Introduction

Your personal information

Uses beyond your direct care

Who are we?

We are the Kent and Medway Shared Health and Care Analytics Board (SHcAB), a partnership of health and care organisations that have come together to:

• Help prevent ill health
• Encourage wellbeing
• Support research and innovation
• Join up services to better meet the needs of the population of Kent and Medway.

SHcAB is not a legal entity and has no statutory responsibility for ensuring compliance with data protection legislation or the common law duty of confidentiality. This responsibility remains with individual data controllers and processors.

What will you do with my information?

Whenever you use a health or care service, such as visiting your GP, attending hospital, or using care services in the community, information about you is collected in a patient/client record. This is known as data processing for direct care. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you can also be used for and shared with other organisations for purposes beyond your individual care. This is known as processing for secondary uses. Examples of this include population health management purposes such as:

• Planning services
• Managing finances
• Early treatment of illnesses (known as risk stratification)
• Co-ordinating and improving patient and service user’s movement through the health and care system
• Research
• Public health enhancement

Using confidential information in this way can only happen when there is a reason supported by the law.

The SHcAB receives requests to use data collected routinely by organisations across Kent and Medway and makes sure it is allowed by law. The information from more than one source may be joined together and used.

Details of each project, including the legal basis, can be found on our website, https://www.kmkernel.org/projects, which is regularly updated.

What information of mine will you use?

The data that is routinely collected about you includes that from your personal health and / or care record. This is manipulated so you are no longer identifiable:

• Anonymised data – where personal identifiable identifiers have been removed and you would no longer be able to be identified in any way.
• Pseudonymised data – where any information which could be used to identify an individual has been replaced with an alternative identifier.

What are my Data Protection rights?

Data Protection laws give you rights in respect of the personal information that is held about you. You have the right to:

• Be informed why, where, and how your information is used
• Have access to it
• Rectify it if it inaccurate or incomplete
• Erase or remove it
• Restrict or stop processing it
• Move, copy, or transfer it
• Object to it being processed or used
• Understand where your data is used for automated decision making or profiling about you

How long will you keep my information?

Approved researchers may hold personal data for specified periods of time, as set out in the NHS Records Management Code of Practice 2021. This will be decided on a case-by-case basis for individual projects using a Risk Assessment known as a Data Protection Impact Assessment.

The full database used by SHcAB does not have a set retention period as it has been deidentified, so no longer refers to any readily identifiable individuals.

Can I opt out of my information being used?

If you do not want your identifiable data to be shared for these purposes, please contact the SHcAB Data Protection advisor using the details below.

Who can I contact about any Data Protection queries?

The SHcAB is assisted by a Data Protection advisor from NHS Kent & Medway to monitor compliance with the Data Protection legislation. They can be contacted by email on kmicb.dpo@nhs.net.

How can I complain?

If you are dissatisfied with your response from our Data Protection advisor, you can also complain to the Information Commissioner. Its address is Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF. It can be telephoned on 0303 123 1113.

Version: 2.0, 2 December 2022
Author: Andrew Harvey, Associate Director of Information Governance/Data Protection Officer, NHS Kent & Medway