1. Introduction​

New Malden & Worcester Park PCN Ltd ("the PCN", "we", "our" or "us") is committed to protecting your privacy and ensuring that your personal information is handled fairly, lawfully and transparently.

This Privacy Notice explains how we collect, use, store, share and protect personal information about individuals who interact with our organisation.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, the Common Law Duty of Confidentiality where applicable, and other relevant legislation and NHS information governance requirements.

​

2. Who We Are​

Data Controller: New Malden & Worcester Park PCN Ltd

Address: 134 Malden Road New Malden KT3 6DR

Email: swlicb.nmwp.pcn@nhs.net

Data Protection Officer: Dr Nick Merrifield
Email: nick.merrifield@nhs.net​

New Malden & Worcester Park PCN works collaboratively with its member GP practices and other health and care organisations to support the delivery and development of primary care services.

Depending on the particular service and circumstances, the PCN may act as a data controller independently or alongside other organisations.

​

3. Who This Privacy Notice Applies To​

This Privacy Notice may apply to:

• Patients and service users

• Employees, workers and volunteers

• Job applicants

• Contractors and consultants

• Healthcare professionals

• Representatives of our member practices

• Suppliers and service providers

• Members of the public who contact or interact with the PCN

​

4. What Personal Information We May Collect​

The information we collect will depend upon your relationship with us.

This may include:

• Name, address and contact details

• Date of birth

• NHS number where applicable

• Contact and communication information

• Employment and professional information

• Qualifications and professional registration details

• Recruitment and application information

• Payroll, pension and financial information relating to employees

• Training and appraisal information

• Attendance and absence records

• Information required for safeguarding purposes

• Information relating to complaints, incidents or concerns

• Information necessary to manage contracts and suppliers​

Where necessary, we may also process special category information, including:

• Health and medical information

• Information concerning disability

• Racial or ethnic origin

• Religious or philosophical beliefs

• Sexual orientation

• Trade union membership

• Genetic or biometric information where applicable​

We will only process this information where there is a lawful basis for doing so.

We may also process information relating to criminal convictions and offences where this is necessary and permitted by law, for example in connection with Disclosure and Barring Service (DBS) checks.

​

5. Patient and Service User Information

Where the PCN is involved in delivering or supporting healthcare services, we may process information about patients and service users.

This may include:

• Name and contact details

• NHS number

• Demographic information

• Relevant medical and health information

• Medication and treatment information

• Appointment and referral information

• Information provided by GP practices or other healthcare professionals

• Information necessary to provide, coordinate or improve healthcare services

We will only access and use patient information where there is an appropriate lawful basis and where it is necessary for the purpose for which it is being processed.

Access to confidential patient information is restricted to authorised individuals who require the information to perform their role.

​

6. Employee and Workforce Information

We process information about employees, workers, contractors and other members of our workforce in order to manage our employment responsibilities.

This may include information relating to:

• Employment contracts

• Payroll and pensions

• Annual leave

• Sickness absence

• Performance and appraisals

• Training and development

• Professional registration

• Occupational health

• Disciplinary and grievance matters

• Equality monitoring

• DBS and safeguarding checks where appropriate

• Emergency contact information

We only collect and retain information that is necessary to manage the employment relationship and meet our legal and regulatory responsibilities.

​

7. Recruitment

When individuals apply to work for the PCN, we may collect information including:

• Contact details

• Application forms and CVs

• Employment history

• Qualifications

• Professional registrations

• References

• Interview and assessment information

• Right to work documentation

• DBS information where required

• Occupational health information where appropriate

We use this information to manage recruitment, assess suitability for employment and undertake appropriate pre-employment checks.

​

8. Why We Use Personal Information

We may process personal information in order to:

• Provide and support healthcare services

• Coordinate care between healthcare professionals and organisations

• Manage our workforce

• Recruit employees

• Pay employees and administer pensions

• Manage contracts and suppliers

• Meet safeguarding responsibilities

• Respond to enquiries, complaints and concerns

• Monitor and improve the quality and safety of our services

• Carry out audits and service evaluations

• Meet contractual requirements

• Meet our legal and regulatory obligations

• Protect the rights, safety and interests of individuals

• Support the effective management and administration of the PCN

​

9. Our Lawful Bases for Processing

Under UK GDPR, the lawful basis we rely upon will depend upon why we are processing the information.

