Skip to main content Skip to footer

Data Protection Privacy Notice

About ANIA

The ANIA programme has been developed to support NHS Scotland Boards roll out patient support services, such as Closed Loop Services for type 1 diabetes and digital dermatology, in a much more coherent and streamlined approach, ensuring that patients are receiving the care and support they need, without undue delay.  This is a collaboration with ANIA and NHS Scotland.

The National Diabetes CLS Onboarding Team staff are NHS Scotland employees working within the ANIA Programme as part of Centre for Sustainability Delivery Team who are based at NHS Golden Jubilee.  This means that the team working on this project are employees of NHS Golden Jubilee.

Fundamentally, the National Diabetes CLS Onboarding Team will be contacting patients on behalf of NHS Scotland Boards to support the adoption of various devices, such as Closed Loop System (CLS) for type 1 diabetes. The National Diabetes CLS Onboarding Team will also play a vital role training patients in the adoption and use of these devices.  The team will only be contacting patients that have agreed to be referred to the programme. It will be fully explained, at the point of referral, to these patients, the purpose of the programme and how their data will be processed.

The National Diabetes CLS Onboarding Team will be engaging and providing information with various device suppliers and will have Data Processing Agreements in place with each of these suppliers.

A Data Protection Impact Assessment (DPIA) has also been completed to support the data processing within this programme.

About NHS Golden Jubilee

NHS Golden Jubilee is a public organisation created in Scotland under the National Health Service (Scotland) Act 1978 (the 1978 Act). It is one of the organisations which form part of NHS Scotland (NHSS).

The NHS Golden Jubilee, which is the brand name for the National Waiting Times Centre Board, is a registered Data Controller on the Information Commissioner’s Office (ICO) website. The Data Controller registration number on the ICO website is Z7996020.

Device Suppliers

The National Diabetes CLS Onboarding Team will be working with relevant device suppliers who will play a vital role in the digital technology and devices required for the patients within the ANIA programme.  All of these suppliers are UK based and provide secure devices which have been assessed and approved for use within the digital framework for NHS Scotland.

About the personal information we use

NHS Health Boards across Scotland will be supplying The National Diabetes CLS Onboarding Team at NHS Golden Jubilee with patient information in order to deliver this service. The information provided about patients involves the following information:

  • Patient’s name
  • Date of birth
  • Community Health Index Number (CHI number)
  • Telephone number
  • Email address (where available)
  • Appropriate and proportionate health information in relation to the specific service the patient is receiving

Only the relevant clinical information about you is shared with this team regarding the service and device you will be using. The team are not provided with any access to any part of your medical records. Information will only be shared for patients who agree to be part of the ANIA programme.

Our purposes for using personal information

Under the 1978 Act NHS Golden Jubilee has the statutory responsibility to provide or arrange for the provision of a range of healthcare, health improvement and health protection services. We are given these tasks so that we can help to promote the improvement of the health and wellbeing of our patients and assist in operating a comprehensive and integrated national health service in Scotland. 

We use personal information to enable us to provide healthcare services for patients, data matching under the national fraud initiative; research; supporting and managing our employees; maintaining our accounts and records and the use of CCTV systems for crime prevention.

Our legal basis for using personal information

NHS Golden Jubilee, as data controller, is required to have a legal basis when using personal information.

NHS Golden Jubilee considers that performance of our tasks and functions are in the public interest.  So, when using personal information our legal basis is usually that its use is necessary for the performance of a task carried out in the public interest, or in the exercise of official authority vested in us. 

In some situations, we may rely on a different legal basis; for example, when we are using personal information to pay a supplier, our legal basis is that its use is necessary for the purposes of our legitimate interests as a buyer of goods and services. Another example would be for compliance with a legal obligation to which NHS Golden Jubilee is subject to, for example under the Public Health etc. (Scotland) Act 2008 we are required to notify Health Protection Scotland when someone contracts a specific disease.

When we are using more sensitive types of personal information, including health information, our legal basis is usually that the use is necessary:

  • for the provision of health or social care or treatment or the management of health or social care systems and services; or
  • for reasons of public interest in the area of public health; or
  • for reasons of substantial public interest for aims that are proportionate and respect people’s rights, for example research; or
  • in order to protect the vital interests of an individual; or
  • for the establishment, exercise or defence of legal claims or in the case of a court order

On rare occasions we may rely on your explicit consent as our legal basis for using your personal information.  When we do this we will explain what it means, and the rights that are available, to you.  You should be aware that we will continue to ask for your consent for other things like taking part in a drug trial, or when you are having an operation. 

