contract to provide services. This notice can be updated at any time and we will inform you if this occurs.

It is important that you read this notice, together with any other privacy notice that is provided on specific occasions when we are collecting or processing personal information about you, so that you are aware of how and why we are using such information.

Data protection principles

The data protection law says that the personal information we hold about you must be:

  • used lawfully, fairly and in a transparent way
  • collected only for valid purposes that we have clearly explained to you and not used in any way that is incompatible with those purposes
  • relevant to the purposes we have told you about and limited only to those purposes
  • accurate and kept up to date
  • kept only as long as necessary for the purposes we have told you about
  • kept securely

Information we hold about you

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).

We collect, store, and use the following categories of personal information about you.

 

Job Applications

  • personal contact details such as name, title, addresses, telephone numbers, and personal email addresses.
  • copy of driving licence, passport, birth and marriage certificates, decree absolute
  • evidence of your right to work in the UK/immigration status
  • diversity monitoring information such as your race or ethnicity, religious beliefs, sexual orientation and political opinions
  • information about criminal convictions/allegations and offences as part of Baseline
  • Qualifications
  • Doctors

When you are employed by us

  • Dates of birth, marriage and divorce
  • Gender
  • Marital status and dependants
  • Next of kin, emergency contact and death benefit nominee(s) information
  • National Insurance number
  • Bank account details, payroll records and tax status information
  • Salary, annual leave, pension and benefits information (including state and occupational pension retirement age, and current/previous pension scheme details)
  • Wage-related information including allowances, overtime payments, bonuses and miscellaneous payments
  • Start date and leaving date
  • Location of employment or workplace
  • Recruitment information (including copies of right to work documentation, references, qualifications  and other information included in a CV or cover letter or as part of the application process)
  • Three years employment history
  • full employment records employment (including contract, terms and conditions, grade, job titles, work history, working hours, promotion, absences, attendances, training records and professional memberships)
  • Compensation history
  • Performance and appraisal information
  • Talent and appraisal information
  • Disciplinary, investigation, whistleblowing and grievance information
  • Secondary employment and volunteering information, including information on staff who volunteer with HR improvement initiatives
  • Information on corporate role you hold within the organisation
  • Information on learning and development, training, and professional development undertaken
  • Training Agreement
  • Information about your health, including any medical condition, health and sickness records

How is your personal information collected?

We collect personal information about prospective employees, employees, workers and contractors through the application and recruitment process, either directly from candidates or sometimes from a third party such as an employment agency. These third parties include:

  • Former employers
  • Disclosure and Barring Service (DBS)
  • Pensions administrators
  • Medical and occupational health professionals
  • Professionals who advise Taurus Healthcare generally and/or in relation to any employment issues

The legal basis for collecting, using and holding your data

Job Applications

Processing is necessary:

  • in order to take steps at your request prior to entering into a contract. This concerns receiving your application for employment or pre-employment checks
  • to comply with a legal obligation placed on us: checking you are legally entitled to work in the UK
  • for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. In this case that is carrying out National Security vetting for required roles

When you are employed by us

It is necessary for the performance of a contract to which you are a party. This concerns:

  • paying you and, if you are an employee, deducting tax and National Insurance contributions

Providing employment-related benefits to you including:

  • Occupational Sick, Adoption, Maternity, Paternity, Shared Parental and Annual leave and pay (including payslips)
  • pension
  • advances of salary
  • season ticket loans
  • childcare vouchers
  • reward vouchers and bonuses
  • liaising with your pension provider, providing information about changes to your employment such as promotions, changing in working hours
  • general administration of the contract we have entered into with you
  • conducting performance and talent reviews, managing performance and determining performance requirements
  • managing sickness absence
  • making decisions about salary reviews and compensation
  • assessing qualifications for a particular job or task, including decisions about promotions
  • gathering evidence and any other steps relating to possible grievance, investigations, whistleblowing or disciplinary matters and associated hearings
  • making decisions about your continued employment or engagement
  • making arrangements for the termination of our working relationship
  • providing you with education, training and development requirements
  • processing bank cards and ePurchasing Card Solution (ePCS) applications
  • corporate credit card management
  • stationery order processing
  • processing taxi bookings, business travels and hotel accommodation

Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller. This concerns providing information to enable overall management of the Civil Service, monitoring equality of opportunity in line with our Public Sector Equality Duty, transparency duties, and to prevent fraud.

