Sexual Health Service privacy notice

Why are we collecting your information?

This Privacy Notice has been written to inform you that York and Scarborough Teaching Hospitals NHS Foundation Trust (the Trust) processes information about you in order to provide sexual health care services.

This information will be used to provide free sexually transitted infection (STI) testing and treatment, to notify sexual partners of people who have been diagnosed with an STI for the diagnoses and management of various specified STIs and for the provision of contraception, counselling and social support.

In addition, information is required to provide performance data including numbers of new service users, first attendance, follow up appointments, waiting times and other quality measures.

Who do we collect your information from?

Directly from yourselves
Sexual partners that may have given us your details
External provider partners that may have given us your details, such as GPs, community nurses, social workers etc
We also work with Preventx to provide a postal screening service for STIs. The Trust only access and record details of positive test results.

To see Preventx privacy information please go to: https://www.test.me/privacy

Who are we?

The Trust is a ‘Data Controller’, this means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation.

The Trust has appointed Rebecca Bradley (Head of Information Governance) to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the Trust is compliant with Data Protection legislation and to oversee data protection procedures. The DPO contact details are:

York and Scarborough Teaching Hospital NHS Foundation Trust
York Hospital
Wigginton Road
York
North Yorkshire
YO31 8HE
yhs-tr.Information.Governance@nhs.net

In this case when you send your information to Preventx they also act as a Controller. The Trust and Preventx have an Information Sharing Agreement documenting our relationship, this is available on request.

What Information are we collecting?

Basic information about you, such as name, address, date of birth, NHS number and next of kin details
Contacts we have had with you, such as day care clinics and/or home visits
Notes and reports about your health and any treatment and care you need
Details and records about the treatment and care you receive
Relevant information from other healthcare professionals

We may also process special categories of information that may include:

Nationality, racial and/or ethnic origin
Religious or philosophical beliefs
Health information: e.g. results of laboratory tests
Notes and reports about your health, treatment and care.
Sex life or sexual orientation

What is our lawful basis for processing your information?

Any personal data we process is done so in accordance with the UK. Our lawful basis for processing are:

Article 6(1)(e) Public Task: the processing is necessary to perform a task in the public interest, or our official functions, which have a clear basis in law.

Where we process your special category information our lawful basis are:

Article 9(2)(h) Health and Social purposes; Schedule 1, Part 1 (c) medical diagnosis, (d) the provision of health care or treatment, or (f) the management of health care systems or services or social care systems or services.
Article 9(2)(i) The processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or high quality and safety of health care and medicinal products or devices.
Article 9(2)(j) The processing is necessary for archiving purposes in the public interest, Schedule 1, Part 1 scientific or historical research purposes or statistical purposes in accordance with Article 89 (1)

We do not need your consent to use your personal information for the delivery of direct care because we have a public task to do this. We use personal information because it is necessary for us to use this to carry out our activities as an NHS organisation.

How long do we keep your information for?

The Trust follows NHS Digitals recommended retention schedule which can be found in the Records Management Code of Practice for Health and Social Care 2016

Who do we share your information with?

We may share your information with:

Your GP,
Other sexual health services where needed,
Social work teams if required,
Where required, other health professionals such as midwives and school nurses, other medical professionals
Other 3rd party organisations such as charities, after a discussion with yourself
Shared anonymised data with our commissioners, such as relevant local authorities and with Public Health England and other statistical auditing services.

Do we transfer your information outside the UK?

We do not transfer this information outside the UK.

What rights do you have over your data?

Under GDPR data subjects have the following rights in relation to the processing of their personal data:

to be informed about how we process your personal data. This notice fulfils this obligation
to request access to your personal data that we hold, and be provided with a copy of it
to request that your personal data is amended if inaccurate or incomplete
to request that your personal data is erased where there is no compelling reason for its continued processing
to request that the processing of your personal data is restricted
to object to your personal data being processed

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO on the address provided above. To put in a Subject Access Request please contact:

01904 725680
yhs-tr.SubjectAccessRequests1@nhs.net

If we cannot resolve your concerns you may also complain to the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the Trust has handled your personal data. You can do so by contacting:

First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
casework@ico.org.uk // 0303 123 1113

Version 3 - 20/03/2023