Working together to continuously improve care and
health outcomes for the people of Somerset.

Search
Slightly Opaque Blue and Purples Circles Background

Privacy Policy

Data Controller – Somerset NHS Foundation Trust

This page provides you with information about how we use and manage the personal data we hold about you, including how we share it with NHS and non-NHS organisations, and how we maintain confidentiality.

What is personal data?

Personal data is information about a living, identifiable individual. Therefore, your personal data is any information that can be attributed to you personally, including your name, weight, height, date of birth, health conditions and treatments you receive. So long as you can be identified from that information, it becomes your personal data.

Organisations that use personal data must do so in line with the provisions of the Data Protection Act. The Act applies to personal data held in both electronic and physical media.

An example of the types of personal data that the Trust uses are:

  • Name, address, date of birth, NHS Number and next of kin
  • Contact information i.e. telephone number and email
  • Contacts we have had with you such as clinic visits
  • Details of diagnosis and treatment
  • Allergies and physical or mental health conditions
  • Racial or Ethnic Origin
  • Religious or other beliefs of a similar nature
  • Offences, criminal proceedings, outcomes and sentences.
  • Family, lifestyle and social circumstances
  • Education and training details
  • Employment details
  • Financial details

Why we collect information about you

We keep records about the health care and treatment you receive as one of our patients.  This helps to ensure that you receive the best possible care from us and that full information is readily available if you see another doctor, or are referred to a specialist or another part of the NHS.  We collect contact information so that we can make contact and keep you informed about that care and treatment.

We also keep records relating to staff, for the purpose of employment, pay, discipline, superannuation, work management or other personnel matters. This is to ensure that employment at the Trust is managed to a high standard and that staff are provided with the information and training required to carry out their role.

We may use personal data for the following purposes:

  • To prepare statistics on NHS performance
  • To audit NHS Services
  • To monitor how we spend public money
  • To plan and manage the health service
  • To teach and train healthcare professionals and NHS employees
  • To conduct health research and development

 This helps you because:

  • Accurate and up to date information assists us in providing patients with the right care
  • Full information is readily available if you see another doctor or are referred to a specialist or another part of the NHS
  • Accurate and up to date information assists us in providing staff with the information and training required to carry out their role in the Trust

Data Protection Act 2018

All of the personal data that we collect and use is handled in accordance with the Data Protection Act principles. These state that:

  • We must satisfy lawful conditions in order to use personal data. (These conditions include, but are not limited to, obtaining consent from the individual to use their personal data; and/or needing the personal data to protect someone from serious harm; and/or using the personal data in order to exercise one of our statutory duties)
  • We must let individuals know why we are using their personal data. This webpage helps us to do that.
  • We must use the personal data in a manner compatible with that purpose.
  • We must only use the personal data that is relevant to the purpose; i.e., not obtain or use more than we need to.
  • We must keep your personal data accurate and up-to-date.
  • We must not keep your personal data longer than is necessary
  • We must use in line with your Data Protection rights; for example, the right to obtain a copy of the personal data we hold about you.
  • We must keep your personal data safe and secure.
  • We must only transfer your personal data outside of the European Economic Area if we have ensure that adequate safeguards are in place.

Further information on the principles can be found by clicking here.

Somerset NHS Foundation Trust is the Data Controller (registration number is Z6696096) of personal information that is collected by the Trust to help us provide and manage healthcare to our patients and relating to the employment of our staff.

Who do we share personal data with?

We share data with a range of organisations.  We will always endeavour to share the minimum amount of personal data required, even anonymising data where we possible. However, there will be some instances where personal data will need to be shared with other organisations for the purposes of caring for a patient. In such instances we will need to ensure that the information shared is adequate so that the patient is properly cared for.

We may share personal data with the following organisations for the purposes of delivering or improving healthcare, or where there is a legal requirement for us to do so:

  • Clinical commissioning groups
  • Health authorities
  • Other NHS organisations
  • General practitioners (GPs)
  • Ambulance services
  • Other NHS common services agencies such as primary care agencies
  • Social services
  • Education services
  • Local authorities
  • Police
  • Department for Work & Pensions
  • Voluntary sector providers and private sector providers.
  • Fraud Protection/Detection bodies

How long do we retain your records?

All our records are destroyed in accordance with the NHS Retention Schedule, which sets out the appropriate length of time each type of NHS records is retained. We do not keep your records for longer than necessary.

