This privacy notice is a statement that describes how the LLR ICB collects, uses, retains and discloses your personal information. Different organisations sometimes use different terms, and it can be referred to as a privacy statement, a fair processing notice or a privacy policy.

To ensure that we process your personal information fairly and lawfully we are required to inform you:

• Why we need your data
• How it will be used
• Who it will be shared with
• What rights you have to control how we use your personal information.

LLR ICB recognises the importance of protecting personal and confidential information in all that we do, all we direct or commission, and takes care to meet its legal obligations.

LLR ICB ensures that it complies with the key Data Protection Legislation:

• UK General Data Protection Regulation (GDPR)
• The Data Protection Act 2018
• The Human Rights Act 1998
• The Common Law Duty of Confidentiality Act
• Health and Social Care Act 2012 as amended by the Health and Social Care (Safety and Quality) Act 2015.

Our contact details

Name: Leicester, Leicestershire and Rutland Integrated Care Board (LLR ICB)

Address: Room G30, Pen Lloyd Building, County Hall, Glenfield, Leicester, LE3 8TB

General phone number: 0116 295 3405

General enquiries email address: llricb-llr.enquiries@nhs.net

Website: https://leicesterleicestershireandrutland.icb.nhs.uk/

We are the controller for your information. A controller decides on why and how information is used and shared.

Data Protection Officer contact details

Our Data Protection Officer is Daljit Bains (Head of Corporate Governance) and is responsible for monitoring our compliance with data protection requirements. If you have any questions about the use of your personal data or this privacy notice, please contact via the details below:

Daljit Bains

Head of Corporate Governance

NHS Leicester, Leicestershire and Rutland Integrated Care Board

Room G30, Pen Lloyd Building, County Hall, Glenfield, Leicester, LE3 8TB.

Telephone: 0116 295 3405 Email: llricb-llr.enquiries@nhs.net

The personal information we collect is provided directly from you for one of the following reasons:

• You have provided information to seek care – you have used a health or care service, such as attending the Accident & Emergency department or using a Community Care service where important information about you was collected to help ensure you get the best care and treatment
• You have sought funding for continuing health care or personal health budget support
• You have applied for a job with us or work for us
• You have signed up to our newsletter/patient participation group
• You have made a complaint to the ICB about healthcare that you have received, and we need to investigate.

We also receive personal information about you indirectly from others, in the following scenarios:

• Other health and care organisations involved in your care so that we can provide you with care e.g., Care Homes, GPs,
• Family members or carers to support your care
• Members of Parliament ( if they raise an enquiry or complaint on your behalf with your consent)
• Parliamentary and Health Service Ombudsman
• Provider organisations we commission to provide acute services g., University Hospitals of Leicester, Leicestershire Partnership Trust (with your consent)
• Local Authorities (with your consent)
• NHS England (with your consent).

Personal information

We process personal information to enable us to support the provision of healthcare services  for our  patients, maintain our  own  accounts and records, promote our services, and to support and manage our employees. In order to do so effectively we are often required to process personal data, that which identifies a living individual.

For the details of what personal information we collect and how we use it please refer to Appendix 1 of this Privacy Notice, further details are provided under the relevant service or function.

More sensitive information

We also process special category information which the Data Protection Act 2018 says is more sensitive and therefore needs more protection:

• Racial and ethnic origin
• Criminal or Suspected criminal offences
• Trade Union Membership
• Religious or philosophical beliefs
• Physical or mental health details
• Sexual orientation.

The information collected about you when you use health or care services can also be provided to other approved organisations, where there is a clear legal basis, to help with planning services, improving care provided, research into developing new treatments and preventing illness.

Confidential personal information about your health and care is only used in this way, where allowed by law and would never be used for insurance or marketing purposes without your explicit consent.

We may share information with the following types of organisations:

• Internally within the LLR ICB between teams / functions g. for the planning and commissioning of health and care services
• Provider organisations we commission to provide services g. University Hospitals of Leicester NHS Trust, Leicestershire Partnership NHS Trust.
• Other NHS Trusts, GP surgeries and other care providers involved in your care and treatment including Midlands and Lancashire Commissioning Support
• Third party data processors (such as IT systems suppliers or auditors).

Where the LLR ICB commissions a third-party data processor to support the services we provide, they are legally and contractually bound to adhere to the same security arrangements as the LLR ICB to handle your personal information. The LLR ICB legally remain the data controllers of the personal information being processed.