It is necessary to comply with a legal obligation placed on us as the data controller. This concerns providing tax and salary information to HMRC, and dealing with legal disputes involving you, or other employees, workers and contractors, including accidents at work.

When you cease to be employed by us

It is necessary for the performance of a contract to which you are a party. This concerns continuing obligations to pay pensions and death benefit, and processing exits from the organisation including redundancy and ill health retirement.

The legal basis for collecting, using and holding sensitive and criminal convictions personal information

Sensitive personal data is personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person’s sex life or sexual orientation.

When you apply for a job with us

Where it is necessary for reasons of substantial public interest for the exercise of our functions. This concerns information about criminal convictions/allegations and offences to conduct baseline security clearance checks.

When you are employed by us

Where it relates to our, or your, employment-related legal rights, including processing health data to make reasonable adjustments. This also concerns:

  • information relating to leaves of absence; this can include sickness absence or family related leave, to comply with employment and other laws
  • trade union membership information to pay trade union premiums, register the status of a protected employee and to comply with employment law obligations
  • where it is needed to assess your working capacity on health grounds, subject to appropriate confidentiality safeguards

Where it is necessary for the purposes of identifying or keeping under review the existence or absence of equality of opportunity or treatment between groups of people. This is why we collect information about your race or national or ethnic origin, religious beliefs, or your sexual orientation, to ensure meaningful equal opportunity monitoring and reporting.

Where it is necessary for reasons of substantial public interest for the exercise of our functions. This concerns information about criminal convictions/allegations that disclose to us.

It is necessary for the establishment, exercise or defence of legal claims, for example to deal with employment tribunal cases.

Do we need your consent?

We do not need your consent if we use your personal information for one of the other reasons outlined above. Where we do ask for your consent in future, you will be given information at the same time about what we intend to do with it (with your permission).

Data sharing

We will in some circumstances have to share your data with third parties, including third party service providers, external auditors, internal auditors and other Civil Service bodies.

We require third parties to respect the security of your data and to treat it in accordance with the law.

We will in some circumstances transfer your personal information outside the EU.

If we do, you can expect a similar degree of protection in respect of your personal information.

Why might you share my personal information with third parties?

We will share your personal information with third parties where required by law, where it is necessary to administer the working relationship with you; where it is in the public interest to do so or where it is necessary for the performance of our functions as a Government Department or a function of the Crown. This will, in some circumstances, involve sharing special categories of personal data and, where relevant, data about criminal convictions/allegations.

Which third-party service providers process my personal information?

“Third parties” includes third-party service providers (including contractors and designated agents) and other entities within the Civil Service. The following activities are carried out by our third-party service providers:

  • payroll (Shared Service Connected Ltd)
  • pensions administration (My CSP)
  • benefits provisions (Edenred)
  • Overseas Healthcare (Healix)
  • recruitment administration (WCN)
  • Occupational Health provisions (OH Assist)
  • Workplace Adjustment provisions (Civil Service Workplace Adjustments Team)
  • casework provisions (Ministry of Justice Casework)
  • taxi (Goldstar Taxis and Greater London Taxi Hire Ltd), travel (Enterprise Rent-A-Car UK Limited) and accommodation (Calder Conferences Ltd and Clarity) booking
  • statutory duties in respect of compliance, complaints and investigation (Civil Service Commission), advice under the Business Appointment Rules (Advisory Committee on Business Appointments), and casework in compliance with the Government Code for Public Appointments (Office of the Commissioner for Public Appointments)

How secure is my information with third-party service providers?

