Privacy Notice

Introduction

This Privacy Notice explains how Alliance for Better Care collects, uses, and protects your personal information. We are committed to protecting your privacy and complying with data protection laws, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. 

For information about our data security measures and compliance frameworks, please see our Compliance page.

What information we collect about you

We keep data on you relating to: 

  • Who you are  
  • Where you live  
  • What you do  
  • Your family  
  • Possibly your friends  
  • Your employers  
  • Your habits  
  • Your problems and diagnoses  
  • The reasons you seek help  
  • Your appointments  
  • Where you are seen  
  • When you are seen and who sees you  
  • Recordings of our calls from and to you  
  • Referrals to specialists and other healthcare providers  
  • Tests carried out here and in other places  
  • Investigations and scans  
  • Treatments and outcomes of treatments  
  • Your treatment history  
  • The observations and opinions of other healthcare workers, within and outside the NHS  
  • Comments and aide memoires reasonably made by healthcare professionals who are appropriately involved in your healthcare  

NHS Registration 

When registering for NHS care, all patients who receive NHS care are registered on a national database. The database is held by NHS England, a national organisation which has legal responsibilities to collect NHS data. 

Webinar Registration Data 

We collect personal data when you register for webinars hosted by Alliance for Better Care CIC. This may include: 

  • Your name  
  • Email address  
  • Job title  
  • Organisation  
  • Attendance status  

4. Purpose of Processing 

Direct Care 

Direct Care is care delivered to the individual alone, most of which is provided via your Practice. After a patient agrees to a referral for direct care elsewhere, such as a referral to a specialist in a hospital, necessary and relevant information about the patient, their circumstances and their problem will need to be shared with the other healthcare workers, such as specialists, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and care. 

Sharing Information for Your Care 

If your health needs require care from others elsewhere or outside our services, we will exchange with them whatever information about you that is necessary for them to provide that care. When you contact healthcare providers outside our services but within the NHS, it is usual for them to send us information relating to that encounter. We will retain part or all of those reports. Normally we will receive equivalent reports of contacts you have with non-NHS services, but this is not always the case. 

Your consent to this sharing of data, within our services and with those others outside our services, is assumed and is allowed by law. 

Staff Access to Your Information 

People who have access to your information will only normally have access to that which they need to fulfil their roles: 

  • Administration staff will normally only see your name, address, contact details, appointment history and registration details in order to book appointments  
  • Nurses will normally have access to your immunisation, treatment, significant active and important past histories, your allergies and relevant recent contacts  
  • GPs will normally have access to everything in your record  

Audit, Quality Improvement and Performance Management 

We use your data for: 

  • Auditing our services to ensure quality and safety 
  • Quality improvement initiatives  
  • Performance management purposes  
  • Confirming contract delivery to commissioners  
  • When used for these purposes, we anonymise data wherever possible. 

Webinar Purposes 

We use webinar registration data to: 

  • Manage your registration and attendance  
  • Provide access to webinar materials such as recordings and slides  
  • Send essential updates about the webinar you have registered for  
  • Send follow-up communications related to the webinar, if you have opted in  
  • Invite you to future webinars and events, if you have given explicit consent  

5. Lawful Basis for Processing 

The processing of personal data in the delivery of direct care and for providers’ administrative purposes in our practices, services and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the UK General Data Protection Regulation: 

  • Article 6(1)(e) – ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority’ Article 9(2)(a) – ‘The data subject has given explicit consent for one or more specified purposes.’  
  • Article 9(2)(h) – ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services’ 

For webinar-related processing, we rely on: 

  • Article 6(1)(b) UK GDPR (performance of a contract) or, where applicable, Article 6(1)(e) (public task) for processing necessary to deliver the webinar  
  • Article 6(1)(a) UK GDPR (consent) for communications beyond the event  

Full list of lawful basis of processing, we rely on (please see Sub-processors page for full details): 

  • Article 6(1)(a) – Consent 
  • Article 6(1)(b) – Contract 
  • Article 6(1)(c) – Legal obligation 
  • Article 6(1)(e) – Public task 
  • Article 6(1)(f) – Legitimate Interests 
  • Article 9(2)(a) – Explicit consent 
  • Article 9(2)(b) – Employment, social security, and social protection law 
  • Article 9(2)(h) – Health or social care purposes 
  • Article 9(2)(g) – Substantial public interest 

Common Law Duty of Confidentiality 

We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”. 

Common law is not written out in one document like an Act of Parliament. It is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case law. The law is applied by reference to those previous cases, so common law is also said to be based on precedent. 

The general position is that if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent. 

In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or held in the memory of the professional, must not normally be disclosed without the consent of the patient. It is irrelevant how old the patient is or what the state of their mental health is; the duty still applies. 

Three circumstances making disclosure of confidential information lawful are: 

  1. Where the individual to whom the information relates has consented  
  2. Where disclosure is in the public interest  
  3. Where there is a legal duty to do so, for example a court order  

6. Who We Share Your Data With 

Healthcare Providers 

The data will be shared with healthcare professionals and support staff working at: 

  • GP practices  
  • Hospitals  
  • Diagnostic and treatment centres  

who contribute to your personal care. 

External Software and Systems 

We use externally provided software for the purposes of recording incidents and complaints. All patient identifiable information is hosted within our own NHS servers. 

