Privacy Notice

**Privacy note on COVID-19 for patients and service users**

This notice describes how we may use your information to protect you and others during the COVID-19 outbreak. It supplements our main Privacy Notice which is available below. 

The health and social care system is facing significant pressures due to the COVID-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations.

Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak. Using this law the Secretary of State has required NHS Digital; NHS England and Improvement; Arms Length Bodies (such as Public Health England); local authorities; health organisations and local practices to share confidential patient information to respond to the COVID-19 outbreak. Any information used or shared during the COVID-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data. Further information is available on here and some FAQs on this law are available here.

During this period of emergency, opt-outs will not generally apply to the data used to support the COVID-19 outbreak, due to the public interest in sharing information. This includes National Data Opt-outs. However in relation to the Summary Care Record, existing choices will be respected. Where data is used and shared under these laws your right to have personal data erased will also not apply. It may also take us longer to respond to Subject Access requests, Freedom of Information requests and new opt-out requests whilst we focus our efforts on responding to the outbreak.

In order to look after your health and care needs we may share your confidential patient information including health and care records with clinical and non clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111. We may also use the details we have to send public health messages to you, either by phone, text or email.

During this period of emergency we may offer you a consultation via telephone or video-conferencing. By accepting the invitation and entering the consultation you are consenting to this. Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation.

We will also be required to share personal/confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak. Further information about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the COVID-19 response is here.

NHS England and NHS Improvement, together with NHSX have developed a single, secure store to gather data from across the health and care system to inform the Covid-19 response. This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital. New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patients themselves. All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.

In such circumstances where you tell us you’re experiencing COVID-19 symptoms we may need to collect specific health data about you. Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards.

We may amend this privacy notice at any time so please review it frequently. The date at the top of this page will be amended each time this notice is updated.

For all the latest NHS information and advice about coronavirus (COVID-19) read the NHS pages here.

What is a privacy notice?

A ‘privacy notice’ is a statement issued by an organisation, or jointly by organisations, which explains how personal and confidential information about patients, service users, staff and visitors is collected, used and shared. This may also be called a privacy statement, fair processing statement/notice or privacy policy. This privacy notice is issued by the iDCR Partnership.

By issuing this privacy notice, we demonstrate our commitment to openness and transparency. We recognise the importance of protecting personal confidential information in all that we do and take care to meet our legal requirements.

Why we need your information and how it will be used by health and social care providers for your direct healthcare in Doncaster

The health and social care professionals who work with you to provide your care will keep records about the treatment and support you receive. Having this information available in one record will enable these professionals to work together and share vital information about your health and wellbeing needs. Health and social care professionals will be able to use the information to assess your needs and decide the most appropriate treatment or support for you.

Who will be controlling your information?

The Integrated Doncaster Care Record (iDCR) is a partnership supported by NHS Doncaster Clinical Commissioning Group, GPs within the Doncaster Community, Rotherham Doncaster and South Humber NHS Foundation Trust, Doncaster and Bassetlaw Teaching Hospital Trust, Doncaster Metropolitan Borough Council and Fylde Coast Medical Services (a not for profit Urgent Care Service).

All partners are signatories to the Doncaster Care Record Sharing Agreement which provides partner agencies with a robust foundation for the lawful, secure and confidential sharing of personal information between themselves and other public, private or voluntary sector organisations that they work with.

Each partner has a legal duty to protect your personal information and will remain sole data controller of its own data. We all take confidentiality very seriously and are committed to ensuring all personal information within the iDCR is managed in accordance with the relevant legalisation to ensure your information is safe, secure and confidential.

The data we are sharing

It is important that the iDCR has up to date and accurate information about your health and care to ensure you receive the best quality care possible.

Your care record within the iDCR contains key information like:

  • Personal details, such as your name, address, date of birth and next of kin
  • Names of the health and care professionals looking after you
  • Any medications you are taking
  • Any allergies you have
  • Any health concerns about you
  • Previous referrals to services
  • Dates and reasons for any occasions you have been admitted to hospital
  • Appointments
  • Any assessments you have had
  • Care plans and care packages you have
  • Emergency contact details

None of your Sexual Health records (GUM/TriHealth Services) will be shared in to the iDCR, however we cannot guarantee that if you have discussed any sexual health issues you have with any Health and Social Care professionals from other services which share in to the iDCR that this information is not pulled through in to your shared record.

What is the lawful basis for sharing your information?

The following outlines the legal basis that will be used to allow us to share your information within the iDCR

  • Data Protection Act 1998
    • Principle 1 (Fair and Lawful Processing)
      • Schedule 2 – The processing is necessary for the exercise of any other functions of a public nature exercised in the public interest by any person.
      • Schedule 3 -The processing is necessary for medical purposes and is undertaken by –
        • A health professional, or
        • A person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional.
        • NB “medical purposes” includes the purposes of preventative medicine, medical diagnosis, medical research, the provision of care and treatment and the management of healthcare services.
  • General Data Protection Regulation/Data Protection Act 2018 (Draft Bill)
    • Article 9 (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3.
  • Health and Social Care Act 2012
  • Health and Social Care (Safety and Quality) Act 2015
  • Duty to share information (Part 9 of the Health and Social Care Act 2012)
    This section applies to information about an individual that is held by a relevant health or adult social care commissioner or provider known as the relevant person.