All our third-party service providers are required to take appropriate security measures to protect your personal information in line with our policies. We do not allow our third-party service providers to use your personal data for their own purposes. We only permit them to process your personal data for specified purposes and in accordance with our instructions.

When might you share my personal information with other organisations within the Civil Service?

We will share your personal information with other Civil Service organisations as part of our regular reporting activities on departmental performance, in the context of a business reorganisation or restructuring exercise, for system maintenance support and hosting of data; business planning/talent management initiatives, succession planning, publication of transparency data, statistical analysis; and general management and functioning of the Civil Service, including the development and continued work of the Civil Service Professions. Personal data is also shared with the Office for National Statistics, mainly for statistical purposes.

What about other third parties?

If required, we will need to share your personal information with a regulator or National Audit Office, or to otherwise comply with the law.

Transferring information outside the EU

As your personal data is stored on our IT infrastructure, and shared with our data processors, it may be transferred and stored securely outside the European Economic Area. Where that is the case it will be subject to equivalent legal protection through the use of Model Contract Clauses.

Some of your personal data may be processed offshore by our services provider, Shared Services Connected Limited (SSCL). SSCL use Centres of Excellence in the UK and in India to manage our back office services. Your personal data receives the same level of protection when processed offshore as it does onshore. This protection is delivered by the use of standard data protection clauses adopted by the European Commission, and used in their entirety in the contract with SSCL. A copy of the model contract clauses are published on the Commission website. More information on the offshoring process can be found on the Cabinet Office Intranet

Data security

We have put in place measures to protect the security of your information. Details of these measures are available on the intranet.

Third parties will only process your personal information on our instructions and where they have agreed to treat the information confidentially and to keep it secure.

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a business need to know.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

Data retention

How long will you use my information for?

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements. Details of retention periods for different aspects of your personal information are available in our data retention policy. Our data retention policy can be found within our Cabinet Office Employee Document Retention Schedule.

To determine the appropriate retention period for personal data, we consider the amount, nature, and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data and whether we can achieve those purposes through other means, and the applicable legal requirements.

In some circumstances we will anonymise your personal information so that it can no longer be associated with you, in which case we will use such information without further notice to you. Once you are no longer an employee, worker or contractor of the company we will retain and securely destroy your personal information in accordance with our data retention policy. Our data retention policy can be found within our Cabinet Office Employee Document Retention Schedule.

Rights of access, correction, erasure, and restriction

Your duty to inform us of changes

It is important that the personal information we hold about you is accurate and current. Please keep us informed if your personal information changes during your working relationship with us.

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

  • request access to your personal information (commonly known as a “data subject access request”). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it. It also allows you to request an electronic copy of any data you have provided in a structured, commonly used and machine-readable format.
  • request correction of the personal information that we hold about you. This enables you to have any incomplete or inaccurate information we hold about you corrected.
  • request erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your personal information where you have exercised your right to object to processing (see below).
  • object to processing of your personal information where we are relying on the legal basis that we are carrying out our public task (see ‘legal bases’ above)
  • you also have the right to object where we are processing your personal information for direct marketing purposes (although we do not use it for that purpose)
  • request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact the HR Information Management mailbox at hr-im@cabinetoffice.gov.uk.

No fee usually required

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we are allowed under the law to charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we can refuse to comply with the request in such circumstances.

What we need from you

We sometimes need to request specific information from you to help us confirm your identity and ensure your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal information is not disclosed to any person who has no right to receive it.

Data Protection Officer

The Data Protection Officer provides independent advice and monitoring of Cabinet Office’s use of personal information. If you have any concerns about how your personal data has been handled, please contact the DPO.

