COPD+ Patient Privacy Notice

National Services for Health Improvement Ltd (NSHI) provides COPD reviews that are conducted by Respiratory Specialist Nurses. We assist GP practices to conduct a full clinical assessment of all COPD patients in order to provide the best possible care for their patients.

NSHI is an independent company and we deliver the COPD+ Service, which is paid and provided for by Chiesi Ltd as a service to medicine. Chiesi Ltd is a pharmaceutical company.

Whilst NSHI work in collaboration with pharmaceutical companies, it has no affiliation to any one pharmaceutical company, nor shall it promote any pharmaceutical company’s products in the provision of their service.

- Patients name, contact information (including email and telephone number) and NHS number

- Data concerning patients’ health, including medical record of patient health & care information (e.g. medication details)

- History, medication, control, clinical measurements, inhaler technique, current management and management plan

We process your personal data to assist your GP and provide you with a COPD review that is conducted by an NSHI Respiratory Specialist Nurse.

All personal data collected are used for the sole purpose of the review and is scanned into the electronic patient record (held on the GP’s system). NSHI does not store any of your personal data. We create fully anonymised reports using aggregated data to conduct research into respiratory health and publish anonymised reports (e.g. in medical journals).

Most of the personal information we process is provided to us directly by you or is accessed through your GP Practice record. All processing undertaken will be fully compliant with the General Data Protection Regulation (GDPR) and the UK Data Protection Act 2018.

The legal basis we rely on for processing patient personal data is:

a) Necessity for the performance of a contract between your GP and NSHI, to identify whether you would benefit from attending an COPD clinic with a Respiratory Specialist Nurse as part of the COPD+ Service and send your invitation letter/text message.

b) Your consent to access your full medical record and any information you may provide us with about your health.

As we need your consent to process data concerning your health you have a right to withdraw your consent at any time.

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

Your right of access

You have the right to ask for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.

Your right to rectification

You have the right to ask to rectify information you think is inaccurate. You also have the right to ask for information to be completed if you think is incomplete. This right always applies. Your right to erasure You have the right to ask for erasure of your personal information in certain circumstances.

Your right to restriction of processing

You have the right to ask to restrict the processing of your information in certain circumstances. Your right to object to processing You have the right to object to your personal data being processed, and we will respect your objection unless there is a clear lawful basis for continuing to process your data (e.g. if NSHI is subject to a legal obligation).

Your right to data portability

This only applies to information you have given. You have the right to ask for the transfer of information you gave from one organisation to another or to give it to you. The right only applies if processing information is based on your consent or under, or in talks about entering into a contract and the processing is automated. Because NSHI does not control or retain any of your personal data you should contact your GP Practice (who is the data controller) directly to raise any queries (for example about the accuracy of your data) and exercise your rights (including the right to access, rectification, and erasure). You are not required to pay any charge for exercising your rights. The GP Practice has one month to respond to you.

We will only share your personal data with third parties (i.e. any party other than you or your GP), if required to do so by law.

We will not share your information with any third parties for direct marketing purposes. We may contract third party data processors that provide solutions and services that enable us to meet your care needs.

We use data processors that are third parties who provide elements of services for us. We have contracts in place with our data processors. This means that they cannot do anything with your personal information unless we have instructed them to do it. They will not share your personal information with any organisation apart from us. They will hold it securely and retain it for the period we instruct.

We’ll also monitor any emails sent to us, including file attachments, for viruses or malicious software. You must ensure that any email you send is within the bounds of the law.

You will have the option to complete an anonymous Patient Satisfaction Questionnaire after your consultation.

You should raise any queries or complaints you may have about the use of your personal data directly with your GP (e.g. if you feel as though any of your data protection rights have not been respected).

If you ever have any queries about your data protection rights, you can also contact the UK Information Commissioners Office (at any time):

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

Service Related Complaints

Should you have any complaints that directly relate to the service you have received from NSHI, in relation an NSHI Nurse Advisor, kindly make your complaint to our HR Department using the following contact details: Human Resources,

NSHI Ltd.,

33 Turbine Way,

Ecotech Business Park,

Swaffham,

Norfolk PE37 7XD

T: 01760 721279

E: [email protected]