Your data's journey through Nuffield Health Emotional Wellbeing
Discover how your data may be processed through our Emotional Wellbeing services
What information may you be asked to provide?
BOOKING YOUR APPOINTMENT
The data taken will vary depending your method of being booked for your Emotional Wellbeing assessment. This can be via:
- the Nuffield Health website
- the Nuffield Health booking agents over the phone
- your insurer
- your employer
Standard information taken regardless of method of booking will include:
- Postal Address
- Telephone Number
- Email (assistance for confirmation of bookings)
- Date of Birth
Some methods of booking may also include the following data being taken:
- Card details for payment
- Type of emotional difficulty experienced;
- Employer or insurer and details policy or referral /authorisation code (if relevant);
- Maximum session or maximum value allowed under insurer policy (if relevant)
Depending on your customer/patient journey it may be that your initial assessment is via telephone or face to face; depending on which will provide some variation in data requested.
Phone based assessment – when the call begins you will be asked a set of questions to protect your data to ensure we are talking to the right person. This may include information such as: address; date of birth; insurer; presenting issues.
You will then be asked questions regarding the history of your present condition; past mental health problems; social history including your occupation; previous treatment your received and by whom and other questions which will allow the Emotional Wellbeing practioner to understand the best course of treatment for your condition.
Face to face assessment – this will include the history of your present condition; past mental health problems; social history including your occupation; previous treatment you received and by whom and other questions which will allow the Emotional Wellbeing practioner to understand the best course of treatment for your condition.
Where we may collect your information from
There are a number of ways to enter the Emotional Wellbeing service through Nuffield Health. Depending on which way you access the service and how your appointment is booked will vary as to how we initially receive information about you. So information could be coming from:
- Yourself directly, either through the website or a direct booking
- Through another health professional working for, or outside, Nuffield Health
- You have previously had therapy through Nuffield Health and therefore the therapist may be able to see reports with regards to your previous treatment (this will vary depending on when you had treatment and in which location)
- Through your insurer or employer
Why we need this information and how we might use it
We are required to collect the information that we have outlined above for a number of different purposes which are listed below and will vary depending on who is paying for your treatment.
Data protection – personal data is required so that we can complete appropriate checks, such as call verification, to ensure we are speak to the right person.
To provide a smooth patient journey - email addresses and telephone numbers allow us to provide booking confirmation and to contact you to book and confirm future appointments.
Clinical treatment – to construct the most effective treatment plan for your condition or symptoms and ensure that we support you appropriately.
Billing – depending on who is paying for your treatment, where relevant, so invoices can be sent to you.
Fair and Lawful Processing
Each organisation is required to demonstrate that they are processing personal data fairly and lawfully, to do this we must have a ‘lawful basis for processing’ personal data.
Consent is probably the condition that has gained the most attention but we only rely on consent in limited circumstances e.g. to share information with a third party or your GP.
Emotional Wellbeing will mainly be processing data based on the following lawful basis for processing:
Article 6 (1)(b) Processing is necessary for the performance of a contract to which the individual is party or in order to take steps at the request of the individual prior to entering into a contract.
Article 6 (1)(f) Legitimate interests: the processing is necessary because of a legitimate interest or the legitimate interests of a third party unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests.
Article 9 (2)(h) Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of English Law or pursuant to contract with a health professional.
WHAT DOES THIS ACTUALLY MEAN?
In order to provide you with the level of support agreed to in our contracts in a safe and effective way we need to process the data discussed, and as such, we are doing so lawfully. This means we may not always ask your consent each time we use your data if what we are doing is linked to your treatment or doing something we must do by law.
Who your Personal Data may be shared with
Depending on who is your bill payer will mean that there are variations on who your data may be shared with. These differences are outlined below.
The Mental Health professional involved in your care via Nuffield Health - In order to provide you with the best standard of care, we work with a number of dedicated associate therapists who are not directly employed by Nuffield Health but form a dedicated network of independent clinicians.
During your treatment journey, it will be necessary to share your information with the health professional who is involved in your care, e.g. your treating therapist or assessing psychiatrist. This information will be data shared between Nuffield Health and your treating therapist in order to provide you the best possible service. For any information to be sent to any other individual e.g. GP, we will always seek specific consent from you, unless in rare emergency scenarios.
Billing – depending on who is paying for your treatment where and who relevant invoices will be sent to.
Authorisation of treatment (where relevant) – depending on your bill payer we may have been asked to send reports to authorise treatment or with regards to your treatment outcomes.
Research – to continue to improve clinical treatment Nuffield Health may use non-identifiable data as part of a research project or an assessment of our services.
Occupational Health Reports – if your referral has been from your employer as part of an occupational health assessment then a report will be produced and sent to your employer, however, not before you have had the option to see the report and have provided your consent.
Complaints – we know not everything runs smoothly all of time and sometimes you may have cause to complain about an element of your patient journey. In order to fully investigate your complaint we may need to share information with our compliance team, senior leaders or other parties not directly involved with your care e.g. if you were referred to Emotional Wellbeing via your insurer we might need to discuss your complaint with your insurer in order to fully investigate it.
In any case, we will only share as limited information as is necessary to investigate your complaint. We may also need to share details of your complaint with your treating therapist or other professionals involved in your care for the purposes of investigating your complaint.
How long we will keep your Personal Data for?
The length of time that Personal Data is stored is set by national legislation and is outlined in Nuffield Health Policy.
- Adult health records are kept for 8 years.
- For individuals who are aged under 18 records will need to be kept until their 25th birthday or those who were aged 17 at the start of treatment until their 26th birthday.
Each Emotional Wellbeing Journey is different and our highly skilled therapists and our administration team will ensure that you receive a bespoke patient journey that is right for you. As such, all of our decision making is based on the expert opinion of our team and no part of your journey will be based on wholly automated decisions.
Your rights in respect of your Personal Data
The law gives you certain rights in respect of the information that we hold about you. Below is a short overview of the key rights available to you:
Data Subject Access Request - with some exceptions designed to protect the rights of others, you have the right to a copy of the personal data that we hold about you. Where the data is data that you have given to us, you have the right to receive your copy of it in a common electronic format, and to provide copies of it to other people if you wish (Right to Data Portability).
Right to Rectification - you have the right to have the personal data we hold about you corrected if it is factually inaccurate. This right does not extend to matters of opinion, such as assessments of performance or fitness to work.
Right to Erasure - in some limited circumstances, you have the right to have personal data that we hold about you erased (the “right to be forgotten”). This right is not generally available where we still have a valid legal reason to keep the data (for example, because we are obliged to do so by law).
Right to Restrict Processing - you also have the right in some circumstances to request that temporary restrictions are placed on how we process your personal data, for example if you contest its accuracy or where we are processing it on the basis of our legitimate interest and you contest our assessment that our interest overrides your rights.
The above is not a complete and exhaustive statement of the law Further Information
For further information about how your data may be processed or to ask any questions please email: Elaine.firstname.lastname@example.org. If you are not satisfied with how we handle your personal data or a request to exercise one of your rights in relation to your data, you can contact the Data Protection Officer on email@example.com
Should you remain dissatisfied you have a right to complain to the Information Commissioner’s Office on 0303 123 1113 or through their website https://ico.org.uk/