The contact details for the data controller’s Data Protection Officer are:

Stephen Jones, Data Protection Officer
Cabinet Office
70 Whitehall
London
SW1A 2AS

Email: dpo@cabinetoffice.gov.uk

Complaints

If you consider that your personal data has been misused or mishandled, you may make a complaint to the Information Commissioner, who is an independent regulator. The Information Commissioner can be contacted at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Email: casework@ico.org.uk

Any complaint to the Information Commissioner is without prejudice to your right to seek redress through the courts.

Data Controller

The data controller for your personal data is the Cabinet Office. If you have any questions about this privacy notice, please contact Cabinet Office HR at hrim@cabinetoffice.gov.uk.

Changes to this privacy notice

We reserve the right to update this privacy notice at any time, and we will provide you with a new privacy notice when we make any substantial updates. We will also notify you in other ways from time to time about the processing of your personal information.

COVID-19 Privacy Notice

Due to the unprecedented challenges that the NHS and we, Taurus Healthcare Ltd face due to the worldwide COVID-19 pandemic, there is a greater need for public bodies to require additional collection and sharing of personal data to protect against serious threats to public health. 

 

In order to look after your healthcare needs in the most efficient way we, Taurus Healthcare Ltd may therefore need to share your personal information, including medical records, with staff from other GP Practices including Practices within our Primary Care Network, as well as other health organisations (i.e. Clinical Commissioning Groups, Commissioning Support Units, Local authorities etc.) and bodies engaged in disease surveillance for the purposes of research, protecting public health, providing healthcare services to the public and monitoring and managing the Covid-19 outbreak and incidents of exposure.

 

The Secretary of State has served notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) to require organisations to process confidential patient information in the manner set out below for purposes set out in Regulation 3(1) of COPI.

 

PURPOSE OF THIS NOTICE

The purpose of this Notice is to require organisations such as Taurus Healthcare Ltd to process confidential patient information for the purposes set out in Regulation 3(1) of COPI to support the Secretary of State’s response to Covid-19 (Covid-19 Purpose). “Processing” for these purposes is defined in Regulation 3(2) and includes dissemination of confidential patient information to persons and organisations permitted to process confidential patient information under Regulation 3(3) of COPI.

 

This Notice is necessary to require organisations such as Taurus Healthcare Ltd to lawfully and efficiently process confidential patient information as set out in Regulation 3(2) of COPI for purposes defined in regulation 3(1), for the purposes of research, protecting public health, providing healthcare services to the public and monitoring and managing the Covid-19 outbreak and incidents of exposure.

REQUIREMENT TO PROCESS CONFIDENTIAL PATIENT INFORMATION

The Secretary of State has served notice to recipients under Regulation 3(4) that requires Taurus Healthcare Ltd to process confidential patient information, including disseminating to a person or organisation permitted to process confidential patient information under Regulation 3(3) of COPI.

 

Taurus Healthcare Ltd is only required to process such confidential patient information:

  • where the confidential patient information to be processed is required for a Covid-19 Purpose and will be processed solely for that Covid-19 Purpose in accordance with Regulation 7 of COPI
  • from 20th March 2020 until 31 March 2021.

 

COVID-19 PURPOSE

 

A Covid-19 Purpose includes but is not limited to the following:

  • understanding Covid-19 and risks to public health, trends in Covid-19 and such risks, and controlling and preventing the spread of Covid-19 and such risks
  • identifying and understanding information about patients or potential patients with or at risk of Covid-19, information about incidents of patient exposure to Covid-19 and the management of patients with or at risk of Covid-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from Covid-19
  • understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of Covid-19 and the availability and capacity of those services or that care
  • monitoring and managing the response to Covid-19 by health and social care bodies and the Government including providing information to the public about Covid-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services
  • delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with Covid-19, including the provision of information, fit notes and the provision of health care and adult social care services
  • research and planning in relation to Covid-19.

 

RECORDING OF PROCESSING

A record will be kept by Taurus Healthcare Ltd of all data processed under this Notice.

SENDING PUBLIC HEALTH MESSAGES

Data protection and electronic communication laws will not stop Taurus Healthcare Ltd from sending public health messages to you, either by phone, text or email as these messages are not direct marketing.