All records are destroyed confidentially once their retention period has been met, and the Trust has made the decision that the records are no longer required. For further information, please see the Records Management Code of Practice for NHS and Social Care 2016

How do we keep your personal data safe and secure?

We are committed to securing your personal information from unauthorised access, use of disclosure.  We secure the personal data you provide on computer servers in a controlled, secure environment.  We also train our staff and have policies and procedures in place so that everyone working in the Trust is aware of the high standards we expect them to adhere to when handling your personal data.

Everyone working for the NHS is subject to the Common Law Duty of Confidence.  Information provided in confidence will only be used for the purposes advised and consent given by the individual to whom the information relates, unless there are other circumstances covered by the law.

Under the NHS Confidentiality Code of Conduct, all our staff are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared.  This will be noted in your records.

Patient information and health and care research

All NHS organisations (including Health & Social Care in Northern Ireland) are expected to participate and support health and care research. The Health Research Authority and government departments in Northern Ireland, Scotland and Wales set standards for NHS organisations to make sure they protect your privacy and comply with the law when they are involved in research. Our research ethics committees review research studies to make sure that the research uses of data about you are in the public interest, and meet ethical standards.

For further information please click  here.

Information sharing with non-NHS organisations

For your benefit, we may also need to share information from your health records with non-NHS organisations, from which you are also receiving care, such as social services or private healthcare organisations. This information is only routinely shared with data processors with whom we have written contracts to undertake work for us. These non-NHS organisations are not allowed to use the data for their own purposes.

Where there is no written contract we will not disclose any health information to third parties without your explicit consent, unless there are exceptional circumstances, such as when the health or safety of others is at risk or where the law requires it.

Where patient information is shared with other non-NHS organisations, an information sharing agreement is drawn up to ensure information is shared in a way that complies with relevant legislation.

These non-NHS organisations may include, but are not restricted to: social services, education services, local authorities, the Police, voluntary sector providers and private sector providers.

Third Parties

We do not sell, rent or lease its customer lists to third parties.  We may share data with trusted partners (our data processors) to help us perform statistical analysis, send you email, postal mail and/or appointment reminders, provide customer support or arrange for deliveries.  All such third parties are prohibited from using your personal information except to provide these services to the Trust, and they are required to maintain the confidentiality of your information.

SIDeR

A new service called SIDeR (Somerset Integrated Digital electronic Record) is being rolled out across Somerset over the next few years to allow GP practices, hospitals and Social Care to securely view your health and care information.

SIDeR will help us to link up our existing IT systems that record and securely store your information, so that medical and care staff can view your information to help them deliver better and safer care for you. For example, they will be able to see what medications you’re taking, what allergies you have and what appointments you have coming up. If you have a care plan in place, they will also be able to see this to understand what your exact needs are.

Further information on SIDeR can be found by clicking here.

Patient satisfaction

We may use your details to contact you with patient satisfaction surveys relating to services you have used. This is to improve the way we deliver healthcare to you, our patient.

Your right to withdraw consent for us to share your personal information

You have the right to make a request to refuse / withdraw consent to information sharing at any time.  The possible consequences will be fully explained to you and could include delays in receiving care.

Data Subject Rights – Can I see my information?

Under the Data Protection law a person may request access to information (with some exemptions) that is held about them by an organisation.  This is known as the Right of Subject Access.  If you require access to your health records you must make a written request or verbal request to:

Data Access and Disclosure Office

Medical Records Department

Unit J, Crown Close
Taunton TA2 8RX

Download the Personal Data Request From

The Trust can only provide access to information it holds. For example to see the records held by your GP you have to contact the surgery.

The Access to Health Records Act 1990 also allows access, in certain circumstances, to information that we hold on deceased patients.

Further information on other Data Subjects Rights can be found by clicking here.

If you wish to exercise any of your Data Subjects Rights, please email the information governance team at informationgovernance@SomersetFT.nhs.uk

Raising a concern

If you have a concern about any aspect of your care or treatment at this hospital or about the way your records have been managed, please contact:

Patient Advice & Liaison Service (PALS)

Somerset NHS Foundation Trust

Musgrove Park Hospital

Taunton TA1 5DA

Tel: 01823 343536

Email: pals@SomersetFT.nhs.uk

Additionally, you have a right to complain to the Information Commissioner if ever you are unsatisfied with the way the Trust has handled or shared your personal information:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5A

Tel: 0303 123 1113 (or 01625 545745 or 44 1625 545745 if calling from overseas)
Fax: 01625 524510

Changes to this Statement

Somerset NHS Foundation Trust will occasionally update this Statement of Privacy to reflect company and customer feedback. Somerset NHS Foundation Trust encourages you to periodically review this Statement to be informed of how Somerset NHS Foundation Trust is protecting your information.

