Patient survey privacy statement - NHS e-Referral Service

This privacy statement relates to services provided by NHS England.

This is a privacy statement for the NHS e-Referral Service user survey for use by patients and patient representatives that have used the Manage Your Referral website for booking, cancelling or rearranging their health and social care appointments.

This privacy statement is also for patients and patient representatives that choose to take part in the NHS e-Referral Service patient-user research panel. As a research panel member, you will have the opportunity to take part in online surveys, one-to-one interviews, web usability tests and discussion groups. We may follow up with you to ask about how your referral experience was including attending your appointment.

The NHS e-Referral service user research team understands your needs as an individual to ensure that your data is being used and held in a responsible way and we aim to reassure you that every reasonable step is being taken to secure your personal information.

Please ensure that you read this statement carefully and contact the NHS e-Referral Service programme team at [email protected] if you have any questions or concerns relating to this privacy statement.

This privacy statement explains the following:

• who we are
• what information we collect
• how we use your information
• what legal basis we have for processing your personal data
• when we share your personal data
• where we store and process personal data
• how we secure personal data
• how long we keep personal data for
• your rights in relation to personal data
• how to contact us

The NHS e-Referral Service is a programme service of NHS England. NHS England is the controller for the NHS e-Referral Service.

The Data Protection Officer for NHS Digital can be contacted at [email protected].

When you complete the Manage Your Referral patient survey, we collect:

• the address of the website you visited from,
• your "Booking Reference Number" (if present)
• the type of device you have used
• operating system
• web browser type and version
• IP/Address
• screen resolution
• flash version

As part of the survey, we may also ask you questions about:

• your age
• your gender
• the area of the country you live in
• disabilities or long-term impairments
• assistive equipment you use with your device

If you choose to participate in our patient user research panel, we will collect further information, including:

• your name
• your email address
• a contact telephone number

We use your information so that the NHS e-Referral Service can be improved.

We use the data we collect to:

• inform developments to our products
• understand how different groups of patient experience being referred
• gain knowledge of how referrals are managed by NHS organisation types in different locations (for example, hospitals, GP surgeries, Integrated Care Board)
• help improve the user experience of the services we provide

Under General Data Protection Regulation (GDPR) legislation, the legal basis for us processing your data is public task. This means that we process your data in the public interest and benefit.

In this case, it is for research purposes to assist the continued improvement of NHS systems.

For members of the patient-user research panel, we may request to share your details with other research teams within NHS England, if we feel that you would be a suitable candidate for their user research. Details would only be shared with authorised members of the NHS England research team, but only with your permission.

We will not:

• share your information with any other organisations for marketing, research or commercial purposes - we will not pass on your information to any organisation outside of NHS Digital
• identify you personally in any findings or reports

The results of the surveys may be published by NHS England to support NHS services to improve how referrals are managed. Published results will remain anonymous - nobody will be able to identify you in any results.

We store your data on servers in the UK. Currently there are no plans for this to change.

We take the security of your personal information seriously. We have set up security measures, policies, and procedures, such as:

• all our survey data is stored securely in line with the General Data Protection Regulations
• only allowing access to survey data to specific NHS England staff
• compulsory information governance training completed every year for all NHS England staff members and contractors.

While in transit, the information you share with us by completing a survey is done so using a secure, encrypted HTTPS connection. We have procedures in place to keep your information secure once we have it. 

However, no software or application can be completely secure, and we are unable to guarantee the security of your information while it is in transit. If you have any concerns that your information could have been compromised, please contact [email protected].

We store personal data from our surveys for a maximum of three years, after this time it will be deleted.

If you wish to have your data omitted, restricted, erased, rectified or if you wish to have a copy of your responses from the results of this survey contact [email protected].

We respect your rights to access and control the personal data that we hold about you, as required by Data Protection Legislation.

This includes the right to:

• be informed
• get access to it
• rectify or change it
• restrict or stop processing it

You can exercise these rights at any time by emailing the NHS e-Referral Service programme team on [email protected]. Any requests for information will be acknowledged within one working day.

If you no longer want to take part in the patient-user panel, you can withdraw your information by contacting us on [email protected]. You do not have to provide a reason to withdraw.

If you wish to make a complaint about how we have managed your data, contact details for the Regulator are provided below:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

WSK9 5AF

Their website address is https://ico.org.uk.

If you have any questions or concerns about this privacy statement or the way in which we process your data, please contact us on [email protected]

To know how your data will be collected, processed, and stored, and for what purposes, you can contact our Data Protection Office:

By email on [email protected]

By post at:

Information Governance Compliance Team
NHS England
7 and 8 Wellington Place
Leeds
West Yorkshire
LS1 4AP

We ask that you try to resolve any issues with us first, although you have a right to lodge a complaint with the Information Commissioner's Office (ICO) at any time about our processing of your personal information.

The ICO is the UK regulator for data protection and upholds information rights.

Contact the ICO