Privacy policy

Clinical Partners Limited ("we") is committed to protecting and respecting your privacy.

Important information and who we are

Data controller

For the purposes of data protection laws, we are the “controller” of the processing of your personal data. This means that we decide why and how your personal information is processed. It also means that we are responsible to you under the law for that processing.

Clinical Partners Limited is a company registered in England and Wales under company number 07590254 and registered office at Unit 6, Chaldicott Barns, Tokes Lane, Semley, Wiltshire, SP7 9AW. Clinical Partners Limited is registered with the Information Commissioner’s Office (ICO) with registration number Z2868470. Notification details can be accessed by searching the Data Protection Public Register.

We are part of a group of companies made up of different legal entities, details of which can be provided on request.

We have appointed a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. If you have any questions about this privacy notice, including any requests to exercise your legal rights, please contact the DPO using the details set out below.

Contact details

FAO Data Protection Officer

Email address: Governance@clinical-partners.co.uk

Postal address: Unit 6, Chaldicott Barns, Tokes Lane, Semley, Wiltshire, SP7 9AW

Telephone number: + 44 (0) 203 326 9160

Privacy Notice for Clinical Partners Group Ltd

1.0 Purpose

1.1. This Privacy Notice explains how Clinical Partners and OAC collects, uses, shares and protects your personal data when accessing the services we provide. It applies to personal data relating to patients, service users, carers, individuals whose information may be processed as part of our clinical partnership arrangements.

1.2. We are committed to being open and transparent about how personal data is used.

2.0 Scope

2.1. Clinical Partners and OAC are the controller for the personal data we process for the purposes described in this notice, unless otherwise stated. In some clinical partnership arrangements, we may act as a joint controller with one or more. The relevant data sharing agreement or contract will set out each party’s responsibilities.

3.0 Procedure

3.1. What personal data we process

3.1.1. The personal data we process will depend on the nature of the clinical partnership, service or pathway. It may include:

• identifiers such as name, date of birth, NHS number, address, telephone number and email address;

• clinical and health information, including referrals, assessments, diagnoses, treatment plans, medicines, test results, allergies, care plans and appointment information;

• information about carers, next of kin, representatives or people with parental responsibility where relevant to care or safeguarding;

• special category data, including health information and, where relevant, information about ethnicity, religion, disability, sex life or sexual orientation where this is necessary for care, equality monitoring or safeguarding;

3.2. Why we use personal data

3.2.1. We use personal data where it is necessary and proportionate for the following purposes:

• to support the provision of safe, effective and joined-up care;

• to manage referrals, appointments, assessments, treatment and follow-up care;

• to communicate with clinical partners and other health and care professionals involved in an individual’s care;

• to support safeguarding, risk management and continuity of care;

• to meet legal, regulatory, professional and contractual obligations;

• to monitor service quality, safety, audit, training and governance;

• to investigate incidents, complaints, concerns or information governance matters;

• to support service planning, evaluation, reporting and improvement, using anonymised or

  pseudonymised data wherever possible;

• to manage access to clinical systems, information sharing arrangements and security controls.

3.3. Our lawful bases for processing

3.3.1. Where we process personal data, we will identify an appropriate lawful basis under the UK GDPR. Depending on the circumstances, this may include:

• Article 6(1)(b) - Contract (for the general processing of your personal data needed to fulfil our contractual obligations with you)

• Article 6(1)(e) – public task: where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority;

• Article 6(1)(c) – legal obligation: where processing is necessary to comply with a legal obligation;

• Article 6(1)(f) – legitimate interests: where applicable, for example in relation to certain partnership management activities, provided individuals’ rights and interests are protected;

• Article 6(1)(d) – vital interests: where processing is necessary to protect someone’s life.

3.3.2. Where we process special category data, such as health information, we will also identify an Article 9 condition. This may include:

• Article 9(2)(h): health or social care purposes, including diagnosis, treatment, care management and the management of health or social care systems and services;

• Article 9(2)(i): public health purposes, where relevant;

• Article 9(2)(g): substantial public interest, where supported by a condition in the Data Protection Act 2018;

• Article 9(2)(c): vital interests, where the individual is physically or legally incapable of giving consent.

3.4. Confidential patient information and consent

3.4.1. Where confidential patient information is used or shared for direct care, this will usually be on the basis that the individual would reasonably expect relevant information to be shared with health and care professionals involved in their care, unless they have objected or another restriction applies. Information will only be shared on a need-to-know basis.

3.4.2. Where confidential patient information is used for purposes beyond direct care, such as research or planning, we will use anonymised or pseudonymised data wherever possible. Where identifiable confidential patient information is required, we will ensure there is an appropriate legal basis and confidentiality basis, such as explicit consent, a statutory requirement, section 251 support, a court order or an overriding public interest justification.

3.5. Who we share personal data with

3.5.1. We may share personal data with clinical partners and other organisations where this is necessary, lawful and proportionate. This may include:

• NHS trusts, GP practices, community services, mental health services, pharmacies and other health and care providers;

• integrated care boards, local authorities and social care providers for example funding requests and invoice validation;

• your child’s school or contact them if appropriate

• laboratories, diagnostic providers and specialist clinical services;

• commissioners, regulators, auditors and professional bodies where required;

• safeguarding partners, police or emergency services where necessary to protect individuals or meet legal obligations;

• IT system suppliers, secure messaging providers and other service providers acting under contract;

• research, planning or evaluation partners where appropriate safeguards are in place.

3.5.2. We work with third parties and suppliers (data processors) to be able for us to provide a service to you. These include:

• Salesforce – Patient Data Base

• Heidi – Transcribes Assessments

• Yoti – Prescription Identity Service

3.5.3. We will ensure that appropriate contracts, data sharing agreements, data processing agreements or information governance arrangements are in place before personal data is shared.

3.6. International transfers

3.6.1. Please note that some of the data we collect may be transferred to, and stored at, a destination outside the UK and EEA. This data may be processed by staff operating outside the UK/EEA who work for us or one of our suppliers

3.6.2. To ensure your personal data remains protected during these transfers, we will only transfer data outside the UK/EEA where one of the following safeguards is in place:

• Adequacy Regulations: We transfer the data to a country that the UK has deemed to provide an adequate level of protection for personal data.

• Appropriate Safeguards: We ensure the transfer is governed by appropriate safeguards, primarily through the use of the UK International Data Transfer Agreement (IDTA) or the UK 

• Addendum to the EU Standard Contractual Clauses (SCCs). These contracts legally bind the recipient to protect your data to the standard required by UK GDPR.

3.6.3. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

3.7. How long we keep personal data

3.7.1. We will keep personal data only for as long as necessary for the purposes for which it was collected, and in line with applicable legal, regulatory, clinical and records management requirements. Retention periods may vary depending on the type of record, the service involved and any legal or clinical need to retain the information. When personal data is no longer required, it will be securely deleted, anonymised or archived in accordance with our retention policy.

3.8. How we protect personal data

3.8.1. We use appropriate technical and organisational measures to protect personal data against unauthorised access, loss, misuse, alteration or disclosure. These measures may include access controls, role-based permissions, secure systems, encryption where appropriate, audit logging, staff training, incident reporting processes and contractual controls with suppliers and partners.

3.9. Individual rights

3.9.1. Individuals have rights under data protection law. Depending on the circumstances, these may include the right to:

• be informed about how their personal data is used;

• access a copy of their personal data;

• ask for inaccurate or incomplete personal data to be corrected;

• ask for personal data to be erased in certain circumstances;

• ask us to restrict how personal data is used;

• object to the use of personal data in certain circumstances and does not apply to health information/records;

• request data portability where this right applies;

• not be subject to solely automated decisions that have legal or similarly significant effects, unless permitted by law.

3.9.2. Some rights may not apply in all situations, particularly where information is needed for direct care, legal obligations, safeguarding, public health, clinical safety or the establishment, exercise or defence of legal claims.

3.10. Children and young people

3.10.1. Where we process information relating to children and young people, we will take account of their age, maturity, capacity and best interests. We will provide privacy information in a clear and accessible way where appropriate. Information may be shared with parents, carers or people with parental responsibility where this is lawful and appropriate, taking account of the child or young person’s competence, wishes, safeguarding needs and confidentiality rights.

3.11. How to contact us

3.11.1. If you have questions about this Privacy Notice, how personal data is used, or how to exercise data protection rights, please contact:

Data Protection Officer: Andrea Hughes

Email: dp@clinical-partners.co.uk

Postal address: Clinical Partners, Unit 6, Chaldicott Barns, Tokes Lane, Semley, Wiltshire, SP7 9AW

3.12. Complaints

3.12.1. If you are unhappy with how we have used personal data, please contact us first so that we can try to resolve the issue. Individuals also have the right to complain to the Information Commissioner’s Office, the UK supervisory authority for data protection.