DIGITAL CONSULTATIONS

It may also be necessary, where the latest technology allows Taurus Healthcare Ltd to do so, to use your information and health data to facilitate digital consultations and diagnoses and we will always do this with your security in mind.

RESEARCH AND PANDEMIC PLANNING

The Secretary of State has directed NHS Digital to collect, process and analyse data in connection with COVID-19 to support the Secretary of State’s response to COVID-19 and support various COVID-19 purposes set out in the COVID-19 Public Health Directions 2020, 17 March 2020 (as amended) (COVID-19 Direction) and below. This enables NHS Digital to collect data and analyse and link the data for COVID-19 purposes with other data held by NHS Digital. 

The purpose of the data collection is also to respond to the intense demand for General Practice data to be shared in support of vital planning and research for COVID-19 purposes, including under the general legal notice issued by the Secretary of State under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI). 

NHS Digital has therefore been requested by the joint co-chairs of the Joint GP IT Committee (JGPITC) (the BMA and RCGP) to provide a tactical solution during the period of the COVID-19 pandemic to meet this demand and to relieve the growing burden and responsibility on General Practices. On 15 April 2020 the BMA and RCGP therefore gave their support via JGPITC to NHS Digital’s proposal to use the General Practice Extraction Service (GPES) to deliver a data collection from General Practices, at scale and pace, as a tactical solution to support the COVID-19 response in the pandemic emergency period.

It is a requirement of the JGPITC that all requests by organisations to access and use this data will need to be made via the NHSX SPOC COVID-19 request process, that will triage and prioritise these requests and refer appropriate requests on to the NHS Digital Data Access Request Service (DARS).   NHS Digital will consult with representatives of the BMA and the RCGP on all requests for access to the data. An outline of the process for this agreed with the BMA and the RCGP is published here.

Requests by organisations to access record level data from this collection will also be subject to Independent Group Advising on the Release of Data (IGARD) consideration. Data applicants will need to demonstrate they have a lawful basis to access the data for COVID-19 purposes. 

BENEFITS OF THIS SHARING

Organisations, including the Government, health and social care organisations and researchers need access to this vital data for a range of COVID-19 purposes, to help plan, monitor and manage the national response to the COVID-19 pandemic, which will help save lives. COVID-19 purposes for which this data may be analysed and used may include:

 

  • understanding COVID-19 and risks to public health, trends in COVID-19 and such risks, and controlling and preventing the spread of COVID-19 and such risks
  • identifying and understanding information about patients or potential patients with, or at risk of COVID-19, information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID19
  • understanding information about patient access to health services and adult social care services as a direct or indirect result of COVID-19, and the availability and capacity of those services • monitoring and managing the response to COVID-19 by health and social care bodies and the Government including providing information to the public about COVID-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services
  • delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of health care and adult social care services; and
  • research and planning in relation to COVID-19.

Data may be analysed and linked to other data held by NHS Digital or held by other organisations to which access to the data is granted for COVID-19 purposes, through the process described above.

Data will be collected nationally from all GP Practices by NHS Digital every fortnight. All requests to access this data will be triaged through the NHSX SPOC COVID-19 request process and assessed and fulfilled by NHS Digital through DARS. This will significantly reduce the burden on General Practice at a time when demand on resources is high, enabling General Practice to focus on delivering health care and support to patients. It will also reduce compliance burden and risk for General Practice associated with sharing data and complying with the terms of the general legal notice issued under COPI, which applies to General Practices.

LEGAL BASIS FOR THIS COLLECTION

NHS Digital has been directed by the Secretary of State under section 254 of the 2012 Act under the COVID-19 Direction to establish and operate a system for the collection and analysis of the information specified for this service: GPES Data for Pandemic Planning and Research (COVID-19). A copy of the COVID-19 Direction is published here: 

https://digital.nhs.uk//about-nhs-digital/corporate-information-and-documents/directions-anddata-provision-notices/secretary-of-state-directions/covid-19-public-health-directions-2020

Details of the information to be collected can be found on the NHS Digital website – Specification of this DPN. Type 1 objections will be upheld in collecting this data from General Practices and therefore the data for those patients who have registered a Type 1 objection with their GP will not be collected. The Type 1 objection prevents an individual’s personal identifiable confidential information from being shared outside of their GP Practice except when it is being used for the purposes of their direct care. The National Data Opt-Out will not apply to the collection of the data, as this is a collection which is required by law. 

This information is required by NHS Digital under section 259(1)(a) of the 2012 Act to comply with the COVID-19 Direction. In line with section 259(5) of the 2012 Act, all organisations in England that are within the scope of this Notice, as identified below under Health and Social Care Bodies within the scope of the collection, must comply with the requirement and provide information to NHS Digital in the form, manner and for the period specified in this Notice.   This Notice is issued in accordance with the procedure published as part of NHS Digital’s duty under section 259(8) of the 2012 Act. 

In August 2020, the NHS announced that the seasonal national flu immunisation programme criteria for 2020 - 2021 will be expanded to include patients on the SPL. Therefore, to provide information that will support the identification of patients at moderate or high risk of complications from flu, a revision to the weekly extract of data has taken place. This, version three of the extract for the purpose of maintaining and updating the SPL, will continue until the expiry of the COVID-19 Direction. This is currently 31 March 2022 but will be reviewed in September 2020 and every six months thereafter. The frequency of the data collection may change in response to demand.

 

Data collection extracted on a weekly basis week commencing 13 April 2020

Revised weekly data collection. The first collection is due week commencing 28 September 220

 

 

All patients with defined long-term medical conditions which pose a COVID-19 risk, identified as clinically extremely vulnerable to that risk and/or on certain drug treatments as below:

All patients with defined long-term medical conditions which pose a COVID-19 risk, identified as clinically extremely vulnerable/potentially clinically vulnerable to that risk and/or on certain drug treatments as below:

Medical Conditions that provide information on clinically vulnerable patients

  • Severe asthma and dust related lung disease with relevant treatment in the last 12 months (asthma treatment & prednisolone OR high dose cortiscosteroid safety card)
  • COPD emphysema, and associated lung diseases with relevant treatment in the last 12 months (COPD drugs OR high dose high dose cortiscosteroid safety card
  • Non-asthma and non-COPD respiratory disease
  • Cancer(haem and others)
  • Genetic, metabolic or autoimmune disease
  • Immunosuppression drugs in the last 12 months
  • Flu-like symptoms or respiratory tract infections from 1 November 2019
  • Transplants with severe Immunosuppression drug treatment in the last 12 months
  • Pregnant in last 9 months  

Medical Conditions that provide information on clinically vulnerable patients

  • Severe asthma and dust related lung disease with relevant treatment in the last 12 months (asthma treatment & prednisolone OR high dose cortiscosteroid safety card)
  • COPD emphysema, and associated lung diseases with relevant treatment in the last 12 months (COPD drugs OR high dose high dose cortiscosteroid safety card
  • Non-asthma and non-COPD respiratory disease
  • Cancer(haem and others)
  • Genetic, metabolic or autoimmune disease
  • Immunosuppression drugs in the last 12 months
  • Flu-like symptoms or respiratory tract infections from 1 November 2019
  • Transplants with severe Immunosuppression drug treatment in the last 12 months
  • Pregnant in last 9 months 

 

No change

 

  • Patients designated separately as at risk from COVID-19 using high/medium/low risk SNOWED CT Codes, for example
  • Patients designated separately as at risk from COVID-19 using high/medium/low risk SNOWED CT Codes, for example

 

No change

 

Patients with a COVID-19 activity code

Patients with a COVID-19 activity code

 

No change

 

 

Clinically vulnerable patients (eligible for seasonal flu vaccination)

