The name and contact details of our organisation
Preventx Limited is the data processor for the Sexual Health London e-service
The City of London Corporation is the data controller for the Sexual Health London e-service.These means that they instruct Preventx and its partners on what data is processed and how this will be done.This role is undertaken in accordance with the General Data Protection Regularly (GDPR) and the Data Protection Act 2018.
For all requests regarding the control of your data, please contact the City of London Corporation's Information Officer
[email protected]
City Corporation’s Data Protection Officer
PO Box 270
Guildhall
London
EC2P 2EJ
The City of London Corporation provides information regarding data privacy and security via its Privacy Notice:
www.cityoflondon.gov.uk/privacyThe purposes of the processing
To deliver Local Authority services that are required by law.
The lawful basis for the processing
Providing services for the prevention, diagnosis and treatment of illness in line with the Health and Social Care Act (2012).
The legitimate interests for the processing
The provision of healthcare or treatment and the management of health or social care systems and services.
The categories of personal data obtained
Personal data: name, address, date of birth, contact information e.g. telephone number.
Special category data: ethnicity, gender identity, responses to medical and safeguarding screening questions, medical testing history, details of attendance with health providers that may have provided treatment.
The recipients or categories of recipients of the personal data
We use other organisations to either store personal information or use it to help deliver our services to you:
- The provider of the London Sexual Health e-service: Preventx Limited
- Providers of treatment and care that you have chosen to use can receive your full personal record i.e. sexual health clinics in London and Lloyds Pharmacy Online Doctor (Expert Health Limited) who provide remote chlamydia treatment.
- If you have chosen to use this service as part of a research trial, we may also share your information with the researchers in accordance with that trial’s protocol and its ethics approval.
- The local authorities who fund the service and the Department of Health (including Public Health England) can receive pseudonymised data only. These reports do not include personal data such as: your name, date of birth, contact details, address or postcode.
Both the processor and controller have an agreement in in place to make sure that the organisations that your data is shared with comply with data protection law.
Sometimes there is a legal duty to provide personal information to other organisations.
There may also be occasions that your personal information is shared, when we (Preventx or its partners) consider/believe that there is a good reason to do so, which is more important than protecting your privacy. This doesn’t happen often, but in these circumstances your information may be shared:
- to find and stop crime and fraud,
- if there are serious risks to the public, our staff or to other professionals,
- to protect a child,
- to protect adults who are thought to be at risk, for example if they are frail, confused or cannot understand what is happening to them.
For all these reasons, the risk must be serious before we can override your right to privacy.
If in providing this service Preventx and/or its partners we are worried about your physical safety or feel they need to take action to protect you from being harmed in other ways, they will discuss this with you and, if possible, get your permission to tell others about your situation before doing so.
Preventx and/or its partners may still share your information if they believe the risk to others is serious enough to do so.
If this is the case, Preventx (and/or its partners) will make sure that a record of what information is shared and the reasons for doing so. We will let you know what we have done and why, if we think it is safe to do so.
The details of transfers of your personal data to any third countries or international organisations
Your data that is provided is stored on secure servers in the UK and there is no transfer of data to any third (party) countries or international organisations.
The retention periods for the personal data
Preventx and its partners will only hold your personal information for as long as it is necessary to fulfil our legal duties or business purposes.
In line with national clinical guidelines, your record will be retained for 10 years after the last recorded entry, e.g. your last data entry was 1 January 2018, your personal information will be deleted on 1 January 2028.
If you are aged 16 or 17 years old, your record will be retained for 10 years after your 18th birthday. For example if your last data entry is 1 January 2018 and your 18th birthday is 1 February 2018 then your data will be deleted on 1 February 2028. After that point, your personal identifying information (e.g. name, house number, street name, telephone number and email) will be removed to provide an anonymised data set for statistical and research purposes only.
Your data will not be deleted after 10 years if continue to use the service. This is based on national guidance, which NHS sexual health clinics follow.
The rights available to individuals in respect of the processing
The law gives you a number of rights in relation to what personal information is used by the City Corporation, and how it is used. These rights are listed below, and full details can be found in the City Corporation’s Data Subject Rights Policy.
You can ask us to:
- provide you with a copy of the personal information that we hold about you
- correct personal information about you which you think is inaccurate
- delete personal information about you if you think we should no longer be using it
- stop using your personal information if you think it is wrong, until it is corrected
- transfer your personal information to another provider in a commonly used format
- review automated decision-making processes that have been used to make decisions about you.
The right to withdraw consent and the right to erasure do not apply due to the nature of the services being provided and the basis in law for processing this data. The City of London Corporation as the controller of your data will consider requests to remove personal identifying information from your record to ensure that the data we do retain is anonymised.
The right to lodge a complaint with a supervisory authority
For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.
Alternatively, visit http://www.ico.org.uk or email [email protected].
The source of the personal data
The personal data Preventx and its partners hold is provided by you in the first instance. If you subsequently attend a clinic to access treatment following a diagnosis, that clinic will inform SHL of that attendance so that we can be sure you have not been lost to care and protect public health. No further details will be shared with us by the treating clinic unless you have provided them with your consent to do so e.g. the treatment provided, or further tests that they undertake. If you communicate with the clinical team at SHL they will record the advice and support, they have provided.
The details of the existence of automated decision-making, including profiling
Preventx and its partners use automated decision-making to confirm eligibility for the service e.g. to make sure that your borough is participating in the service. There is also automated decision made on your age because this service is only for people aged 16 years and over. Automated decision making, based on national clinical guidelines is also used, to determine whether the e-service is clinically appropriate for your individual circumstance and to determine which type of test kit is most suitable for you.
If the automated decision-making process determines that you are unsuitable for the e-service, including the chlamydia treatment pathway, you will be provided with information about accessing care from a physical clinic.
Currently, no profiling is undertaken, and we have no plans to do so. Profiling would only ever be used to help us fulfil our duties under the Equality Act 2010 in advancing equality of opportunity between people who share a protected characteristic and people who do not share it
Laboratory Testing
Your sample will be tested in Preventx's specialist laboratory and in accordance with the laboratories quality system. Standard testing carried out via the SHL.UK service is accredited to international standards, and more information can be read in the Preventx Laboratory Services document (https://www.preventx.com/laboratory)
In some cases, we may use non-accredited tests to supplement your screening, however, this would only ever be in agreement with doctors or clinicians (for example, specific sample and test combinations may be recommended but may fall outside of accreditation scope).
Please note that some test samples may be retained by the laboratory after testing. These samples may be used for internal studies, public health initiatives (such as surveillance work with UK Health Security Agency (UKHSA) or verification purposes (such as performing equipment validation). Samples used for these purposes will be pseudonomysed. This will always exclude personal data such as your name, date of birth, contact details, address or postcode.