Information Commissioner’s Office

Website: ico.org.uk

Telephone: 0303 123 1113

3.13. Changes to this Privacy Notice

3.13.1. We will review this Privacy Notice regularly and update it where necessary to reflect changes in our services, clinical partnerships, legal requirements or information sharing arrangements.

4.0 Review and Approval

4.1. This SOP will be reviewed annually or upon a change in approach /legislation / regulation – whichever is sooner.

4.2. All staff are responsible for having knowledge of this process.

5.0 Definitions

6.0 References

7.0 Related Documents

7.1. This policy should be read in conjunction with the following Clinical Partners Ltd policies and procedures:

• Privacy Notice for Children and Young People

Privacy Notice for Children and Young People

1.0 Purpose

1.1. This notice explains how Clinical Partners Ltd and Oxford ADHD Centre (OAC) use information about you when we help with your care. This may include information about your health, appointments, assessments and the people who help look after you.

1.2. We want you to understand what information we have, why we need it, who we may share it with and what you can ask us to do.

2.0 Scope

2.1. We use information about you to help give you safe care.

2.2. We only use information when we have a good reason.

2.3. We may share information with people who help care for you, like doctors, nurses or therapists.

2.4. We try to keep your information private and safe.

2.5. You can ask what information we have about you.

2.6. You can ask a parent, carer or trusted adult to help you contact us.

3.0 Procedure

3.1. Who we are

3.1.1. Clinical Partners Ltd and OAC help provide health and care services. We decide why and how some information about you is used. Sometimes we work with other health or care organisations, and we agree who is responsible for looking after your information.

3.2. What information we may use

3.2.1. The information we use depends on the care or service you receive. It may include:

• your name, date of birth, NHS number, address, phone number and email address;

• information about your health, such as referrals, assessments, diagnoses, medicines, allergies, test results, appointments and care plans;

• information about your parent, carer, next of kin or another person who helps look after you, if this is needed for your care or safety;

• sensitive information, such as health information and, where needed, information about things like ethnicity, religion, disability or other personal details, if this helps us care for you, keep you safe or meet the law.

3.3. Why we use your information

3.3.1. We only use information when we have a good reason. We may use it to:

• help give you safe and joined-up care;

• arrange referrals, appointments, assessments, treatment and follow-up care;

• talk to doctors, nurses, therapists or other people involved in your care;

• help keep you or someone else safe;

• follow rules that health and care organisations must follow;

• check that our services are safe and working well;

• look into worries, complaints or incidents;

• plan and improve services, usually using information that does not directly identify you;

• keep our computer systems and records secure

3.4. The rules that allow us to use your information

3.4.1. Data protection law says we must have a proper reason before we use personal information.

Depending on the situation, we may use your information because:

• we need it to provide a service or meet a contract;

• we need it to do a task in the public interest, such as helping with health or care services;

• the law says we must use or keep certain information;

• we have a legitimate reason, and we have checked that your rights are protected;

• we need to protect someone’s life.

3.4.2. Some information is extra private, such as health information. We only use this when the law allows it, for example to provide health care, protect public health, keep someone safe or meet an important public interest reason.

3.5. When we share confidential patient information

3.5.1. If information is needed for your direct care, we may share it with health and care professionals who are helping you. We only share what they need to know.

3.5.2. If information is used for things that are not direct care, such as research or planning, we try to use information that does not identify you. If we need to use information that identifies you, we will only do this when there is a clear legal reason or consent where needed.

3.6. Who we may share your information with

3.6.1. Sometimes we need to share information with other organisations. We only do this when

it is needed, fair and allowed by law. This may include:

• NHS hospitals, GP practices, mental health services, community services, pharmacies and other health or care providers;

• integrated care boards, local councils and social care services, for example for funding or checking invoices;

• your school, parent or carer, if this is appropriate and allowed;

• laboratories, diagnostic services and specialist clinical services;

• regulators, auditors or professional bodies, when required;

• safeguarding teams, police or emergency services, if needed to protect someone or follow the law;

• IT and secure messaging suppliers who help us run our services safely;

• research, planning or evaluation partners, where safeguards are in place.