Integrated Care Board Reporting 

We share non-identifiable demographic and appointment data with the Integrated Care Board through APEX for reporting purposes. 

Sub-processors 

We use third-party service providers (sub-processors) to help us deliver our services. For a complete list of our sub-processors, including details about what data they process and where they are located, please see our Sub-processors page. 

All sub-processors are carefully selected and monitored to ensure they provide appropriate security measures and comply with UK GDPR requirements. 

7. Data Retention 

Patient Data 

Patient data will be retained in line with the law and national guidance. Healthcare records are retained for specified periods according to: 

  • NHS Records Management Code of Practice  
  • Information Governance Alliance Records Retention Schedule  
  • Legal and regulatory requirements  

Webinar Data 

Webinar-related data will be stored securely and retained for up to 12 months after the webinar unless you request deletion sooner. This retention period applies only to webinar-related data processed for the above purposes. 

8. Your Rights 

Under UK GDPR and the Data Protection Act 2018, you have the following rights: 

Right to Access 

You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of law. 

To request access to your data, please contact the Data Controller or Data Protection Officer using the contact details provided above. 

Right to Object 

You have the right to object to some or all the information being processed under Article 21. Please contact the Data Controller or the Information Governance Lead. 

Important: You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance. You have the right to object to us sharing your data, but we have an overriding responsibility to do what is in your best interests. 

Right to Rectification 

You have the right to have inaccurate personal data corrected. 

Right to Erasure 

In certain circumstances, you have the right to request deletion of your personal data. This right does not apply to accurate medical records except when ordered by a court of law. 

Right to Restrict Processing 

You have the right to request that we restrict the processing of your personal data in certain circumstances. 

Right to Data Portability 

You have the right to receive your personal data in a structured, commonly used and machine-readable format and to transmit it to another controller. 

Right to Withdraw Consent 

Where we rely on your consent to process your data (such as for webinar marketing communications), you may withdraw your consent at any time. You can unsubscribe from marketing communications at any time by clicking the “unsubscribe” link in our emails or by contacting us at abc.communications@nhs.net. 

Withdrawing consent does not affect the lawfulness of processing based on consent before its withdrawal. 

9. NHS Data Choice and National Data Opt-Out 

Information About Your Health Data 

Information about your health and care helps us to improve your individual care, speed up diagnosis, plan your local services and research new treatments. The NHS is committed to keeping patient information safe and always being clear about how it is used. 

Information about your individual care such as treatment and diagnosis is collected about you whenever you use health and care services. It is also used to help us and other organisations for research and planning such as: 

  • Research into new treatments  
  • Deciding where to put GP clinics  
  • Planning for the number of doctors and nurses in your local hospital  

It is only used in this way when there is a clear legal basis to use the information to help improve health and care for you, your family and future generations. 

Your Data Choices 

Wherever possible, we try to use data that does not identify you, but sometimes it is necessary to use your confidential patient information. 

If you are happy for your confidential patient data to be used for research and planning, you do not need to do anything. 

To find out more about the benefits of data sharing, how it is protected, or to make a change/opt out choice, visit: www.nhs.uk/your-nhs-data-matters 

10. Data Protection Impact Assessments 

We undertake Data Protection Impact Assessments as needed to identify and mitigate privacy risks. Copies of these assessments are available upon request. 

11. International Data Transfers 

Where data is transferred outside the United Kingdom or European Economic Area, we ensure appropriate safeguards are in place, including: 

  • Standard Contractual Clauses approved by the UK Information Commissioner’s Office  
  • Adequacy decisions where applicable  
  • Additional security measures as required  

For more information about our sub-processors and where data is processed, please see our Sub-processors page. 

12. Automated Decision Making 

We do not use automated decision-making or profiling in relation to your healthcare data. 

13. Security of Your Information 

We take the security of your personal information seriously. For detailed information about our security measures, including: 

  • How we protect your data  
  • Our technical and organisational security measures  
  • Our incident response procedures  
  • Our compliance accreditations  

Please see our Compliance page.

14. Changes to This Privacy Notice 

We may update this Privacy Notice from time to time to reflect changes in our practices or legal requirements. We will notify you of any significant changes and update the “Last Updated” date at the top of this notice. 

We recommend that you review this Privacy Notice periodically. 

Contact information

  • Data Controller

    Alliance for Better Care CIC 
    Horley Health Hub 
    120 Victoria Road 
    Horley 
    RH6 7BL

    Contact for general privacy enquiries

  • Data Protection Officer

    For Alliance for Better Care Head Office and Non-Practice Functions:
    Richard Newell (Your-DPO)
    Contactable via Alliance for Better Care Head Office (Horley Health Hub)

    Contact Richard

Making a complaint

If you are not satisfied with our response to your data protection concerns, you have the right to lodge a complaint with: 

Information Commissioner’s Office (ICO) 

Website: www.ico.org.uk 

Telephone: 0303 123 1113 (local rate) or 01625 545 745 (national rate) 

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF 

Alliance for Better Care CIC ICO Registration Number: ZA505659

Link to record: Alliance For Better Care CIC | ICO 

Control

This Privacy Notice is reviewed annually and updated as necessary to reflect changes in our practices, regulatory requirements, or organisational structure. 

Version: 2.0 

Last Updated: February 2026 

Next Review Date: January 2027 

Owner: Information Governance Lead 

Approved By: Senior Information Risk Officer and Data Protection Officer