Coronavirus (COVID-19) data protection statement

Our role in responding to the pandemic may vary in relation to demand. As a result of these unique circumstances, we may need to share personal data with the NHS and other regulatory and government bodies. Each of our hospitals are working in collaboration with their local NHS trusts to ensure we can provide the right help, exactly where and when it is needed, and this may involve personal data being shared with us by the local Trust. This will be done in accordance with data protection legislation and any amendments to applicable legislation made by the Secretary of State. We will also consider any guidance provided by the Information Commissioner's Office.

Where the NHS and its healthcare professionals provide your healthcare services at a CHG hospital, the privacy notice of the relevant NHS Trust may also apply.

Circle Health Group (CHG) may seek to collect and process your personal data in response to continued monitoring of the impact of coronavirus, and to ensure the safety and well-being of everyone working in areas where we operate. We will use your information internally to support our planning and management activities linked to coronavirus; this will enable us to efficiently conduct our duties, support business continuity and put contingency plans in place to safeguard those who are vulnerable.

The types of personal information we may collect about you include:

• Demographic information - your name, date of birth, sex, ethnic group, employee number, address and postcode, occupation
• Contact details - such as your phone number and email address
• Health information- such as results of Lateral Flow Tests, PCR Tests and your coronavirus vaccinations where you’ve had these.

Your processed information will be limited to what is necessary and proportionate, taking into consideration relevant guidance which are issued by the Government and health professionals.

Where your personal data is required for organisational decisions, appropriate steps will be taken to anonymise the data so that, its use is limited to general statistics/numbers and cannot be linked back to you or other individuals.

Although, the provision of your information is not mandatory however, you are strongly advised to provide such in the best interests of everyone working at our various locations.

The information will be managed in a confidential and secure manner for as long as is necessary thereafter, it will be confidentially destroyed.

We will rely on Article 6 (1) (b) and Article 9 (2) (h) for the processing of your data. In addition, we will rely on one or more of the following bases when sharing your personal data as part of our support work with the NHS during the coronavirus pandemic:

• Legal obligation: the processing is necessary for compliance with a legal obligation Article 6 (1)(c) *
• Vital interests: the processing is necessary to protect someone's life. Article 6 (1)(d)
• Public interest: the processing is necessary to perform a task in the public interest. Article 6 (1)(e)
• Legitimate interests: the processing is necessary for an organisation's legitimate interests or the legitimate interests of a third-party Article 6 (1)(f)

When processing special category data for the purposes of:

• Employment, social security and social protection Article 9 (2)(b)
• Vital interests of the Data Subject Article 9 (2)(c)
• Substantial public interest Article 9 (2)(g)
• Provision of health or social care Article 9 (2)(h)
• Public interest in the area of public health such as protecting against serious cross border threats to health Article 9 (2)(i)

Schedule 1, Part 1(3) – is necessary for reasons of public interest in the area of public health and is carried out by or under the responsibility of a health professional, or by another person who in the circumstances owes a duty of confidentiality under an enactment or rule of law.

Schedule 1, Part 1(1) – is necessary for the performance or exercising obligations or rights which are imposed or conferred by law on the controller or the data subject in connection with employment, e.g. Health and Safety at Work Act 1974.

* This includes the Notice by Secretary of State under Reg 3(4) of Health Service Control of Patient Information Regulations issued 1st April 2020 allowing healthcare providers to share personal data and any other such notice that may be issued to support efforts against coronavirus.

We may share your personal information in response to Directives by the Secretary of State for Health and Care, in support of national and local actions to monitor and control the spread of coronavirus. We will only share your personal information where we have a lawful basis to do so.

Your personal data may be shared for the following purposes:

• Understanding coronavirus trends and risks to public health and controlling and preventing the spread of coronavirus
• Identifying and understanding information about patients or potential patients with or at risk of coronavirus including patient exposure to coronavirus
• Management of patients with or at risk of coronavirus including locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from coronavirus
• Understanding capacity and availability information about patient access to health services and adult social care services
• Monitoring and managing the response to coronavirus by health and social care bodies and the Government including providing information (including workforce details) to the public about coronavirus
• Delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with coronavirus
• Planning in relation to coronavirus. 

We assure you that all necessary steps will continue to be taken to maintain the security of your personal information and our focus will be to prioritise information flows, to ensure ongoing safe and effective care during these unprecedented times.

We will regularly review this privacy statement and its applicability throughout the coronavirus outbreak. We reserve the right to update this privacy statement at any time, and we will provide you with a new privacy statement when we make any substantial updates. We may also notify you in other ways from time to time about the processing of your personal information.

For further questions or to exercise any rights set out in this Privacy Notice, please contact CHG’s Head of Information Governance & Data Protection Officer:

Information Governance & DPO Circle Health Group,

30 Cannon Street, London

EC4M 6XH

Email: [email protected].