Data Controller
NHS West Yorkshire Integrated Care Board
Purpose
To fund specific treatment for you for a particular condition that is not covered in our contracts with providers. Individual Funding Requests provide payments required to receive specialist treatment, not routinely provided on the NHS, on a case by case basis.
We will need to process your personal and health information in order to consider and process you funding request accurately and fairly.
Lawful basis
The ICB’s legal basis for processing this personal data under the UK GDPR is Article 6(1) e - exercise of official authority.
For special category data the basis is Article 9(2) h - provision of health or social care or treatment.
Type of information used
Personal data: name, address date of birth, NHS number.
Special Category data: Physical and Mental Health information, ethnic origin, gender.
Who we will share the information with (recipients)
The information may be shared with NHS or private providers of health services.
Do we use any processors
The Health Informatics Service (THIS), our IT supplier who store all our information securely on their servers.
Microsoft Azure, supported by IT staff, host our data.
Blueteq – content management system provided by Blueteq Limited.
North of England Commissioning Support.
How we collect (the source) and use the information
Information to make payments in relation to funding treatment is provided by you, along with relevant information from
primary and secondary care regarding the referral for specialist treatment.
The ICB will only use the identifiable information we collect to process the request for funding.
This process is carried out with the consent of the patient to satisfy the Common Law Duty of Confidentiality.
How long we will keep the information
8 years from end of care or when you are last seen.
Where your request has been rejected, information will be kept for 2 years.
Your Rights
With regards to Individual Funding Requests under the UK GDPR you have the following rights:
- The right to be informed about the processing of your data (this notice)
- The right of access to the data held about you
- The right to have that information amended in the event that it is not accurate
- The right to have the information deleted
- The right to restrict processing
- The right to object to processing
- Right not to be subjected to automated decision making and profiling
- To be notified of data breaches