Wateringbury Surgery Privacy Notice for Xyla Health and Wellbeing To provide the ‘Your local Healthier You: NHS Diabetes Prevention Programme’ NHS England has commissioned a provider, Xyla Health and Wellbeing, to provide the ‘Your local Healthier You: NHS Diabetes Prevention Programme’ for patients at risk of type 2 diabetes. Once a patient is referred, they will be contacted for a motivational interview with the provider (Xyla) to help them enrol onto the course and to have an opportunity to ask any questions they have at this time, including if you don’t want to enrol in the programme. Xyla Health and Wellbeing is part of the Acacium Group and sometimes, if required and legally allowed, Xyla may share some of your basic details such as your name and contact details with providers who have been identified as suitable to contact you to provide support for you during this programme. Any sharing of your data is done as little as possible, under due diligence and in compliance with applicable laws. For full details on how Xyla would use your data for the diabetes prevention programme, see their privacy notice at: https://preventing-diabetes.co.uk/diabetes-prevention-privacy-policy/ For general information on the national diabetes prevention programme, please visit the NHS England website on this at: https://preventing-diabetes.co.uk/ 1) Data Controller contact details 2) Data Protection Officer contact details Wateringbury Surgery 14 Pelican Court Wateringbury Maidstone Kent ME18 5SS 01622814466 gp.g82200@nhs.net www.wateringburysurgery.co.uk Pamela Ashe GP Data Protection Officer (DPO) NHS Kent and Medway Clinical Commissioning Group Unit A, Compass Centre North, Pembroke Road, Chatham Maritime, Kent, ME4 4YG Email: pamela.ashe@nhs.net 3) Purpose of the processing To enable you to have a preference as to how we contact you To enable us to communicate and manage our relationship with you while we deliver the programme to you, this will include sending appointment reminders To ensure eligibility for the programme To have a unique identifier for yourself when we communicate with you To ensure eligibility for the programme, as you must be over the age of 18 To ensure that we can communicate with you effectively while we deliver the programme to you To enable you to have a chosen representative who we can speak with on your behalf if you require us to To enable us to provide an individual service tailored to individual needs To monitor results for demographics and improve our services in the future To address any concerns and improve our service Investigate or prevent any complaints or incidents raised To carry out or assist with any legal or regulatory investigation To support your success on the programme and share progress with NHSE 4) Lawful basis for processing The processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR: Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’. Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services...” 5) Recipient or categories of recipients of the processed data 6) Rights to object 7) Right to access and correct 8) Retention period 9) Right to Complain. We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”* The data will be shared with Health and care professionals and support staff in this surgery and at hospitals, diagnostic and treatment centres who contribute to your personal care. You have the right to object to some or all the information being processed under Article 21. Please contact the Data Controller or the practice. You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law. The data will be retained in line with the law a