Privacy Policy - GPs (and other primary care clinicians)

Privacy Policy

Consultant Connect recognises the importance of keeping data safe and secure and acting in compliance with UK GDPR (UK General Data Protection Regulation).

 

Your personal data – what is it?

Personal data relates to a living individual who can be identified from that data. Identification can be by the information alone or in conjunction with any other information in the data controller’s possession or likely to come into such possession. The processing of personal data is governed by the General Data Protection Regulation 2016/679 (the “GDPR”).

This Privacy Notice tells you what to expect in relation to personal information about you which is collected, handled and processed by Consultant Connect Limited.

Who are we?

We are Consultant Connect Limited of 58 St Aldate’s, Oxford, OX1 1ST.

Consultant Connect acts as Data Controller for clinician account information described in this notice. Where Consultant Connect processes personal data on behalf of NHS organisations, it acts as Data Processor under the instructions of the relevant Data Controller.

Consultant Connect is the provider of communications systems to the NHS and Private Health Providers that facilitate easier and faster patient-specific discussions between different teams of clinicians. The overall objective is to ensure patient pathways are not delayed unnecessarily on account of clinicians being unable to contact each other.

We acknowledge and agree that any personal data of yours that we handle will be processed in accordance with all applicable data protection laws in force from time to time.

The information we may collect – Data relating to GPs (and other primary care clinicians)

The information about you that we may collect, hold, and process includes the following:

• Name
• Job title
• Employing organisation
• GMC number (or equivalent)
• Email address
• Mobile phone number
• The IP address of any device used to access the system
• Device make, model and software version of any device used to access the system

This information will have been provided, or will be provided, by you or a third party with whom we work, such as your employing organisation.

Please note that if you access our service using your NHS Care Identity credentials, the identity access and management services are managed by the applicable responsible NHS body; NHSE in England, DHCW in Wales and NHSS in Scotland. These bodies are the controller for any personal information you provided to them to get a national digital identity and authenticate your claim to that identity and uses that personal information solely for that single purpose. For any such personal information, we are the Data Processor acting under instruction provided by the aforementioned bodies (as the “controller”) when verifying your identity. This restriction does not apply to the personal information you provide to us separately, which is managed in accordance with our Privacy Policy.

 

How we use the information

The above information is/will be used to facilitate clinician-to-clinician contact via the Consultant Connect system, for the purposes of providing high-quality care to patients.

Your information may also be used to send you service feedback surveys and other communications relating to your use of the Consultant Connect service for the purposes of service improvement.

 

Call recording, secure messaging, and audit trails

All calls made through the Consultant Connect system are recorded as highly encrypted, information-governed digital files, which provide a medico-legal record. These recordings are stored in a Secure Virtual Private Cloud and are accessible only to authorised personnel at the relevant GP practice and/or hospital team, subject to secure login and Role-Based Access Controls. Recordings are retained for patient safety, clinical governance, audit and medico-legal purposes.

Photo messages, emails and other messages sent via the Consultant Connect App are also stored securely in the Secure Virtual Private Cloud as part of the medico-legal record. These are not retained on the clinician’s device.

A comprehensive audit trail is maintained for all access to calls, messages and photos. This records when data was accessed, what data was accessed, and by whom. All data is stored securely in the UK.

How we hold the information

All the personal data we have is stored on our database in the UK, within Secure Virtual Private Clouds provided by Amazon Web Services (AWS) and Google Cloud Platform (GCP). Both are physically located in the UK and hold ISO 27001, 27018 and 9001 certifications. No data is stored in any other territory.

The Consultant Connect service is DSPT (Data Security and Protection Toolkit)- compliant and Cyber Essentials Plus-certified.

 

Disclosure of your information

Your personal data will be treated as strictly confidential and will not be shared with any third-party organisation other than with your explicit consent.

Legal basis for processing the information

The primary legal basis upon which we hold and process your data is Contractual Necessity.

Contractual Necessity: processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Where we use your information to improve our services (for example, by sending surveys), we rely on Legitimate Interests as the legal basis for processing. Our legitimate interest is to monitor, evaluate, and enhance the quality, safety, and effectiveness of the Consultant Connect service.

Legitimate Interests: processing is necessary for the purposes of the legitimate interests pursued by the data controller, where those interests are not overridden by the interests or fundamental rights and freedoms of the data subject.

Retention of your data

Your data will be retained for no longer than is necessary and in accordance with our Data Retention Policy. Call recordings, photos, messages, and emails are retained for medico-legal purposes in line with NHS Records Management Codes of Practice, with a default retention period of 10 years, subject to approval from the Data Controller.

 

Your rights

You currently have the right at any time to ask for:

• Access to your data – a copy of the information about you that we hold.
• Erasure of your data – removal of data.
• Rectification – correction of inaccurate or incomplete data.
• Restriction of processing – restriction in the way data is processed.
• Objection – to object to processing carried out on the basis of legitimate interests.
• Data Portability – transfer of your data to another provider of services.

You can also complain to the Information Commissioner’s Office on 0303 123 1113 or via www.ico.org.uk/concerns.

If you would like to make a request for any of the above, please email DPO@consultantconnect.org.uk.

 

Withdrawal of consent

If you have provided us with your consent to process your data for the purpose of using our services, you have the right to withdraw this at any time. In order to do so, you should contact us by emailing our Governance Lead at DPO@consultantconnect.org.uk.

Concerns

If you have a concern about the way we are collecting or using your personal data, you should raise your concern with us in the first instance or directly to the Information Commissioner’s Office at www.ico.org.uk/concerns.

Contact

Please address any questions, comments and requests regarding our data processing practices to our Governance Lead at DPO@consultantconnect.org.uk.

Changes to the Privacy Notice

This Privacy Notice may be changed by us at any time.