Who provides the personal information?

The National Diabetes CLS Onboarding Team at NHS Golden Jubilee receives personal information about patients, who have agreed to take part in the programme, from individual Health Boards.

The personal and health information shared with the team is limited to only what is necessary for the purpose of the service ANIA (NHS Golden Jubilee) are providing.

Sharing personal information with others

The data will only be shared between the NHS Board of residence and the National Diabetes CLS Onboarding Team for the purposes outlined above.  The team will only share relevant, proportionate information to the appropriate device suppliers in relation to the specific services received by the patient.  Patients will be fully informed of this at the point of referral. 

Transferring personal information abroad

Personal data of patients will not be transferred outside of the United Kingdom.

Retention periods of the information we hold

Participant information will be held securely (electronically) by ANIA for the duration of the funded projects (12 months).

Advice will be sought from Information Governance leads from the referring Boards when the projects have concluded regarding the appropriate storage/archiving/destroying of participant data.  Anonymised participant data will be available electronically via project update and evaluation reports and stakeholder engagement communications – these may be published online.  The ongoing retention of participant data which is not anonymised, beyond the duration of the 12 month project will not be required.

How we protect personal information

We take care to ensure your personal information is only accessible to authorised people.  Our staff have a legal and contractual duty to keep personal health information secure, and confidential.

The following security measures are in place to protect personal information:

  • All staff undertake mandatory training in Data Protection and IT Security
  • Compliance with Scottish Government Public Sector Cyber Resilience Framework
  • Organisational policy and procedures on the safe handling of personal information
  • Access controls and audits of electronic systems

Your rights

This section contains a description of your data protection rights within NHS Golden Jubilee.

The right to be informed

NHS Golden Jubilee must explain how we use your personal information. We use a number of ways to communicate how personal information is used, including:

  • This Data Protection Notice
  • Our main Data Protection Notice (https://www.nhsgoldenjubilee.co.uk/site-information/privacy-policy)
  • Information leaflets
  • Discussions with staff providing your care

The right of access

You have the right to access any data we may hold about you. Any request in relation to right of access for the national validation campaign will be managed by NHS Golden Jubilee following the standard processes already in place for right of access requests.

If you require to access the information we hold in relation to this programme, the ANIA team will engage with the NHS Board of residence and the Data Protection Officer at both Boards to ensure the request is being managed by the appropriate organisation.

The first point of contact for this is ig@gjnh.scot.nhs.uk

The right to rectification

If you identify an error in the information we hold about you in relation to the programme, ANIA will communicate this back to the NHS Board of residence for the information to be corrected.

For example, a patient’s clinical information may change while on the programme.  In this instance, if the National On-boarding team at ANIA are the primary contact from the patient this information will be shared with the NHS Board of residence for updating.

The right to object

The right to object to your information being processed in this case does not apply as the services provided under the programme is considered a part of our ‘public task’ as it is essential to patient care.  You can, however, ask to be treated back at your Board of residence and be removed from the ANIA programme.

Right to restrict processing (where applicable)

Requests to restrict the right to processing will be managed under the current NHS Golden Jubilee processes and will be assessed if such a request is made.

Right to data portability (where applicable)

Information can be supplied in different formats if requested.

Right to erasure (where applicable)

This right does not apply in these circumstances involving health records.

Rights in relation to automated decision-making and profiling (where applicable)

This does not apply in these circumstances as there will be no automated decision making or profiling involved in the data processing.

The right to complain

NHS Golden Jubilee employ a Data Protection Officer (DPO) to check that we handle personal information in a way that meets data protection law.  If you are unhappy with the way in which we use your personal information, please tell our Data Protection Officer using the contact details below.

Mrs Sharon Stott
Head of Digital Governance/DPO 
eHealth Department
Golden Jubilee National Hospital
Agamemnon Street
Clydebank, G81 4DY

Tel: 0141 951 5765

Email: Sharon.stott@gjnh.scot.nhs.uk

You also have the right to complain about how we use your personal information to the Information Commissioner’s Office (ICO). Details about this are on their website at www.ico.org.uk.