Your Data’s Journey through a Nuffield Health Programmes For All

What information may you be asked to provide

Nuffield Health’s Programmes For All exist to address unmet public health needs. Some Programmes For All exist as rehabilitation programmes whilst others exist to maintain function or improve knowledge. As such, each Programme For All may differ significantly from one another in their scope, duration and information you may be asked to provide. The current Nuffield Health Programmes For All include:

• Cystic Fibrosis Programme (CF Programme)
• Joint Pain Programme
• STAMINA: Lifestyle Change in Prostate Cancer
• COVID-19 Rehabilitation Programme
• School Wellbeing Activity Programme (swap)

Please note, no identifiable data is collected as part of the School Wellbeing Activity Programme.

We will never ask for more information about you than is necessary to ensure the quality of the service you receive. An outline of what information may be required is outlined below:

Contact Information – this may include an address, contact telephone number and/or email address depending upon how you enter a Programme For All. This information may be used to create you a membership to access our Health and Wellbeing Centres dependent upon which Programme For All you are engaging in and to contact you to progress your request.

Demographic Information – demographic information such as gender, ethnicity and date of birth may be required for certain Programmes For All where such demographic information may impact expected outcomes or to help us understand how a Programmes For All outcomes differ so that we can improve our Programmes For All to better serve the nation.

GP Details – where you have been referred in to a Programme For All from your GP or where a Programme For All aims to address specific health needs such as the Joint Pain Programme, we may ask you to provide your GP details so we can inform them of any relevant clinical changes to ensure you receive the best quality of care for your needs.

Outcomes Related Information – to evidence the impact of our Programmes For All at the individual level and societal level, you may be asked to provide specific information that allows us to understand your current state of health and wellbeing and any subsequent changes as a result of taking part in a Programme For All. These can take the form of questionnaires or objective assessments such as a Joint Pain Health M.O.T. (Joint Pain Programme) where a trained member of staff such as a rehabilitation specialist will undertake certain measurements with your permission such as your height and weight, resting blood pressure or measures of functional capacity. You will be fully briefed prior to undertaking any objective assessment to ensure you understand the tests involved and purpose.

Where we may collect your information from

Depending upon the Programme For All you are taking part in, we may collect your information from multiple ways outlined below:

Internet based forms – Some Programmes For All require you to complete an online referral form whilst in other Programmes For All, you may be emailed a link to a secure online form to complete more detailed information that may be used to progress you through different stages of a Programme For All.

Email – In some Programmes For All, you may receive an email with a secure link to complete a questionnaire to either provide additional information not already known about your clinical history for example, or to complete questionnaires to help us understand how a given Programme For All might be affecting you.

Telephone / Video call – Some information may be recorded by our staff as part of a telephone call or video call such as the Video Triage within the Covid-19 Rehabilitation programme. You may be required to answer questions from our clinical staff who may record your results on a secure internal system for the purposes of providing the service associated with a given Programme For All.

Mobile applications – Some Programmes For All use applications such as MyWellbeing, MyTherapy or Nuffield 24/7 and as such may collect information relating to the content you access on these apps or may push questionnaires to you at different time points during a Programme For All to complete short questionnaires.

Internal Systems – Dependent upon the Programme For All you are taking part in, where information might be collected via telephone / video call or during a face to face consultation, information you provide may be captured on internal systems by the member of staff conducting your Programme For All.

Why we need this information and how we might use it

We are required to collect the information that we have outlined above for a number of different purposes which are listed below and will vary depending on which Programme For All you are taking part in.

Identifying individuals – The individual delivering your Programme For All will need to identify you in the result that any results or questionnaire responses require follow-up or where they need to contact you with regard to the delivery of the Programme For All you are taking part in.

Account creation – Some Programmes For All require you to have an account for a variety of reasons such as: creating a membership to our Fitness and Wellbeing Centres or to track your journey through a Programme For All to ensure you receive the correct communications or questionnaires at the correct time points.

Caller verification – Certain Programmes For All have digital components that involve regular calls with our staff, your information will be required to ensure we are speaking to the correct person prior to any further discussions.

Billing – Whilst some Programmes For All are delivered for free, others are delivered at cost price which may be paid for either by the individual or by an organisation such as your employer.

Evidencing Impact – All Programmes For All exist to improve the health and wellbeing of the individuals they service. To allow us to continually assess the impact of our Programmes For All, we need to collect clinical or other information relevant to the aim of a given Programme For All. Further, where many people are referred to Programmes For All by their employer / insurer / NHS, we must evidence the impact of the service on those people and submit this information in line with any agreed service specification.

Research – One way we can help improve the health of the nation is to be open and transparent about our Programmes For All, detailing how they are conducted and how they might affect the individuals who take part. One way to achieve this is to publish anonymised data from our Programmes For All as research studies.

We will always ask for your consent before using your anonymised data for research purposes and all research conducted by Nuffield Health is overseen by the Nuffield Health Research Expert Advisory Group. Please note that this is not a data protection consent. No research will take place without prior ethical approval from an academic institution.

When things go wrong

• Nuffield Health pride ourselves with the quality of our services and consistent positive customer satisfaction, however, we understand that in a small number of cases you may have cause to raise a concern regarding an element of your patient journey. It is important that Nuffield Health learn from these episodes to continually enhance services and as such we carry out thorough investigations. In order to fully investigate your concern, we may need to share information with our compliance team, senior leaders or other parties not directly involved with your care. For example, if you were referred to a Programme For All such as the Joint Pain Programme via your GP, we might need to discuss your concern with your GP in order to fully investigate it. In any case, we will only share a limited amount of information, as little as is necessary to investigate the concern. We may also need to share details of your concern with your clinician, rehabilitation specialist or other professionals involved in your care for the purposes of the investigation.
• If the concern has come via a third party e.g. a regulator, body or solicitor, we may need to disclose your data with them in order to resolve, defend or investigate a concern.

Who your Personal Data may be shared with

There are variations on who your data may be shared. These differences are outlined below.

• Bill payer - Where a Programme For All has an associated cost to take part, we may share some data with the bill payer as part of an agreed service delivery specification. We will never share more data than is absolutely necessary.
• Employer - Where you may have been referred to take part in a Programme For All from your employer, we may share anonymised, aggregated data with them with your prior consent. We will never share more data than is absolutely necessary.
• GP - With your prior consent, we may share clinical or other relevant data with your GP to ensure any continuation of care or to inform your GP of your inclusion, exclusion or completion of any programme. We will never share more data than is absolutely necessary.
• For research purposes - Where data from a Programme For All may be used for the purposes of research, we may share anonymised data with a third party for the purposes of conducting research. This may include academic institutions. Please note, no data will be shared without your consent.

Fair and Lawful Processing

Each organisation is required to demonstrate that they are processing personal data fairly and lawfully, to do this we must have a ‘lawful basis for processing’ personal data.

• Article 6 (1)(a) The data subject has given consent to the processing of his or her personal data for one of more specific purpose
• Article 6 (1)(b) Processing is necessary for the performance of a contract to which the individual is party or in order to take steps at the request of the individual prior to entering into a contract.
• Article 6 (1)(f) Legitimate interests: the processing is necessary because of a legitimate interest or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
• Article 9 (2)(a) The data subject has given explicit consent to the processing of those personal data for one or more specific purposes.
• Article 9 (2)(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of English Law or pursuant to contract with a health professional.

What does this actually mean?

In order to provide you with the level of support agreed to in our contracts in a safe and effective way we need to process the data discussed, and as such, we are doing so lawfully. This means we may not always ask your consent each time we use your data if what we are doing is linked to your treatment or doing something we must do by law.

Your rights in respect of your Personal Data

The law gives you certain rights in respect of the information that we hold about you. Below is a short overview of the key rights available to you.

• Data Subject Access Request - with some exceptions designed to protect the rights of others, you have the right to a copy of the personal data that we hold about you. Where the data is data that you have given to us, you have the right to receive your copy of it in a common electronic format, and to provide copies of it to other people if you wish (Right to Data Portability).
• Right to Rectification - you have the right to have the personal data we hold about you corrected if it is factually inaccurate. This right does not extend to matters of opinion, such as assessments of performance or fitness to work.
• Right to Erasure - in some limited circumstances, you have the right to have personal data that we hold about you erased (the “right to be forgotten”). This right is not generally available where we still have a valid legal reason to keep the data (for example, because we are obliged to do so by law).
• Right to Restrict Processing - you also have the right in some circumstances to request that temporary restrictions are placed on how we process your personal data, for example if you contest its accuracy or where we are processing it on the basis of our legitimate interest and you contest our assessment that our interest overrides your rights.

The above is not a complete and exhaustive statement of the law.

How long we will keep your Personal Data for

The length of time that Personal Data is stored is set by national legislation and is outlined in Nuffield Health Policy. Adult health records are generally kept for 8 years. For individuals who are aged under 18, records will need to be kept until their 25th birthday or those who were aged 17 at the start of treatment until their 26th birthday. Where your data is collected as part of a Programme For All such as the Joint Pain Programme, Covid-19 Recovery programme or other, it may form the basis of anonymised research publications if you have given consent for your data to be used as such. In this instance, your personal data may be held for up to 10 years.

Automated Decisions

Each customer journey is different, and our highly skilled clinical staff and our administration team will ensure that you receive a bespoke journey that is right for you. As such, all of our decision making is based on the expert opinion of our team and no part of your journey will be based on wholly automated decisions.

Further Information

For further information about how your data may be processed or to ask any questions please raise this with the member of staff delivering your Programme For All such as the Joint Pain Advisor (Joint Pain Programme), Rehabilitation Specialist (COVID-19 Rehab Programme) or Personal Trainer (Cystic Fibrosis Programme) who can direct your query to the relevant persons within the Charity Team. If you are not satisfied with how we handle your personal data or a request to exercise one of your rights in relation to your data, you can contact the Data Protection Officer on dataprotectionofficer@nuffieldhealth.com

Should you remain dissatisfied you have a right to complain to the Information Commissioner’s Office on 0303 123 1113 or through their website https://ico.org.uk/