The name and contact details of our organisation

Preventx Limited is the data processor for the Sexual Health London e-service

The City of London Corporation is the data controller for the Sexual Health London e-service.   These means that they instruct Preventx and its partners on what data is processed and how this will be done.  This role is undertaken in accordance with the General Data Protection Regularly (GDPR) and the Data Protection Act 2018.   

For all requests regarding the control of your data, please contact the City of London Corporation’s Information Officer

information.officer@cityoflondon.gov.uk

City Corporation’s Data Protection Officer

PO Box 270

Guildhall

London

EC2P 2EJ

The City of London Corporation provides information regarding data privacy and security via its Privacy Notice:

www.cityoflondon.gov.uk/privacy

The purposes of the processing

To deliver Local Authority services that are required by law.

The lawful basis for the processing

Providing services for the prevention, diagnosis and treatment of illness in line with the Health and Social Care Act (2012).

The legitimate interests for the processing

The provision of healthcare or treatment and the management of health or social care systems and services.

The categories of personal data obtained

Personal data: name, address, date of birth, contact information e.g. telephone number.

Special category data: ethnicity, gender identity, responses to medical and safeguarding screening questions, medical testing history, details of attendance with health providers that may have provided treatment.

The recipients or categories of recipients of the personal data

We use other organisations to either store personal information or use it to help deliver our services to you:

  • The provider of the London Sexual Health e-service: Preventx Limited
  • Providers of treatment and care that you have chosen to use can receive your full personal record i.e. sexual health clinics in London and Lloyds Pharmacy Online Doctor (Expert Health Limited) who provide remote chlamydia treatment.
  • The local authorities who fund the service and the Department of Health (including Public Health England) can receive anonymised (non-patient identifiable) data only.

Both the processor and controller have an agreement in in place to make sure that the organisations that your data is shared with comply with data protection law.

Sometimes there is a legal duty to provide personal information to other organisations.

There may also be occasions that your personal information is shared, when we (Preventx or its partners) consider/believe that there is a good reason to do so, which is more important than protecting your privacy. This doesn’t happen often, but in these circumstances your information may be shared:

  • to find and stop crime and fraud,
  • if there are serious risks to the public, our staff or to other professionals,
  • to protect a child,
  • to protect adults who are thought to be at risk, for example if they are frail, confused or cannot understand what is happening to them.

For all these reasons, the risk must be serious before we can override your right to privacy.

If in providing this service Preventx and/or its partners we are worried about your physical safety or feel they need to take action to protect you from being harmed in other ways, they will discuss this with you and, if possible, get your permission to tell others about your situation before doing so.

Preventx and/or its partners may still share your information if they believe the risk to others is serious enough to do so.

If this is the case, Preventx (and/or its partners) will make sure that a record of what information is shared and the reasons for doing so. We will let you know what we have done and why, if we think it is safe to do so.

The details of transfers of your personal data to any third countries or international organisations

Your data that is provided is stored on secure servers in the UK and there is no transfer of data to any third (party) countries or international organisations.

The retention periods for the personal data

Preventx and its partners will only hold your personal information for as long as it is necessary to fulfil our legal duties or business purposes.

In line with national clinical guidelines, your record will be retained for 10 years after the last recorded entry, e.g. your last data entry was 1 January 2018, your personal information will be deleted on 1 January 2028.

If you are aged 16 or 17 years old, your record will be retained for 10 years after your 18th birthday. For example if your last data entry is 1 January 2018 and your 18th birthday is 1 February 2018 then your data will be deleted on 1 February 2028. After that point, your personal identifying information (e.g. name, house number, street name, telephone number and email) will be removed to provide an anonymised data set for statistical and research purposes only.

Your data will not be deleted after 10 years if continue to use the service. This is based on national guidance, which NHS sexual health clinics follow.

The rights available to individuals in respect of the processing

The law gives you a number of rights in relation to what personal information is used by the City Corporation, and how it is used. These rights are listed below, and full details can be found in the City Corporation’s Data Subject Rights Policy.

You can ask us to:

  • provide you with a copy of the personal information that we hold about you
  • correct personal information about you which you think is inaccurate
  • delete personal information about you if you think we should no longer be using it
  • stop using your personal information if you think it is wrong, until it is corrected
  • transfer your personal information to another provider in a commonly used format
  • review automated decision-making processes that have been used to make decisions about you.

The right to withdraw consent and the right to erasure do not apply due to the nature of the services being provided and the basis in law for processing this data. The City of London Corporation as the controller of your data will consider requests to remove personal identifying information from your record to ensure that the data we do retain is anonymised.

The right to lodge a complaint with a supervisory authority

For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF

Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.

Alternatively, visit http://www.ico.org.uk or email casework@ico.org.uk.

The source of the personal data

The personal data Preventx and its partners hold is provided by you in the first instance. If you subsequently attend a clinic to access treatment following a diagnosis, that clinic will inform SHL of that attendance so that we can be sure you have not been lost to care and protect public health. No further details will be shared with us by the treating clinic unless you have provided them with your consent to do so e.g. the treatment provided, or further tests that they undertake. If you communicate with the clinical team at SHL they will record the advice and support, they have provided.

The details of the existence of automated decision-making, including profiling

Preventx and its partners use automated decision-making to confirm eligibility for the service e.g. to make sure that your borough is participating in the service. There is also automated decision made on your age because this service is only for people aged 16 years and over. Automated decision making, based on national clinical guidelines is also used, to determine whether the e-service is clinically appropriate for your individual circumstance and to determine which type of test kit is most suitable for you.

If the automated decision-making process determines that you are suitable for the e-service, including the chlamydia treatment pathway, you will be provided with information about accessing care from a physical clinic.

Currently, no profiling is undertaken, and we have no plans to do so. Profiling would only ever be used to help us fulfil our duties under the Equality Act 2010 in advancing equality of opportunity between people who share a protected characteristic and people who do not share it