Product Description

 NHS Trusts and Community Provider Organisations use this product to make sure that you receive the appropriate care and treatment during and after discharge from hospital. It lets your care teams see relevant information about you, at the same time in the same place, to monitor your supported discharge from hospital. This allows your care team to work together to make sure you have all the care, equipment, medication and support you need when discharged from hospital.

What are the purposes for processing my personal data in this Product?

This Product processes personal information (called ‘personal data’ under data protection laws) about patients who have been or are being discharged from hospital and require a discharge plan to support the better coordination of your care when discharged from hospital with all of the organisations involved in your care. This includes information about your health, medical condition and the medication you are prescribed. The Product enables your care team to more effectively coordinate your discharge.

The use of the Product by NHS Trusts and Community Provider Organisations will improve the co-ordination of your care once discharged through better use of the information that the hospital and other organisations hold. This will include bringing together all required information into one place to support your discharge from hospital.

The Product enables your care team to identify the actions they can take to improve and support your care once discharged from hospital. Hospitals and Community Provider Organisations will use this Product to provide you with the best care at the most appropriate timeframe.

What personal data about me is processed in this Product?

Personal data which directly identifies you (we call this directly identifiable personal data) will be processed by NHS Trusts about patients who are having planned treatment scheduled, for the purposes above. Data that is processed by hospitals and community provider organisations that use this Product may include your:

• Name
• Address and postcode
• Telephone number
• Date of birth
• Age
• Gender
• Sex
• Living habits
• NHS number or hospital record number
• Health information, including information about your medical condition, symptoms, diagnosis and medication

Personal data about members of staff involved in the delivery of care may also be processed when using this Product, including the names of staff involved in providing care, their email address.

Who is my personal data shared with?

Your personal data is accessed and used by health and care professionals from both in the hospital and other organisations such as Local Authorities, [Trust to add other organisations with access] who are providing you with individual care and treatment, and support staff who need to support health care professionals to administer your care journey.

The Product will enable the NHS Trust to also share anonymous aggregated data with NHS England and the Integrated Care Board (ICB) about the use of the Product to help improve the Product in the future. This is statistical counts of data that don’t identify you. It is therefore not personal data.

UK GDPR Information

Controllers of your personal data

Under data protection law the NHS Trusts using the Product are the legal controllers of your personal data. The specific NHS Trusts using the Product are listed on the Product Description page of the NHS England website here.

Legal grounds for processing your personal data

The processing of personal data by NHS Trusts for the purposes explained above is permitted under the following legal grounds under data protection law (this is UK GDPR and the Data Protection Act 2018 (DPA 2018)):

• Public Task – Article 6(1)(e) of UK GDPR ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.
• Health Care – Article 9(2)(h) of UK GDPR ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…” In addition, the legal grounds under paragraph 2 of Part 1 of the DPA 2018 apply (health care purposes).

The personal data processed about patients by the NHS Trust for the purposes above is also confidential data. As the NHS Trust is processing your confidential data to provide you with individual care, it is relying on your implied consent to do this, as you would reasonably expect the hospital to process your personal information this way to provide you with care. The NHS Trust will keep your personal data confidential and only use and share it with other members of the care team to provide you with care, where you would reasonably expect them to, and subject to strict confidentiality controls to ensure your information remains confidential.

Processor acting on behalf of NHS Trusts

The data platform contractor, Palantir Technologies UK Ltd is a processor acting on behalf of the NHS Trusts who are using this Product. They provide the data platform and the technology that the Product uses and only act on the instructions of the NHS Trust.

Your rights under UK GDPR

You have the following rights under UK GDPR in relation to the processing of your personal data by the NHS Trust for the purposes above:

• Right to be informed
• Right of access
• Right to rectify
• Right to object

Further information about these rights is in the NHS Federated Data Platform Privacy Notice here. Your NHS Trust will also have a Privacy Notice on its own website which will explain more about how the Trust processes your personal data, your rights and how to exercise them.

Contact details for data protection officers in the NHS Trusts using this Product are here.

Does the National Data Opt Out or any other opt out apply to this Product?

The National Data Opt Out to the processing of your personal data by the NHS Trust for the purposes explained above. This is because the NHS Trust is processing your personal data to provide you with individual care and treatment and these opt-outs don’t apply in these circumstances.

Type 1 Opt Outs do not apply to the processing of your personal data by the NHS Trust for the purpose explained above, as no information from your GP Practice is being used.

More information

For more information about how personal data is processed within the Federated Data Platform please see the NHS Federated Data Platform Privacy Notice here.