3.6.2. We also use trusted suppliers to help provide services. They must follow rules about keeping information safe. Examples include:

• Salesforce, which helps us manage patient information;

• Heidi, which helps write up assessments;

• Yoti, which helps check identity for prescriptions.

3.6.3. Before sharing information, we make sure the right agreements and safety checks are in place.

3.7. If your information is sent outside the UK or Europe

3.7.1. Some information may be stored or used outside the UK or Europe by people who work for us or by our trusted suppliers.

3.7.2. If this happens, we use legal safeguards to help keep your information protected. This means we only send information where the country has suitable protection rules, or where special contracts are used so the organisation must protect your information properly.

3.7.3. We take reasonable steps to keep your information safe wherever it is handled.

3.8. How long we keep your information

3.8.1. We keep information only for as long as we need it. How long we keep it can depend on the type of record, the service you use, the law and what is needed for safe care. When we no longer need information, we delete it safely, make it anonymous or archive it in line with our rules.

3.9. How we keep your information safe

3.9.1. We have security measures to protect your information. These include limiting who can see records, using secure systems, training staff, checking activity, reporting problems and making sure suppliers follow our rules.

3.10. Your rights

3.10.1. You have rights over your personal information. Depending on the situation, you may be able to:

• know how your information is being used;

• ask for a copy of your information;

• ask us to correct information that is wrong or missing;

• ask us to delete information in some situations;

• ask us to limit how we use information in some situations;

• object to us using information in some situations, although this may not apply to health records needed for care;

• ask for information to be moved to another service, where this right applies;

• ask that important decisions about you are not made only by a computer, unless the law

  allows this.

3.10.2.Some rights may not apply all the time. This can happen if information is needed for your care, safety, legal duties, public health or to deal with legal claims.

3.11. Children and young people

3.11.1. We will think about your age, understanding, wishes and best interests when we use information about you. We will try to explain things clearly. We may share information with your parent, carer or someone with parental responsibility when this is allowed and appropriate. We will also think about your privacy, safety and what you are able to decide for yourself.

3.12. How to contact us

3.12.1. If you have questions about this notice, or if you want to ask about your information or your rights, you can contact us:

Data Protection Officer: Andrea Hughes

Email: dp@clinical-partners.co.uk

Address: Clinical Partners, Unit 6, Chaldicott Barns, Tokes Lane, Semley, Wiltshire, SP7 9AW

3.13. If you are unhappy

3.13.1. If you are unhappy about how we have used information, please contact us first so we can try

to help. You can also complain to the Information Commissioner’s Office. This is the UK organisation that checks data protection rules are followed.

Information Commissioner’s Office

Website: ico.org.uk

Telephone: 0303 123 1113

3.14. If this notice changes

3.14.1. We will check this notice regularly. If our services, partnerships, legal duties or information sharing arrangements change, we may update this notice.

4.0 Review and Approval

4.1. This SOP will be reviewed annually or upon a change in approach /legislation / regulation – whichever is sooner.

4.2. All staff are responsible for having knowledge of this process.

5.0 Definitions

6.0 References

7.0 Related Documents

7.1. This policy should be read in conjunction with the following Clinical Partners policies and procedures:

• Privacy Notice for Clinical Partners

Website, Telephone Services and Mailing Lists

How we collect and use data from our website

When you interact with us, whether it's through our website, online (web) forms, the telephone lines displayed on our website or surveys we as an organisation will collect information relating to you.

We are committed to collecting only the data necessary for specific, legitimate purposes defined in law and wish to be transparent with all users of our website and telephone services over the processing of personal data that occurs.

We therefore would like to advise you on the following:

Website analytics and tracking

We use a service called Hotjar to better understand how users interact with our website. This helps us improve your experience by showing us things like which pages you spend the most time on and which links are most popular.

Hotjar uses cookies and other technologies to collect data about your device and browsing behaviour, such as your device’s IP address (stored in an anonymised form), screen size, browser type, and general location. This information is stored in a pseudonymised user profile. Neither we nor Hotjar will use this information to identify you as an individual. You can find more details in Hotjar’s privacy policy.

You have the right to opt out of Hotjar's data collection. You can do so by following this opt-out link. By submitting your personal data to us and/or using our website, you consent to our processing of your data in the ways described here.