  • Chronic Respiratory disease
  • Unresolved asthma with recent asthma drug treatment (in the last 12 months) or has ever had an emergency hospital admission due to asthma
  • Chronic heart disease
  • Unresolved chronic kidney disease stage3,4 and 5
  • Unresolved diabetes mellitus
  • Unresolved immunosuppression diagnosis
  • Immunosuppression procedure in the last 12 months
  • Chronic Liver disease
  • Chronic neurological disease
  • Pregnant in the last 9 months (different cluster to clinically extremely vulnerable group)
  • In patients aged 16 and over : BMI of 40+ in the last 12 months
  • In patients aged 16 and over : Latest BMI in the last 3 years was 40+
  • Learning disability (including Down’s)
  • Has a “requires flu vaccination” code
  • Identified as a healthcare worker in the last 12 months
  • Household contact of an immunocompromised individual

 

Other Potentially clinically Vulnerable patients

  • Unresolved hypertension
  • Pulmonary hypertension
  • Dementia
  • Systemic lupus
  • Discoid and non-systemic lupus
  • Psoriasis
  • Rheumatoid arthritis and associated disorders

 

 

Additional Data items for Patients from the above groups

  • Latest ethnic category code (all groups)
  • Earliest code indicating that the patient has died (all groups)
  • Latest smoking status (all groups)
  • Blood pressure from the last 2 years (all groups)
  • In patients aged 16 and over: all BMI and weight in last 5 years plus height (all groups)
  • IFCC-HbA1c in the last 2 years (for diabetic patients in the flu group only)
  • Latest COPD resolved and admission codes (for COPD Patients in the clinically extreme vulnerable group only)
  • ACE inhibitors, ARBs and non-steroidal anti-inflammatory drugs in the last 12 months (all groups)
  • Latest asthma emergency admission codes (for asthma patients in flu group only)
  • Asthma-related drug treatments in the last 12 months (for asthma patients in the flu group only)

 


The Secretary of State has directed NHS Digital to collect, process and analyse data in connection with COVID-19 to support the Secretary of State’s response to COVID-19 and support various COVID-19 purposes set out in the COVID-19 Public Health Directions 2020, 17 March 2020 (COVID-19 Direction) (as amended) (COVID-19) Direction) and below.

This enables NHS Digital to collect data and analyse and link the data for COVID-19 purposes with other data held by NHS Digital. The rationale for changing the data extraction is that the initial data collection was based on an existing specification for flu vaccination eligibility. This data extraction was then refined in order to more accurately reflect the patients who are clinically extremely vulnerable to COVID-19 and also to minimise the data we are collecting. A further refinement of the data extraction has taken place leading to the inclusion of new data being extracted. This will provide information to inform vaccination programmes. This General Practice Extraction

Service (GPES) data will be extracted weekly and be used to assist in producing a weekly update of the SPL. The objective of this collection is on an ongoing basis to identify patients registered at General Practices who may be:

  • clinically extremely vulnerable if they contract COVID-19
  • at moderate or high risk of complications from flu or COVID-19. The data collected will be analysed and linked with other data NHS Digital or other organisations hold to identify:
  • a list of clinically extremely vulnerable patients who will be advised to take shielding measures to protect themselves. Advice given to these patients has been published by Public Health England and is available here:

https://www.gov.uk/government/publications/guidance-on-shielding-and-protectingextremely-vulnerable-persons-from-covid-19/guidance-on-shielding-and-protectingextremely-vulnerable-persons-from-covid-19#what-do-we-mean-by-extremelyvulnerable

  • list of patients at moderate or high risk of complications from flu to inform the flu call/recall vaccination programme.