    • This relevant person must ensure that the information is disclosed to –
      • Persons working for the relevant person, and
      • Any other relevant health or adult social care commissioner or provider with whom the relevant person communicates about the individual

How will your information be used and accessed?

Personal information contained in the iDCR will only ever be used for your direct care and support.

Only health and social care professionals directly involved in your care are allowed to access personal information within the iDCR and all access activity is recorded and monitored.  All partner organisations have ‘Privacy Officers’ these individuals have the ability to audit all access to the iDCR to make sure the access to records is by individuals who are authorised to do so.

The information within your iDCR is used to provide you with the most appropriate care and support that you need. The information within the iDCR helps professionals to make better decisions about your care and ensure it is safe and effective.

How long do we keep your information?

Dependent on your Health and Social Care Provider records about you are required under the law to be retained for specific periods of time dependent on the record. Details of these retention periods can be sourced by contacting the Health and Social Care organisation.

Who will see and share your information?

Only organisations signed up to the Information Sharing Agreement will be sharing your information held in the iDCR. These organisations are listed below;

  • Doncaster and Bassetlaw Teaching Hospitals Foundation Trust
  • Rotherham Doncaster and South Humber NHS Foundation Trust
  • Doncaster Metropolitan Borough Council
  • Fylde Coast Medical Services (Urgent Care Centre)
  • Doncaster General Practitioners

Health and social care professionals directly involved in your care will be able to access your record. Health and social care professionals include GPs, doctors, psychiatrists and psychologists, nurses, social workers, and the administrative staff who support them.  These staff only see the information necessary for your specific needs and relevant to their job role.

Your information will not be shared with anyone who is not providing you with direct care or supporting these services and will never be made available to any third party, unless:

  • Where you the individual to whom the information relates has consented
  • Where disclosure is necessary to safeguard you the individual, or others, or is in the public interest
  • Where there is a legal duty to do so, for example a court order.

Consent to share your information

All iDCR patient records will have a consent status of “opted-in”; this will make your information available within the system, but not viewable by health and social care professionals.

To allow health and social care professionals who are treating you to have access to your information you will be required to give explicit consent (give permission) for your information to be made available. Your consent is recorded within the system.

You can give your consent for a professional to see your record every time you come into contact with care services or you can give on-going consent to anyone involved in your care so you don’t have to be asked again.

Can my records be accessed without  my consent?

There are certain special circumstances that a care professional may be allowed to access your record without asking for consent, if you haven’t already given it. For example if you have arrived in A&E and are unconscious but have an iDCR record. In all cases, this access is time limited, recorded on the system and at your next appointment you will be asked for explicit consent for your care professional to access your record.

How can I “opt-out”?

You have the right to opt-out of having an iDCR. By completely opting-out at the initial stage will result in no record being available. Details of how you can opt-out are contained within the leaflet below:

All about the Integrated Doncaster Care Record

The leaflet is also available in other languages and can be downloaded by clicking on the following links:

You can also opt-out for specific data from certain organisations being shared in to the iDCR at any time.  To opt-out from one of the five organisations detailed above sharing your information you should contact the relevant organisation and inform your health and social care professional or the organisation’s Information Governance Lead of your wishes.

Children’s data – opting-out

If a parent chooses to opt-out their child’s data totally from the iDCR, this record will not be deleted but locked until the child is at an age where they can legally make the decision to consent to their data being shared within the iDCR.

If you choose to opt-out, what are the implications on your care?

As the data subject it is your legal right to opt-out of your information being shared in to the iDCR. However, we ask you to think carefully before making this decision as sharing your health and social care information will make it easier for Doncaster services to provide the best treatment and care for you.

Health and social care professionals caring for you may not be aware of:

  • Your current medications in order to treat you safely and effectively
  • Your current conditions and/or diagnoses, or any social care in place, which could lead to a delay or missed opportunity for correct treatment
  • Any allergies/adverse reactions to medications and may prescribe or administer drug/treatment with adverse consequences

Your rights as a ‘Data Subject’

Under the Data Protection Act 1998 (GDPR May 2018), you have the right to request access to the information held about you as well as who has accessed your information.

If at any point you believe the information we process on you is incorrect a further right you have as a data subject is to request that this incorrect data is corrected or deleted.

If you wish to raise a concern or a complaint you can do so by contacting the care professional providing your care or treatment, or the organisation’s Data Protection Officer or key contact.

If you are not satisfied with the response you receive or believe we are processing your personal data not in accordance with the law you can complain to the Information Commissioner’s Office (ICO).


  • Rotherham Doncaster and South Humber NHS Foundation Trust
    Sue Meakin, Information Governance Manager – 01302 796189 /
  • Doncaster Metropolitan Borough Council
    Nikki Minnikin, Data Sharing and Protection Officer – 01302 736000 /
  • Doncaster and Bassetlaw Teaching Hospitals NHS Foundation Trust
    Roy Underwood, Head of Information Governance – Bassetlaw Information Governance Office: 01909 500990 Ext 2664/2665 or Doncaster Royal Infirmary RA Office: 01302 366666 Ext 642355
  • Fylde Coast Medical Services
    Samantha Marsh, Quality and Risk Lead – 01253 951621 /