Tracking of calls to our phone numbers

For visitors who call us from our website, we generate a unique reference number for each call. This functionality creates an identity marker for each call; it does not directly identify you as an individual but rather lists allows us to track areas of interest in our website and services.

Only authorised Clinical Partners staff can access and track the calls made to the numbers on our site with the sole purpose being to enable us to better understand which our services lead to calls to our phone numbers.

Web forms

In some areas of our website we offer call back services for anyone interested in hearing more from us. Where this is the case we utilise specific web forms that invite visitors to fill in their contact details and desired time for a call back.

In these instances we may again track this activity through the use of an identity marker that does not directly identify individuals. This allows us to understand which of our services are currently of interest to people and the uptake of our services.

Marketing exclusion audiences

As part of our commitment to responsible marketing we may process limited data (contact details and a generic listing of the service you receive from us through) to ensure we do not add you to mailing lists regarding or provide you with updates on our services that you are already utilising or not relevant for you.

As with all aspects of our marketing you may object to the use of your data for this purpose by contacting us. Similarly our service communications and updates sent for these purposes feature the opportunity for you to unsubscribe.

Our legal basis for processing your data

To process your personal data, we rely on specific legal bases set out by data protection law.

• Legitimate Interests: We may process your data when it is necessary for our legitimate business interests, such as to improve our services and understand customer demand or ensure the security of our systems, as long as your fundamental rights and freedoms are not overridden.

• Consent: In specific situations, we will ask for your consent to collect and process your personal data. We will always make it clear which data is necessary for a particular service for example to receive our mailing lists and call back services.

Data we collect

When you visit our website, we may collect the following types of data:

• Device and Browser Data: We collect information from the device and application you use to access our services. This includes your IP address, operating system, device type, and browser.

• Page Tags: We use third-party tracking services with cookies and page tags (web beacons) to collect data on website visitors, including usage and user statistics.

• Log Data: Our web servers keep log files that record data about each visit to our website. This includes your IP address, internet service provider, the files viewed on our site, operating system versions, time on site, device type, and timestamps.

• Telephone IDs: Where you telephone a Clinical Partners number we will generate a unique identifier for each call made to our telephone numbers listed in our advertised services.

Why we collect this data

We collect and process this data to:

• Understand and plan for customer demand and interest, seeing which areas of our services are most required.

• Ensure our website content is presented in the most effective way for you and your device.

• Administer and manage our site.

• Help with internal operations such as troubleshooting, testing, and data analysis.

• Work with analytics and search engine providers that assist us in the improvement and optimisation of our site.

How long we retain your data

In line with our obligations under the UK GDPR, we will only keep your data in an identifiable form for as long as is necessary to achieve the specific purposes for which it was collected, including compliance with our legal and regulatory obligations. The length of time we keep your data will vary depending on the type of data and the purpose for which it was collected. For example, some data may need to be retained for a certain period to meet our legal record-keeping requirements, while other data, such as anonymous website analytics, may be retained indefinitely to help us track long-term trends.

Where your data is stored

All information you provide to us is stored on our secure servers. Any payment transactions will be encrypted.

Please note that some of the data we collect may be transferred to, and stored at, a destination outside the UK and EEA. This data may be processed by staff operating outside the UK/EEA who work for us or one of our suppliers (such as Meta for advertising exclusion audiences).

To ensure your personal data remains protected during these transfers, we will only transfer data outside the UK/EEA where one of the following safeguards is in place:

• Adequacy Regulations: We transfer the data to a country that the UK has deemed to provide an adequate level of protection for personal data.

• Appropriate Safeguards: We ensure the transfer is governed by appropriate safeguards, primarily through the use of the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs). These contracts legally bind the recipient to protect your data to the standard required by UK GDPR.

We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy.

Cookies

Our website uses cookies to improve your experience and our services. A cookie is a small piece of data transferred from a web server to your web browser or hard drive when you visit a website. If your web browser is set to accept cookies, they will be stored in the web browser or hard drive until their expiration date is reached or you delete the cookies yourself. We will inform you if we use any cookies that collect your personal information and request your consent prior to doing so. You can remove cookies from your computer at any time and can also choose to disable cookies in your internet browser settings.

Links to other websites

This website may contain hyperlinks to websites that are not operated by us. These hyperlinks are provided for your reference and convenience only and do not imply any endorsement of the activities of such third-party websites or any association with their operators. We do not control these websites and are not responsible for their personal data practices. We urge you to review any privacy policy posted on any site you visit before using the site or providing any personal data about yourself.