These may include:

• Article 6(1)(b) – processing necessary for a contract or to take steps before entering into a contract.

• Article 6(1)(c) – processing necessary to comply with a legal obligation.

• Article 6(1)(e) – processing necessary for a task carried out in the public interest or in the exercise of official authority.

• Article 6(1)(f) – processing necessary for our legitimate interests, where appropriate.

• Article 6(1)(a) – consent, where consent is the appropriate lawful basis.

Where we process special category information, additional conditions under Article 9 UK GDPR will apply. These may include:

• Article 9(2)(b) – employment and social protection obligations.

• Article 9(2)(h) – provision and management of health or social care.

• Article 9(2)(i) – public interest in the area of public health.

• Article 9(2)(g) – substantial public interest, where applicable.

• Article 9(2)(a) – explicit consent, where this is appropriate.

We will identify and document the appropriate lawful basis for each processing activity.

​

10. Where We Obtain Personal Information

We may receive information directly from you or, where appropriate, from:

• Our member GP practices

• Other NHS organisations

• Healthcare professionals

• NHS England

• Integrated Care Boards

• Recruitment services, including NHS Jobs

• Previous employers and referees

• Occupational Health providers

• Professional regulatory bodies

• Disclosure and Barring Service

• Government departments or other public bodies

• Organisations providing services on our behalf

We will only obtain information where there is a lawful reason to do so.

​

11. Who We May Share Information With

Where necessary and lawful, we may share information with:

• Member GP practices

• NHS organisations

• Integrated Care Boards

• NHS England

• Healthcare professionals involved in providing care

• Local authorities

• Occupational Health providers

• Payroll and pension providers

• Professional regulatory bodies

• Disclosure and Barring Service

• Recruitment providers, including NHS Jobs

• IT and other organisations providing contracted services to us

• Government departments, regulators or law enforcement agencies where legally required

We will only share information where there is an appropriate lawful basis and will limit the information shared to what is necessary.

We do not sell personal information.

​

12. How We Protect Your Information

We take appropriate technical and organisational measures to protect personal information against unauthorised access, loss, misuse, alteration or disclosure.

Measures may include:

• Secure NHS-approved IT systems

• Access controls

• Password protection and authentication

• Secure storage

• Appropriate information sharing arrangements

• Confidentiality requirements

• Data protection and information governance training

• Regular review of information security arrangements

Access to personal information is limited to individuals who have an appropriate reason to access it.

​

13. How Long We Keep Your Information

We do not keep personal information for longer than necessary.

Retention periods depend upon the type of information and the purpose for which it is held.

Where applicable, records are retained in accordance with legal requirements, employment requirements, contractual obligations and the NHS Records Management Code of Practice.

When information is no longer required, it will be securely deleted or destroyed in accordance with our records management arrangements.

​

14. Your Data Protection Rights

Depending on the circumstances, you may have the right to:

• Be informed about how your information is used

• Request access to your personal information

• Request correction of inaccurate or incomplete information

• Request deletion of your information in certain circumstances

• Request restriction of processing

• Object to certain types of processing

• Request data portability where applicable

• Withdraw consent where we rely upon consent

• Raise concerns about how your personal information is being used

These rights are not absolute and may depend upon the lawful basis under which your information is being processed.

Requests concerning your personal information should be made to the PCN or our Data Protection Officer using the contact details above.

​

15. Automated Decision-Making

We do not normally make decisions about individuals based solely on automated processing that produces legal or similarly significant effects. If this changes, we will provide appropriate information about the processing and your rights.

 

16. Data Breaches

We have procedures in place to identify, investigate and manage personal data breaches.

Where required by law, a breach will be reported to the Information Commissioner's Office and affected individuals will be informed where there is a high risk to their rights and freedoms.

​

17. Complaints

If you have concerns about the way we use your personal information, please contact us or our Data Protection Officer in the first instance.

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.

Information Commissioner's Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF

Telephone: 0303 123 1113 Website: ico.org.uk