Greenwich Health Ltd. Privacy Policy

​https://www.greenwich-health.com

​

This privacy notice explains why Greenwich Health Ltd (GH) collects information about you, how we keep it safe and confidential and how that information may be used. The first section provides a summary of these issues followed by a section that explains in more detail on why and how we process information in different ways.

​

Why we collect information about you

​

Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you have received within any NHS organisation. These records help to provide you with the best possible healthcare.

​

GH is a GP Federation, owned by and working on behalf of the GP practices of the Royal Borough of Greenwich. We collect and hold data for the sole purpose of providing healthcare services to patients, whether through services we deliver directly for anyone attending in person - such as our Urgent Treatment Centre at Queen Elizabeth Hospital, which is located in Greenwich but can be used by any patient regardless of where they live or are registered - through borough-wide services for Greenwich patients (such as our Live Well hubs, Dressing Service, PCN enhanced access hubs, and home visiting services), or through systems and services we provide to member practices. In carrying out this role we may collect information about you, which helps us respond to your queries or secure specialist services. We may keep your information in electronic form (and occasionally in written form). The records may include basic details about you, such as your name and address. They may also contain more sensitive information about your health and information such as outcomes of needs assessments.

​

Our role: data controller or data processor

​

Greenwich Health delivers some services in its own right, and delivers or supports other services on behalf of the GP practices of Greenwich. Our legal role under UK GDPR depends on the service.

​

Where we are the data controller, we determine how and why your information is used, and this privacy notice is the primary explanation of that processing. Where we are the data processor, we act on the written instructions of your registered GP practice, which remains the data controller, and your practice’s own privacy notice is the primary explanation of that processing — you should read it alongside this notice.

Our role for each of our main services is:

​

— Urgent Treatment Centre (Queen Elizabeth Hospital, Woolwich): Greenwich Health is the data controller.

​

— Dressings Service: Greenwich Health is the data controller. Information is shared with your registered GP practice on a controller-to-controller basis under a data sharing agreement.

​

— PCN Enhanced Access: Greenwich Health is the data controller for the records we create in delivering the service. Your registered GP practice remains the data controller for your GP record, and information flows between us on a controller-to-controller basis under a data sharing agreement.

​

— Live Well services (including stop smoking, LARC and NHS Health Checks): Greenwich Health acts as data processor on behalf of participating GP practices, which remain the data controllers, under a data processing agreement reviewed and approved by the South East London ICB GP Data Protection Officer and the Londonwide LMCs Information Governance Lead.

​

— ARRS staff working in GP practices: Greenwich Health acts as data processor; staff work within your practice’s clinical record under the practice’s controllership.

​

— Clinical searches and reporting run on practice records (for example, PCN DES monitoring): Greenwich Health acts as data processor on behalf of the practices.

​

Each section of the detailed privacy notice below states which role applies to that activity.

​

Details we collect about you

​

Where GH provides you with care directly, or provides a system or service used by your registered GP practice to provide your care, we (or the practice, as data controller) may hold records about your health and any treatment or care you have received previously or elsewhere (e.g. NHS Hospital Trust, other GP Surgery, Out of Hours GP Centre, A&E, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.

​

Records which we may hold or process about you may include the following:

• Details about you, such as your address and next of kin, emergency contacts and carers

• Your home telephone number, mobile phone number, email address

• Any contact you have had with GH services, such as appointments, clinic visits, immunisations, emergency appointments, etc.

• Notes and reports about your health, treatment and care

• Results of investigations, such as laboratory tests, x-rays, etc.

​

Relevant information from other health professionals, relatives or those who care for you, or information provided to us by you.

​

How we keep your information confidential and safe

​

Where GH acts as a data processor for member GP practices (for example, providing IT systems or clinical services on their behalf), the practice's own GP NHS health record — usually held on EMIS Web, provided by EMIS Health Ltd — remains the definitive clinical record. Where GH itself acts as data controller for its own borough-wide services, relevant records are held on the systems described in the detailed privacy notice that follows, including EMIS, EMIS Search & Reporting, Microsoft Azure and Microsoft Sharepoint, CLEO, Quit Manager, AccuRx, Medical Messenger, and other systems. We make sure that data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed. We only use your mobile number or email address to contact you regarding matters of medical care, such as appointment reminders. We maintain our duty of confidentiality to you always. We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), or where the law requires information to be passed on.

​

We are committed to ensuring the security and confidentiality of your information. There are a number of ways in which we do this:

• Staff receive annual training about protecting and using personal data

• IT hardware and software used by GH is provided, configured and maintained with full disk encryption, managed access controls, and regular security updates

• Policies are in place for staff to follow and are regularly reviewed

• We check that only the minimum amount of data is shared or accessed

• We use 'smartcards' to access systems, this helps ensure that the right people are accessing data - people with a 'need to know'

• We use encrypted emails and storage which would make it difficult for someone to 'intercept' your information

​

We report and manage incidents to make sure we learn from them and improve.

​

How we use information about you

​

Confidential patient data will be shared within the healthcare team providing your care, including clinical, nursing and admin staff at GH, at your registered GP practice, and with other healthcare professionals to whom a patient is referred. Those individuals have a professional and contractual duty of confidentiality.

​

Data Processors

​

GH (as data controller for its own services, and as data processor for a number of services delivered on behalf of member GP practices and Primary Care Networks) uses data processors for various reasons including maintaining electronic patient records, receiving electronic correspondence from other health and social care providers, ensuring correct payments are received, quality monitoring and mandatory data collections, or those providing a clinical service to patients. Details of these data processors can be found in the detailed privacy note later in this document.

​

Services we deliver as a data processor

​

For Live Well services, ARRS staff working in member practices, and clinical searches and reporting run on practice records, Greenwich Health acts as a data processor: your registered GP practice remains the data controller, and the practice’s own privacy notice is the primary explanation of that processing. These arrangements are governed by written data processing agreements, which for Live Well have been reviewed and approved by the South East London ICB GP Data Protection Officer and the Londonwide LMCs Information Governance Lead and are published on the London Data Console. If you have questions about these services, you can contact Greenwich Health or your registered GP practice.

​

Referrals for specific health care purposes

​

We sometimes provide your information to other organisations for them to provide you with medical services. We will always inform you of such a referral and you always have the right not to be referred in this way. These include:

• NHS Hospital Trusts

• Specialist Trusts including Mental Health Services

• Independent Contractors such as dentists, opticians, pharmacists

• Private Sector Providers

• Voluntary Sector Providers

• Ambulance Trusts

• Integrated Care Boards (ICBs)

• Social Care Services

• Local Authorities

• Education Services

• Fire and Rescue Services

• Police

• Other 'data processors' during specific project work, e.g. member GP practices or other GP federations

 

Data Sharing for Direct care

​

We share your personal information on national (Summary Care Record) and local (London Care Record) data sharing platforms to create care records that would allow healthcare professionals to see information on your medical history if needed in an urgent clinical situation, with your consent when possible.

​

Data Sharing for Secondary Uses

​

Data is also shared with national organisations and data processors based on national guidelines and law. This is for purposes that go beyond direct medical care, and includes healthcare planning, audit, population analytics, research, and commissioning at a local, regional or national level. Often this will include patient identifiable data but sometimes may be anonymised aggregate data.

​

National Data Opt-Out: You can choose whether your confidential patient information is used for research and planning through the National Data Opt-Out. Where the opt-out applies and GH is responsible for a disclosure, we will check and respect your recorded choice. Where GH acts as a data processor, we will support the relevant GP practice or other data controller to apply the opt-out in accordance with its instructions. The opt-out does not apply to information used for your direct care, to anonymised information, or where a disclosure is required by law or another exemption applies. You can view or change your choice at any time through the NHS App or the NHS National Data Opt-Out service.

 

YOUR DATA RIGHTS UNDER UK GDPR

​

Your right to be informed

​

GH provides fair processing information about all data processing activities concerning your records, by means of posters and detailed privacy notices (such as the one that follows). This can be found on the GH website at https://www.greenwich-health.com. You have the right to know what information we hold about you, why we hold it, who we share it with, and how long we keep it. This privacy notice is the main way we provide that information to you.

​

Your right of access

​

You have the right to access your own GP record. This is in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Where your registered GP practice holds your clinical record (for example, on EMIS Web), you can access prospective entries through the NHS App, or through third-party patient-facing services such as Patient Access, where these have been enabled by your practice. If you are unable to use the NHS App or Patient Access, you can make a Subject Access Request by contacting your registered GP practice.

​

Where your request relates to a record that GH holds as data controller (for example, an attendance at our Urgent Treatment Centre), you can make your Subject Access Request to GH directly. We will respond within one calendar month of receiving your request. There is no charge for a Subject Access Request unless the request is manifestly unfounded, excessive, or repetitive.

​

Your right to rectification

​

You have the right to have any factual inaccuracies about you corrected. If you believe information held about you is inaccurate or incomplete, please contact GH or your registered GP practice and we will review and correct it where appropriate. Where a clinical opinion has been recorded, it may not be possible to remove or alter that entry, but a note can be added to the record reflecting your view. There is no right to have accurate medical records deleted except when ordered by a court of law.

 

Your right to erasure

​

You have the right to request that your personal data is erased in certain circumstances, sometimes referred to as the “right to be forgotten.” However, this right is significantly limited in the context of health records. GH is required by law to retain records in line with the NHS Records Management Code of Practice, and we process your data under Article 6(1)(e) (public task) and Article 9(2)(h) (provision of health care) of UK GDPR. These legal bases mean that, in most cases, we cannot erase your record on request. If you ask us to erase information, we will consider each request on its merits and explain our decision to you.

​

Your right to restrict processing

​

You have the right to ask us to restrict the processing of your personal data in limited circumstances, for example where you have contested the accuracy of the data and we are verifying it, or where you have objected to processing and we are considering your objection. Where a restriction applies, we will continue to store the data but will not use it further until the matter is resolved. As with erasure, this right is limited by our legal duty to maintain accurate and complete records for the purposes of providing safe care.

​

Your right to data portability

​

The right to data portability allows individuals to obtain and reuse their personal data across different services in a structured, commonly used, and machine-readable format. This right only applies to personal data processed on the lawful bases of consent or contract. As GH processes most records under Article 6(1)(e) (public task) and Article 9(2)(h) (provision of health care), the right to data portability does not generally apply. You can, however, access your record through the NHS App as described above, and you can request a copy of your record through a Subject Access Request.

​

Your right to object

​

You have the right to object to the processing of your personal data under Article 21 of UK GDPR. In the context of health records, this right most commonly applies to how your information is shared, both for direct medical care purposes (such as the national Summary Care Record, the London Care Record, point of care referrals, or text messages) and for purposes other than your direct medical care, known as secondary uses. You cannot object to some of the ways by which your information is disclosed, as these are mandated by law or necessary for the provision of safe care. Details of these purposes are outlined in the detailed privacy note that follows.

​

Your rights related to automated decision-making and profiling

​

Under Article 22 of UK GDPR, you have the right not to be subject to a decision based solely on automated processing, including profiling, which produces legal effects concerning you or similarly significantly affects you. GH does not carry out any solely automated decision-making about your care. Where digital tools are used to support clinical decisions, such as risk stratification tools or population health analytics, these are always reviewed and acted upon by a qualified clinician. A human clinician remains responsible for all decisions about your care and treatment.

​

LAWFUL BASES FOR PROCESSING

​

Lawful bases for processing and the UK General Data Protection Regulation (UK GDPR)

​

The UK GDPR is the data protection law that applies in the United Kingdom. It is based on the EU General Data Protection Regulation, retained in UK law following the UK's departure from the European Union, and sits alongside the Data Protection Act 2018. It came into effect in May 2018 and continues to apply in the UK.

​

You have the right to be informed about the collection and use of your personal data i.e. data processing. This is a key transparency requirement under UK GDPR. (https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/)

​

In common with GP practices and GP federations, Greenwich Health Ltd relies on “Official Authority” to process personal data using Article 6(1)(e) of UK GDPR. The other commonly used Articles of UK GDPR used for the lawful basis of processing data include Article 9(2)(h) and Article 6(1)(c) and Article 6(1)(d) and Article 9(2)(b) and Article 9(2)(i) of UK GDPR:

​

Article 6(1)(e) Official Authority – “…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…”.

​

Article 9(2)(h) – Provision of Health – “necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”

​

Article 6(1)(c) – Legal Obligation – “processing is necessary for compliance with a legal obligation to which the controller is subject.”

​

Article 6(1)(d) Vital Interests – “processing is necessary in order to protect the vital interests of the data subject or of another natural person”

​

Article 9(2)(b) – Employment & Social Security – “processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security”

​

Article 9(2)(i) Public Interest – “processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices…”

​

The detailed privacy note that follows shows the links between these articles and specific data processing areas. This is not an exhaustive list; specific articles may apply to specific situations - see detailed privacy notes for further information.

​

That 'official authority' derives from NHS England's powers to commission health services under the NHS Act 2006 (as amended by the Health and Care Act 2022), and the delegation of primary care commissioning functions to Integrated Care Boards (ICBs) from 1 April 2023 - the NHS Act 2006

​

The “supervisory authority” mentioned in all of the above is the Information Commissioner.

​

Notification

​

Under the Data Protection Act 2018 and the Data Protection (Charges and Information) Regulations 2018, organisations that process personal data are required to pay a data protection fee to the Information Commissioner's Office (ICO) and to be listed on the ICO's public register of fee payers, unless exempt.

We are registered as a data controller. Our registration can be searched for on the ICO's public register at https://ico.org.uk/ESDWebPages/Search

​

COMPLAINTS

​

If you have concerns or are unhappy about any of our services in terms of data processing, please contact our Data Protection Officer:

​

Robert Sweeney

​

robert.sweeney@nhs.net

020 8319 5440

Greenwich Health Ltd

25-27 John Wilson St

Woolwich

London SE18 6PZ

​

If you are still concerned and want to make a formal complaint, please contact the GH senior management team. Details of how to complain are on our website, or available on request.

​

For independent advice about data protection, privacy, and data sharing issues, you can contact:

 

The Information Commissioner

​

Website: www.ico.org.uk

Wycliffe House, Water Lane

Wilmslow

Cheshire SK9 5AF

Phone: 0303 123 1113 (local rate) or 01625 545 700 (national rate)

​

The following provides a detailed list about the many data processing activities that GH performs. Our detailed privacy notice (which refers to all these types of data processing) can also be viewed/downloaded from our website. Each heading below corresponds to a section of the detailed privacy notice.