Privacy Notice

We may revise this privacy policy from time to time. Any changes we may make to our privacy policy in the future will be posted on this page. The policy was last updated on 07/08/2024.

1. Important information

This policy applies to patients, visitors, staff members, volunteers, students, recruitment candidates, clinicians/consultants, contractors/agency staff, suppliers, trustees, members of the charity, fundraising donors, newsletter subscribers (hard copy newsletter and e-newsletter), gym members and visitors to Horder Healthcare websites and sets out your rights under the UK General Data Protection Regulations 2018 (also known as GDPR).

This privacy policy is a statement of how Horder Healthcare collects, uses, retains and discloses your personal information (information that identifies you and is about you), also known as data and came into effect on 25th May 2018.

2. Who we are

Horder Healthcare (also referred to as “we”, “us”, “our” in this policy) is a leading healthcare charity working across Kent and Sussex, delivering care for both NHS and private patients. Our charitable purpose is the advancement of health and the relief of patients suffering from ill health. We do this by providing:

• At the Horder Centre, Crowborough - orthopaedic surgery and musculoskeletal (MSK) treatment
• At our clinics in South East of England (Horder Healthcare Seaford and Eastbourne) - musculoskeletal (MSK) treatment
• At The McIndoe Centre, East Grinstead - cosmetic and plastic reconstruction surgery, eye surgery, oral and maxillofacial surgery and orthopaedic surgery

To ensure that we process your personal information fairly and lawfully we are required to inform you about:

• Why we need your data
• How it will be used
• Who it will be shared with
• What rights you have in relation to the personal data we collect from you.

Within this policy we describe instances where Horder Healthcare is the “Data Controller” (the organisation which decides what information we collect and how it is used), and where we direct or commission the processing of data to help deliver better healthcare, or to assist the management of healthcare services.

There may be situations where Horder Healthcare processes personal data on the instructions of another organisation (i.e. when Horder Healthcare is acting as a “data processor”), but in those circumstances, our use of data would be governed by that organisation.

At Horder Healthcare we recognise the importance of protecting personal and confidential information in all that we do, all we direct or commission, and ensure that we meet our legal duties.

3. What information do we collect about you?

We only collect and use your personal information according to the legal bases defined in the GDPR and for the lawful purposes of administering the business of Horder Healthcare. The legal bases are as follows:

• Consent – where you have given your specific consent to the processing of your personal data.
• Performance of a contract – where the processing of your data is necessary for the fulfilment of a contract, for example e-referrals for NHS patients are subject to a contract.
• Compliance with a legal obligation – processing of your data is necessary by law and Horder Healthcare is required to comply.
• In the vital interest – we may process your personal data in order to protect your vital interests, for example in providing emergency treatment or care should it be required.
• Public interest – we may process personal data in order to complete a task carried out in the public interest.
• Legitimate interest – we may process your personal data where we have a legitimate “business” interest in processing that information.

The table below shows the purposes and the associated legal basis under which we process your personal data:

Please note that should your relationship with Horder Healthcare change, the legal basis under which we hold your data may also change.

4. What types of personal data do we handle?

We process personal information to enable us to support the provision of healthcare services to patients, maintain our own accounts, promote our services and to support and manage our employees. We also process personal information about healthcare professionals who deliver services within Horder Healthcare.

The types of personal information we use (see over):

We also process special categories of information for patients, staff, students, trustees, members of the charity and consultants, which may include:

• Racial and ethnic origin
• Religious or philosophical beliefs
• Trade union membership
• Genetic data
• Biometric data
• Data concerning a person’s sexual orientation
• Offences (including alleged offences), criminal proceedings, outcomes and sentences
• Employment tribunal applications
• Complaints, accidents, and incident details
• Health data (including morbidity and disability)

5. How will we use information about you?

Your information is used to ensure the delivery and improvement of our services.

5.1. For our patients, your data may be used to:

• Manage our relationship with you
• Register all patients onto our Patient Administration System
• Register new referrals for existing patients on our systems, update demographic details and health records with new referral details
• Record telephone calls made to the appointments department in relation to appointment enquiries
• Allow the preparation of health record folder (notes)
• Prepare for the agreed treatment
• Deliver the agreed treatment
• Investigate complaints, legal claims or serious incidents
• Service planning
• Check and report on Horder Healthcare services and their effectiveness.
• Display patients’ names on LCD TV screens within outpatient and reception waiting areas.
• Display patients’ names on whiteboard in nurse stations within the Inpatient Wards
• Create operation notes and letters for communicating outcomes with patients’ GPs
• Ensure correct patient information at all times by using their name on identity bracelets, if patients are admitted for surgery.
• Order medical devices, such as hip and knee prosthetics for surgical procedures
• Process anonymised statistical information on hospital performance
• Address customer service enquiries
• To send SMS/Email reminders for all appointments.
• Phone recording for quality and training.
• For the use of My Clinical Outcomes - My Clinical Outcomes — Privacy Policy

Patient Administration Systems

Horder Healthcare is the data controller for our electronic Patient Administration Systems. These systems hold personal details of all patients that have been referred via:

• the NHS e-Referral system (for NHS patients)
• Secure email (such as NHS.net account used by General Practitioners or encrypted email if the patient was referred privately)
• By secure fax (Safe haven)

The information held on these systems is used primarily for the purpose of administering healthcare services; it may however be used for other non-health related purposes and shared with statutory bodies/organisations to enable them to fulfil their statutory obligations. ‘Non-health related purposes’ relate to processing such as contracted reporting to the Private Hospitals Information Network (PHIN) using pseudonymised data. We may also use the information within the administration system for statistical analysis to see how the organisation is performing with respect to business targets and objectives and quality of care.