Contact Information

Somerset NHS Foundation Trust welcomes your comments regarding this Privacy Notice. If you believe that this notice has not been adhered to, please contact Somerset NHS Foundation Trust.

Further information

To learn more about how we use, manage and maintain confidentiality of your information, or to exercise your rights as a data subject please contact:

Louise Coppin

Data Protection Officer

Somerset NHS Foundation Trust

Musgrove Park Hospital

Taunton TA1 5DA

Tel: 01823 320452

Email: louise.coppin@SomersetFT.nhs.uk

Website Information

Information about your computer hardware and software is automatically collected.  This information can include your IP address, browser type, domain names, access times and referring Web site addresses.  This information is used for the operation of the service, to maintain the quality and provide general statistics regarding use of the Somerset NHS Foundation Trust Web sites.

Our web sites will not disclose your personal information, without notice, only if required to do so by law or in the good faith belief that such action is necessary to: (a) conform to the edicts of the law or comply with legal process served on the Trust or the sites; (b) protect and defend the rights or property of the Trust; and, (c) act under exigent circumstances to protect the personal safety of users of the Trust, or the public.

Please keep in mind that if you directly disclose personally identifiable information or personally sensitive data through Somerset NHS Foundation Trust public message boards, this information may be collected and used by others.  Note: we do not read any of your private online communications.

Links to other websites

We encourage you to review the privacy statements of Web sites you choose to link to from our site so that you can understand how those Web sites collect, use and share your information. The Trust is not responsible for the privacy statements or other content on Web sites outside the Trust family of Web sites.  Therefore we cannot be responsible for the protection and privacy of any information which you provide whilst visiting such sites.

Collecting personal information on E forms

The Trust web sites use electronic forms. These forms enable you to give us feedback about the web site, to feedback about specific activity the Hospital is involved in; to feedback as part of a formal consultation; to take part in fundraising activities or giving; to register for an event or activity; to register interest as a member or Volunteer.

Where we are asking for personal information we will always ask you to acknowledge acceptance and understanding of this Fair Collection/Privacy Notice, before the electronic form can be submitted.

Direct Marketing

Somerset NHS Foundation Trust may also use your personally identifiable information to inform you of other products or services available from Somerset NHS Foundation Trust and its affiliates.  Somerset NHS Foundation Trust may also contact you via surveys to conduct research about your opinion of current services or of potential new services that may be offered.

Somerset NHS Foundation Trust keeps track of the Web sites and pages our customers visit in order to determine which of our services are the most popular. This data is used to deliver customised content and advertising within to customers whose behaviour indicates that they are interested in a particular subject area.  You have the right to refuse / withdraw consent to direct marketing at any time.

Use of Cookies

The Somerset NHS Foundation Trust Web site uses “cookies” to help you personalise your online experience.  A cookie is a text file that is placed on your hard disk by a Web page server.  Cookies cannot be used to run programs or deliver viruses to your computer.  Cookies are uniquely assigned to you, and can only be read by a web server in the domain that issued the cookie to you.

One of the primary purposes of cookies is to provide a convenience feature to save you time.  The purpose of a cookie is to tell the Web server that you have returned to a specific page.  For example, if you personalise pages, or register with Somerset NHS Foundation Trust site or services, a cookie helps to recall your specific information on subsequent visits.  This simplifies the process of recording your personal information, such as billing addresses, shipping addresses, and so on.  When you return to the same Somerset NHS Foundation Trust Web site, the information you previously provided can be retrieved, so you can easily use the features that you customised.

You have the ability to accept or decline cookies.  Most Web browsers automatically accept cookies, but you can usually modify your browser setting to decline cookies if you prefer.  If you choose to decline cookies, you may not be able to fully experience the interactive features of the Somerset NHS Foundation Trust services or Web sites you visit.

You can read more about the cookies used by the Trust’s web sites by clicking on the Cookie link at the bottom of the web page.