Your personal information and what we do with it

Why do you collect my information?

We collect your information for our Health Checks programme for 40 to 74-year-olds. Our service is commissioned by Somerset Council. Your data will be processed to enable us to perform Health Checks, assess your health and wellbeing and contact you.

Who do you get my data from?

We get your information from self-referral via our website or telephone service. We also receive data from the NHS Digital, detailing eligible service users, which we use to contact you.

How does data protection law allow you to use my data?

When self-referring we ask for your consent (Article 61a) and explicit consent (Article 92a) to collect, process and store your data.

When contacting you about our services from the data provided to us by the NHS we rely on the lawful basis of (Article 61e) performance of a public task carried out in the public interest and (Article 92h) processing is necessary for the purpose of preventative care. You can opt out of this communication.

What information of mine do you use?

The personal data we use from you includes:

• age
• gender
• ethnicity
• smoking status
• blood pressure
• pulse
• body mass index
• waist circumference, and
• physical activity levels.

We also use more sensitive special category data including health records, genetics and biometric data.

Do you share my information with anyone?

We share the results from your NHS Health Checks with your GP and anonymised data with Public Health. We also use Booking Bug (JRNI), a scheduling, and booking system to process appointments.

Does any of my information get sent outside of the UK?

When referring your information may get sent outside of the UK by the Booking Bug (JRNI) system. All our other systems are UK based.

How long do you keep my information?

We keep your information for 8 years in line with the NHS Records Management Code of Practice 2021.

What about my rights under Data Protection law, how can I activate them?

Under Data Protection law you have the right to:

• be informed how your data is used (which is what this leaflet is doing)
• access to your information
• rectification of errors
• erasure (in certain circumstances)
• restriction of processing (in certain circumstances)
• objection to processing
• data portability
• understand whether profiling or automated decision-making is being used (see Section 9).

If you would like to request or discuss any of these, please contact our Data Protection Officer using the details found below.

Do you use any automated decision-making or profiling on my information?

We use your information to make automated decisions about you or to profile you. Including your body mass index, cholesterol, glucose levels and Q RISK score.

What do I do if I am concerned about how you are using my information?

In the first instance we would be grateful for the opportunity to respond to your concerns ourselves and hopefully sort out any issues for you. To help with this, please write to our Data Asset Owner at the following email address NHSHC@Somerset.gov.uk

If you are not satisfied with the outcome of our support, you may take your complaint to the Information Commissioner’s Office, which regulates Data Protection. Its address is:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

It can be contacted by telephone on 0303 123 1113 or by email on icocasework@ico.org.uk