In some circumstances we are legally obliged to share information. This includes:

• When required by NHS England to develop national IT and data services
• When reporting some infectious diseases
• When a court orders us to do so
• Where a public inquiry requires the information.

We will also share information if the public good outweighs your right to confidentiality. This could include:

• Where a serious crime has been committed
• Where there are serious risks to the public or staff
• To protect children or vulnerable adults.

We may also process your information in order to de-identify it, so that it can be used for purposes beyond your individual care whilst maintaining your confidentiality. These purposes will include to comply with the law and for public interest reasons.

The National Fraud Initiative

The LLR ICB is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing, or administering public funds, or where, undertaking a public function, in order to prevent and detect fraud. The LLR ICB participate in the UK Government Cabinet Office’s National Fraud Initiative which carries out a data matching exercise, comparing computer records held by one body against the computer records held by another body to see how far they match. The Cabinet Office processes the data with statutory authority under its powers in Part 6 of the Local Audit and Accountability Act 2014 and under UK GDPR does not require the consent of in the individuals concerned.

Personal information

Under UK General Data Protection Regulations (UK GDPR), the LLR ICB processes personal data under the following lawful bases:

Article 6.1 (a) We have your consent – this must be freely given, specific, informed and unambiguous.

Article 6.1 (c) We have a legal obligation – the law requires us to do this, for example where NHS England or the courts use their powers to require the data.

Article 6.1 (e) We need it to perform a public task – a public body, such as an NHS organisation or Care Quality Commission (CQC) registered social care organisation, is required to undertake particular activities by law.

Article 6.1 (f) We have a legitimate interest – for example, a private care provider making attempts to resolve an outstanding debt for one of its service users.

More sensitive data

Under UK General Data Protection Regulations (UK GDPR), the LLR ICB processes your special category data under the following lawful bases:

Article 9.2 (b) – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.

Article 9.2 (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

Article 9.2 (g) – processing is necessary for reasons of substantial public interest.

Article 9.2 (f) – processing is necessary for the establishment, exercise or defence of legal claims.

Common law duty of confidentiality

In our use of health and care information, we satisfy the common law duty of confidentiality because:

• you have provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses)

• we have support from the Secretary of State for Health and Care following an application to the Confidentiality Advisory Group (CAG) who are satisfied that it isn’t possible or practical to seek consent

• we have a legal requirement to collect, share and use the data

• for specific individual cases, we have assessed that the public interest to share the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime). This will always be considered on a case-by-case basis, with careful assessment of whether it is appropriate to share the particular information, balanced against the public interest in maintaining a confidential health service.

Your information is securely stored for the time periods specified in the NHS Records  Management Code of Practice. We will then dispose of the information as recommended by the Records Management Code for example:

• Paper records will be securely disposed via a contract which the LLR ICB hold with the Leicestershire County Council
• Electronic records are deleted by LLR ICB staff in line with the Information Governance policy and NHS Records Management Code of Code of Practice

Under data protection law, you have rights including:

Your right of access – You have the right to ask us for copies of your personal information (known as a subject access request).

Your right to rectification – You have the right to ask us to rectify personal  information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing – You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us if you wish to make a request:

NHS Leicester, Leicestershire and Rutland Integrated Care Board Room G30, Pen Lloyd Building,

County Hall, Glenfield, Leicester, LE3 8TB

Telephone: 0116 295 3405 Email: llricb-llr.enquiries@nhs.net

Automated decision making

The LLR ICB does not make any decisions based solely on automated processing and therefore individual’s rights in relation to personal data processed in this way are not applicable.

National data opt-out

We are applying the national data opt-out because we are using confidential patient information for planning or research purposes.

The information collected about you when you use health and care services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

• improving the quality and standards of care provided
• research into the development of new treatments
• preventing illness and diseases
• monitoring safety
• planning services.

This may only take place when there is a clear lawful basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential health and care information is only used like this when allowed by law.

Whenever possible data used for research and planning is anonymised, so that you cannot be identified, and your confidential information is not accessed.

You have a choice about whether you want your confidential information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-  nhs-data-matters.

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

If you have any concerns about our use of your personal information, you can make a complaint to us via the Corporate Governance Team. Following this, if you are still unhappy with how we have used your data, you can then complain to the Information Commissioner’s Office (ICO).

The ICO’s address is:

Information Commissioner’s Office Wycliffe House

Water Lane Wilmslow Cheshire SK9 5AF

Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk