Your data's journey through Nuffield Health Community Rehabilitation Programmes

About the Programmes

Nuffield Health’s Community Rehabilitation Programmes are designed to address unmet public health needs. Some of these programmes focus on rehabilitation, while others aim to maintain function or enhance knowledge and wellbeing. Because of this, the scope, duration, and data requirements of each Community Rehabilitation Programme may differ significantly.

The current Nuffield Health Community Rehabilitation programmes include:

• Joint Pain Programme
• Cancer Activity Programme
• Covid-19 Rehabilitation Programme
• Long Term Conditions Rehabilitation Programme
• Cardiac Rehabilitation Programme

We only collect information that is necessary to support you and to deliver our services safely and effectively.

What information may be collected

Contact Information

This may include your address, telephone number and/or email address. The type of contact information required depends on how you access the Community Rehabilitation Programme. It may be used to manage your referral, contact you with updates, or create a membership to provide access to our Fitness and Wellbeing Centres. The specific use of this information may differ depending on the programme.

Demographic Information

You may be asked to provide demographic details such as gender, ethnicity, and date of birth. This information can help us understand how different groups experience outcomes and improve future service delivery. In some programmes, this data is necessary to inform your care or tailor the service appropriately.

GP or Healthcare Professional (HCP) Details

Some programmes involve referrals from a GP or other healthcare professional (HCP) or may require oversight from a named clinician for safety or governance reasons. In these cases, we may ask for the professional’s name and contact details. This allows us to share relevant updates with them and ensure continuity and coordination of care.

Outcome and Assessment Information

You may be asked to complete questionnaires, functional assessments or feedback forms, or share information about your general wellbeing and physical function. This helps us track progress and ensure the programme is working effectively. Assessment content and timing vary between programmes, and we will explain what information is being collected and why.

How we collect your information

Depending on the specific Community Rehabilitation Programme you are participating in, we may collect your information through several methods, as outlined below:

• Internet-based forms
  Some programmes require you to complete an online referral form at the outset. In other cases, you may be sent a secure link to an online form that gathers more detailed information to help progress you through different stages of the programme.
• Email
  You may receive a secure email link to complete a questionnaire. These may request additional information such as details about your clinical history, or they may be used to track how the programme is affecting your health and wellbeing over time.
• Telephone / Video call
  In some programmes, our staff may collect information from you during a telephone or video consultation. For example, the Covid-19 Rehabilitation Programme includes a video triage. During these calls, clinical staff may ask you questions and record your responses on a secure internal system to support the delivery of care.
• Mobile applications
  Certain programmes make use of apps like MyWellbeing, MyTherapy, or Nuffield 24/7. These apps may collect information about your interactions with programme content or deliver questionnaires at key time points during your rehabilitation journey.
• Internal systems
  When information is gathered via phone, video, or in-person consultations, it may be entered into our secure internal systems by the staff member leading your programme. This ensures continuity and that all relevant data is available for service delivery and support.

Why we collect your data

We collect the types of information outlined above for a number of reasons, which vary depending on the specific Community Rehabilitation Programme you are enrolled in. These include:

• Identifying individuals
  To deliver the programme safely and effectively, the staff member supporting you must be able to correctly identify you—especially if your responses to questionnaires or assessments require follow-up, or if we need to contact you in relation to your ongoing care.
• Account creation
  Some programmes require an account to be set up—this might be to create a membership at one of our Fitness and Wellbeing Centres, or to track your progress through the programme. This allows us to send you the right communications or questionnaires at the right time.
• Caller verification
  In programmes that involve regular phone contact, we use the information you have provided to verify your identity before any discussions take place. This ensures we are speaking to the correct person and protects the confidentiality of your data.
• Evidencing impact
  All of our programmes are designed to improve health and wellbeing. To demonstrate their effectiveness—both to individuals and organisations such as employers, insurers or NHS commissioners—we collect relevant clinical and other data. This helps us meet service specifications, monitor programme quality, and make improvements where needed.
• Research
  To help improve public health more broadly, we may use anonymised data to publish research studies, editorials or papers that describe how our programmes work and the outcomes they achieve. We will always ask for your explicit consent before using your anonymised data for research. All Nuffield Health research is subject to ethical approval by an academic institution and oversight by our Research Expert Advisory Group. Please note that consent for research purposes is separate from data protection consent.