Further information on the flu programme can be found here:

https://www.england.nhs.uk/wpcontent/uploads/2020/05/Letter_AnnualFlu_2020-21_20200805.pdf

The extract may also be used for future direct care purposes relating to the COVID-19 outbreak. The methodology NHS Digital has used to produce the SPL is explained in detail and is published on the NHS Digital SPL website page here:

https://digital.nhs.uk/coronavirus/shielded-patient-list

Patients added to the SPL will be contacted by post, email (and/or SMS message where this is necessary) by the NHS on behalf of the Chief Medical Officer, Chris Whitty, to:

  • advise of the measures they can take to reduce their risk of contracting the virus and sign-post them to the Extremely Vulnerable Persons service operated by gov.uk at:

https://www.gov.uk/coronavirus-extremely-vulnerable

  • offer a flu vaccination or to contact non-responders who remain unvaccinated (as per NHS England specifications for the service). The SPL will also be used to inform GPs of their individual patients on the SPL, by flagging those patient records on GP patient record systems. The SPL will be shared with a variety of other organisations involved in the care and support of those patients and for planning, commissioning and research purposes associated with COVID-19. Full details of those with whom information has been shared can be found on the NHS Digital SPL website here:

https://digital.nhs.uk/coronavirus/shielded-patient-list/distribution

Requests by organisations to access record level data from this collection will be subject to Independent Group Advising on the Release of Data (IGARD) consideration. Data applicants will need to demonstrate they have a lawful basis to access the data for COVID-19 purposes.

BENEFITS OF THE COLLECTION

Organisations, including Government, health and social care organisations need to access this vital data for a range of COVID-19 purposes, to help plan, monitor and manage the national response to the COVID-19 pandemic, which will help save lives. COVID-19 purposes for which this data may be analysed and used may include:

 

  • understanding COVID-19 and risks to public health, trends in COVID-19 and such risks, and controlling and preventing the spread of COVID-19 and such risks identifying and understanding information about patients or potential patients with, or at risk of COVID-19, information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID19.

 

  • Data will be analysed and linked to other data held by NHS Digital or held by other organisations to which access to the data is granted for COVID-19 purposes, through the process described above. Data will be collected nationally from all General Practices by NHS Digital every week. All requests to access this data will be through Data Access Request Service (DARS). This will significantly reduce the burden on General Practice at a time when demand on resources is high, enabling General Practice to focus on delivering health care and support to patients.

 

  • It will also reduce compliance burden and risk for General Practice associated with sharing data and complying with the terms of the general legal notice issued under the National Health Service (Control of Patient Information Regulations) 2002 (COPI), which applies to General Practices Patients facing the greatest risk if they contract COVID-19 and/or are in the moderate to high risk of complications from flu:

 

  • will be identified and known to health organisations
  • will have a greater awareness of the recommended preventative shielding measures
  • will be able to follow clear advice
  • will be able to ask for help and support, including social care support and essential food supplies, through the Extremely Vulnerable Persons service operated by gov.uk

It will enable the SPL to be updated weekly to identify new patients and changes to patients on the List and will enable support provisions to be more dynamic and responsive to both social and clinical need.

It will also enable vital planning, commissioning, and research to be carried out for COVID-19 purposes. If patients facing the greatest risk follow advice, it is hoped that this will contribute to the delay and mitigation of the spread of COVID-19 and save lives.

VISITORS TO THE PRACTICE

We have an obligation to protect our staff and employees’ health, so it is reasonable for staff at Taurus Healthcare Ltd to ask any visitors to our organisation to tell us if they have visited a particular country, or are experiencing COVID-19 symptoms. This must only be in pre-approved circumstances and we would also ask all patients to consider government advice on the NHS 111 website and not attend the practice.

Where it is necessary for us to collect information and specific health data about visitors to our practice, we will not collect more information than we need, and we will ensure that any information collected is treated with the appropriate safeguards.

REVIEW AND EXPIRY OF THIS NOTICE

This Notice will be reviewed on or before 31 March 2021 and may be extended by The Secretary of State.  If no further notice is sent to Taurus Healthcare Ltd by The Secretary of State this Notice will expire on 31 March 2021.