The information will only be shared with other organisations where there is a statutory or contractual obligation to do so, or with the agreement of the Horder Healthcare Caldicott Guardian and the Information Governance Officer. A Caldicott Guardian is a senior person responsible for protecting the confidentiality of patient and service user information and enabling appropriate information-sharing.

We may keep your information in a written form or on a computer. Whenever possible all information that identifies you will be removed.

5.2. For our staff, students, recruitment candidates, contractors/agency staff, consultants and suppliers, your personal data may be used to:

• Manage our relationship with you
• Fulfil our duty of care towards staff in the event of a major incident (e.g. in the event of a lockdown, fire)
• Verify employment history, qualifications and experience
• Validate ‘right to work’
• Assess suitability for employment during selection process
• Undertake personal development of employees
• Deliver payroll for employees
• Fulfil our duties in respect of national insurance and tax accounting
• Manage disciplinary and grievance procedures
• Undertake due diligence and risk assessment of supply chain
• To communicate with you in the event of a major incident (e.g. in the event of a lockdown, fire)
• To promote Horder Healthcare via our social media platforms on the occasions where we obtained your consent from you to include information about you in our promotions

5.3. For our trustees, members of the charity, subscribers and fundraising donors, your personal data may be used to:

• Manage our relationship with you
• Invite you to attend meetings and events that may interest you
• Send you our newsletters
• Keep you updated about our performance

6. Sharing Your Information

We may disclose your personal information for a number of reasons (to the extent necessary). This can be due to:

• Our obligation to comply with current UK legislation
• Our duty to comply with a court order
• A contractual commitment to report statutory information
• You having provided us with your consent to disclose your information
• Where we are required to do so by law
• The sharing of your data will ultimately benefit you as the data subject
• Our obligation to comply with our regulators

In fulfilling our obligation to provide services (healthcare and other services) we may share your data with the following:

• National Health Service (NHS) organisations
• Regulators
• Independent Sector Complaints Adjudication Service
• Referral services
• General Practitioners (your Doctor)
• Imaging Exchange Portal (a web-based portal used to allow sharing of scan images between healthcare trusts/organisations)
• Specialist consultants (medical and non medical)
• Public Health England (PHE)
• Contracted third parties providing services or devices, medical and non-medical
• Healthcare insurance providers
• Pathology laboratories
• Occupational health services (staff)
• Companies House
• The Charity Commission
• Health & Safety Executive (HSE)
• National registries (e.g. Breast registry, Spinal registry, Joint registry) with patients’ consent.
• Private Healthcare Information Network (PHIN)
• Communication service (Text alert)
• Payroll service
• Training providers

7. Sharing your Information outside of the European Economic Area (EEA)

We may from time to time be required to share your information with other service providers who are outside the UK and the EU. The sharing of your information with these providers is necessary in order to provide the necessary medical device or service. The transfer of personal data internationally will be conducted with the appropriate legal mechanisms in place.

8. How long will we keep your data for?

We will keep your personal information in accordance with our Information Retention Policy and for only as long as is lawfully necessary to conduct our business with you, and/or in accordance with our legal obligations for data retention.

9. Your rights

GDPR gives a number of rights over your data, subject to certain criteria being met. These are:

• Right of access to your personal information and supplementary information (for example your medical record). Once we have received your request we will respond within a calendar month. This information will be sent to you free of charge.
• Right to rectify/amend your personal information if it is incorrectly recorded. You have the right to question any information we hold about you that you think is wrong, out of date or incomplete. If you do, we will take reasonable steps to check its accuracy and correct it.
• Right to object and Right to be forgotten
  You have the right to object to our use of your personal information, or to ask us to delete, remove or stop using your personal information if it is no longer needed for the purpose for which it was collected or otherwise processed. This is known as the ‘right to erasure’ or ‘right to be forgotten’.

• Right to restrict the use of your personal information if:

• • It is not accurate;
  • It has been used unlawfully but you do not want us to delete it;
  • It is not relevant any more, but you want us to keep it for use in legal claims; or
  • You have already asked us to stop using your personal information but you are waiting for us to assess your request and confirm whether we are permitted to continue using the personal information under data protection law.

• Right to obtain your personal information in a portable format
  You have the right to get copies of your personal information from us in a format that can be easily re-used. You can also ask us to pass on your personal information to other organisations.

10. Freedom of information

Horder Healthcare is not a public authority and is not governed by the Freedom of Information Act.

11. Changes to this policy

We may revise this privacy policy from time to time. Any changes we may make to our privacy policy in the future will be posted on our website (this page). The policy was last updated on 07/08/2024.

12. Contact Us

Questions, comments and requests regarding this privacy policy are welcomed. Please contact our Information Governance Officer by email to informationgovernance@horder.co.uk or by writing to: Information Governance Officer, Horder Healthcare, St John’s Road, Crowborough, East Sussex, TN6 1XP.

13. Your right to complain

If you are not satisfied with our response or the way we are processing your personal information you can contact the Information Commissioner’s Officer (also known as the ICO) at www.ico.org.uk.The ICO is the statutory body which oversees data protection law in the UK.