Unsubscribing from communications

If you do not wish to receive emails from us and want to be removed from our electronic mailing list, please email us with "email unsubscribe" in the subject heading. If you also wish to be removed from our postal marketing database, please let us know by emailing us with "mail unsubscribe" in the subject heading or writing to us at the address given below. You may unsubscribe by emailing help@clinical-partners.co.uk.

Clinical Partners imagery

The people featured in the images used on our website and marketing materials are models and do not have any direct connection to Clinical Partners or any specific mental health condition.

Use of your data for research

As part of our commitment to service improvement and supporting the advancement of health care in our specialist treatment areas we will from time to time participate in research activity.

The type of research we conduct

As part of our commitment to service improvement and supporting the advancement of healthcare in our specialist treatment areas, we will from time to time participate in research activity.

This will include the following:

• Internal Service Improvement: Clinical Partners undertakes internal activities focused on improving clinical pathways and better understanding trends in patient data. For this purpose, we process your data under the basis of Legitimate Interests. We aggregate and anonymise patient data prior to conducting analysis, which means you will not be identifiable from the resulting dataset.

• External Health Research: We may partner with third-party research institutions to conduct specific research projects to gain further insights into our treatments. This processing falls into two categories:

  1. Identifiable Studies (Consent-Based): If we identify you as a potential participant in a study involving your identifiable personal data, we will provide you with information about the specific research project and ask for your informed consent prior to using your data. You are under no obligation to take part in the study.

  2. HRA-Approved Studies (Public Interest/Non-Identifiable Data): Where a research study relies on non-identifiable or pseudonymised data and is considered to be of substantial public interest, we will ensure that the study has obtained the necessary ethical and legal approvals, including Health Research Authority (HRA) Approval.

Our legal basis for processing your data

To process your personal data for research, we rely on the following legal bases:

• Legitimate Interests: We may process your data when it is necessary for our legitimate interests as a business or those of a third party, provided your fundamental rights and freedoms are not overridden. This includes using your information to improve and develop our service offerings.

• Consent: We rely on your explicit consent when you volunteer to participate in a specific research study involving your identifiable data.

• Public Task: We rely on Public Task when processing is necessary to conduct research that is considered to be of substantial public interest and has received HRA Approval.

For special category data such as health information, we rely on the following legal bases:

• Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes

• Explicit Consent

If you are taking part in a specific research study, please read this privacy notice alongside any informed consent forms, study specific privacy notices, and/or study documents that are provided to you in relation to the collection, use, and transfer of your personal data for the stated research purpose.

Data we collect

If you choose to take part in a research study, the entity which is conducting the research related activity with us will collect personal data about you including your name, contact information and further details about your treatment. Please refer to the research study documentation for further information about the type of data collected in the study.

For research undertaken internally, we aggregate and anonymise patient data prior to conducting analysis, which means you will not be directly identifiable from the data set.

How long we retain your data

If you choose to take part in a research study with our external partners, details of how long your data will be retained in identifiable format will be provided in the study specific documentation ascertaining your consent.

For research undertaken internally, we may store our anonymised datasets indefinitely to allow for long-term trend analysis, historical comparisons, and future studies without the need to recollect or re-anonymise the data.

Where your data is stored

If you choose to take part in a research study with our external partners, details of where the data will be stored will be detailed in the study specific documentation.

For our internal research activities, We only store your healthcare information on servers located in the UK.

Your rights in relation to research

When we use your data for research or to improve our services, you have the following rights:

1. If You Take Part in a Specific Research Study

   • Right to Stop: If you volunteer to take part in a specific clinical study and give your consent, you have the right to withdraw your consent at any time.

   • What this means: We will stop using your data for the study from that point forward. Withdrawing consent will not affect your ongoing medical care or the lawfulness of any research done before you withdrew.

2. If We Use Your Data for Public Interest Research or Service Improvement

   • Right to Object: You have the right to object to us using your data for general public health research (approved by groups like the HRA) or for our own internal service improvement and evaluation.

   • What this means: If you object, we will stop using your data for these purposes. However, because this research is often carried out for essential public health reasons or legal requirements, we may sometimes have the right to continue processing your data if we can demonstrate that the compelling public interest in conducting the research outweighs your objection.