Who we may share your data with

How your data is shared varies depending on the Community Rehabilitation Programme and its specific requirements. Below are the common ways your information may be shared:

• Bill payer
  If the programme has an associated cost, we may share certain necessary data with the organisation responsible for payment, such as your employer or insurer, according to an agreed service delivery specification. We only share the minimum amount of information required.
• Employer
  If you were referred to a programme by your employer, we may share anonymised and aggregated data with them, but only with your prior consent. We will never share more data than necessary.
• Healthcare Professional (HCP)
  Where relevant, we may share clinical or other pertinent information with your GP or other healthcare professionals to support continuity of care, keep them informed of your progress, or communicate your inclusion or completion of a programme. Only the essential information needed for your care will be shared.
• For research purposes
  When data is used for research, only anonymised information will be shared with third parties conducting research, and only with your consent.

Fair and lawful processing

All organisations processing personal data must do so fairly and lawfully. To comply with this, we must have a lawful basis for processing your personal data. While consent is one such basis, it is only relied upon in limited situations. As such, we may not always ask your consent each time we use your data if what we are doing is linked to your treatment or doing something we must do by law. When delivering Community Rehabilitation Programmes, Nuffield Health primarily processes data under the following lawful bases:

• Article 6 (1)(a): You have given consent to process your data for specific purposes.
• Article 6 (1)(b): Processing is necessary to perform a contract with you or take steps before entering into a contract.
• Article 6 (1)(f): Processing is necessary for legitimate interests unless overridden by your rights.
• Article 9 (2)(a): You have given explicit consent to process sensitive personal data for specific purposes.
• Article 9 (2)(h): Processing is necessary for preventive or occupational medicine, medical diagnosis, health or social care, or the management of health or social care systems under English law or contract with a health professional.

Your rights in respect of your Personal Data

The law gives you certain rights regarding the personal information we hold about you. Below is an overview of the key rights available to you:

• Data Subject Access Request – With some exceptions designed to protect the rights of others, you have the right to request a copy of the personal data we hold about you. Where the data is information you have provided, you have the right to receive it in a common electronic format and to share it with others if you wish (Right to Data Portability).
• Right to Rectification – You have the right to request correction of any factual inaccuracies in your personal data. This right does not cover matters of opinion, such as assessments of performance or clinical opinions.
• Right to Erasure – In limited circumstances, you may request that personal data we hold about you be deleted (the “right to be forgotten”). This right generally does not apply where we have a valid legal reason to retain the data (for example, because of legal obligations).
• Right to Restrict Processing – In some situations, you may request temporary restrictions on how we process your data, for example, if you contest its accuracy or if you challenge our legitimate interest basis for processing.

Please note that this is not an exhaustive list of your rights under data protection law. To see a full list of your rights please visit www.ico.org.uk

When things go wrong

At Nuffield Health, we take pride in delivering high-quality services and maintaining positive customer satisfaction. However, we understand that occasionally you may have concerns about your experience within a Community Rehabilitation Programme. It is important for us to learn from such instances to continually improve our services, so we conduct thorough investigations when concerns are raised.

To properly investigate your concern, we may need to share information with our compliance team, senior leaders, or other parties not directly involved in your care. For example, if you were referred to a programme such as the Joint Pain Programme via your GP, we might need to discuss your concern with your GP to fully investigate it. We will only share the minimum amount of information necessary.

We may also need to share details of your concern with your clinician, rehabilitation specialist, or other healthcare professionals involved in your care to assist with the investigation.

If your concern is raised by a third party (e.g., regulator, solicitor, or another body), we may need to disclose your data to them to resolve, defend, or investigate the matter.

How long we will keep your personal data for

The length of time we retain your personal data is governed by national legislation and detailed in Nuffield Health policy. Generally, adult health records are kept for 8 years. For individuals under 18, records will be retained until their 25th birthday, or for those aged 17 at the start of treatment, until their 26th birthday.

If your data is collected as part of a Community Rehabilitation Programme such as the Joint Pain Programme, Covid-19 Rehabilitation Programme, or others, and you have given consent for your data to be used for anonymised research, your personal data may be retained for up to 10 years.

Automated Decisions

Each customer journey is unique, and our expert clinical and administrative teams ensure your care is tailored specifically to your needs. Therefore, no part of your journey is based solely on automated decision-making; all decisions involve human oversight and professional judgement.

Further Information

For more details about how your data may be processed or if you have any questions, please speak with the team at your local Nuffield Health Fitness and Wellbeing Centre.

If you are not satisfied with how we handle your personal data or wish to exercise any of your rights related to your data, you can contact the Data Protection Officer at dataprotectionofficer@nuffieldhealth.com.

If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO) by calling 0303 123 1113 or via their website at https://ico.org.uk.