Privacy

If you are a user with general public and anonymous access the EPUT website does not store or capture personal information, but merely logs the user’s IP address that is automatically recognised by the web server. We do not use cookies for collecting user information and we will not collect any information about you except that required for system administration of our web server.

This privacy statement only covers the EPUT website. This statement does not cover links within this site to other websites.

Terms and conditions

Welcome to our website. If you continue to browse and use this website you are agreeing to comply with and be bound by the following terms and conditions of use, which together with our privacy policy govern EPUT’s relationship with you in relation to this website.

The term ‘EPUT’ or ‘us’ or ‘we’ refers to the owner of the website. The term ‘you’ refers to the user or viewer of our website.

The use of this website is subject to the following terms of use:

The content of the pages of this website is for your general information and use only. It is subject to change without notice.

Neither we nor any third parties provide any warranty or guarantee as to the accuracy, timeliness, performance, completeness or suitability of the information and materials found or offered on this website for any particular purpose. You acknowledge that such information and materials may contain inaccuracies or errors and we expressly exclude liability for any such inaccuracies or errors to the fullest extent permitted by law.

Your use of any information or materials on this website is entirely at your own risk, for which we shall not be liable. It shall be your own responsibility to ensure that any services or information available through this website meet your specific requirements.

This website contains material which is owned by or licensed to us. This material includes, but is not limited to, the design, layout, look, appearance, and graphics. Reproduction is prohibited other than in accordance with the copyright policy, which forms part of these terms and conditions.

From time to time this website may also include links to other websites. These links are provided for your convenience to provide further information. They do not signify that we endorse the website(s). We have no responsibility for the content of the linked website(s).

You may not create a link to this website from another website or document without EPUT’s prior consent. Your use of this website and any dispute arising out of such use of the website is subject to the laws of England, Scotland, and Wales.

Fair Processing Notice

Essex Partnership University NHS Foundation Trust (the Trust) processes information about you to provide health care services, and in doing so has to comply with the requirements of the General Data Protection Regulation (GDPR). This means that data held about you must only be used for specific purposes as defined by law. This Fair Processing Notice has been created to inform you about the types of information held about you, why that information is held about you, and to whom that information may be shared.

Who we are and what we do

Essex Partnership University NHS Foundation Trust (EPUT provides community health, mental health and learning disability services to support more than 3.2 million people living across Bedfordshire, Essex and Suffolk.

We are a large employer in the East of England with over 5,000 staff working across more than 200 sites. We also provide services in people’s homes and community settings.

If you have any questions regarding your information and how it is used, please contact the below department and we will do our best to help:

If your issues cannot be resolved by the DPO regarding your query, and you are still not happy with our response, please see the Trust Complaints department details below and the ICO details (Information Commissioners Office).

You have the option to consult your own legal counsel for further opinions if you find the responses from the aforementioned contacts unsatisfactory.

Why we collect information about you

Your clinical care team and other health and care professionals caring for you keep records about your health and any treatment and care you receive from the NHS. These help ensure that you receive the best possible care from us. They may be written down (manual records) or held on a computer. The records may include:

• Basic personal information about you, such as,
  • name
  • address
  • date of birth
  • contact details (telephone numbers/email address),
  • NHS number
  • next of kin details
• Use of SMS Text Messaging for Appointment Communications
  • When attending the Trust for an appointment, you may be asked to confirm that we hold accurate contact details for you, including your mobile telephone number. If you provide a mobile number, the Trust may use this to send information via SMS text messages.
  • The use of SMS messaging helps ensure timely communication and supports efficient service delivery. You have the right to opt out of receiving SMS communications at any time. If you choose to opt out, this preference will be recorded in your patient record and respected by all relevant staff.
  • Your contact information is processed in accordance with data protection legislation and is used solely for the purposes of your direct care.
• Contacts we have had with you, such as day care clinics and/or home visits
• ”Special categories” of information about you, such as,
  • Notes and reports about your health and any treatment and care you need
  • Details and records about the treatment and care you receive
• Relevant information from other health and social care professionals, local authorities, voluntary organisations, relatives or those who care for you and know you well

• Use of Artificial intelligence
  • SOPHIA – uses AI to transform EPUT’s Safety Improvement Plans into live, actionable intelligence – driving measurable improvements and supporting continuous learning. This software may use Patient Identifiable Data to ensure that a plan is tracked, actioned and registered appropriately. This process forms part of EPUT’s Safety Policies and Procedures.
  • Beautiful Voice – Used by the Speech & Language team. This is a platform that helps people with speech and language difficulties by providing exercises they can do at home, and tools for our therapists to help assess and treat clients. This platform is used by many NHS organisations successfully and backed by NIHR.
• Each Person – The Trust processes personal data for the management and recognition of its staff, including through third-party platforms such as Each Person. Each Person is an online staff recognition platform, to support staff engagement and wellbeing. The platform is used to recognise and reward staff contributions.

Other types of information used/processed by the Trust:

• Anonymised information/data, which is data about you, but you cannot be personally identified
• De-identified information/data (Pseudonymised), which is data about you, but you cannot be personally identified only your care pathway to help improve the services we provide
• We record CCTV images of people entering, approaching, or passing our buildings (there will be clear signs to advise you that CCTV is in operation) to;
  • Help staff and visitors feel safer
  • Act as a deterrent to offenders
  • Allow the collection of evidence to help find and convict offenders
  • Prevent, detect, investigate, and prosecute fraud
• Body Worn Video (BWV) footage is used by our Mental Health staff within our wards to reduce the potential escalation of incidents to protect patients and staff. This will allow the collection of evidence to help find and convict offenders. The BWV will only be activated if the staff feel there is a risk to safety. Should the BWV be activated, you will be advised by the staff.
• Realwear Headsets – Voice-activated headsets (Realwear) and use of SimplyVideo for real-time clinical assistance. Headset wearer (Clinician) will speak to the patient to make them aware of the headset and what it is to be used for. If patient does not want the headset used then they will not use it.
• Oxevision is a medical device that captures video footage to monitor the vital signs of patients. Footage can be used (clipped) in response to a patient safety incident or following a change in a patient’s vital signs resulting in a system alert. The collection of evidence may be used to help with investigations, complaints, lessons learnt and inquests. The video data is stored on the system for 24 hours before being overwritten. Clipped footage is stored in line with local policy. The Lampard Inquiry has restricted the Trust from deleting records until the Inquiry has concluded.
• vCreate Neuro is a secure clinical video support service allowing patients and clinicians to upload and share clinical videos and photos of children having seizures safely and securely. If patients carers don’t want to use the app, they will not register to use it.
• Glooko which is web-based programme that centralises data from more than 200 diabetes and health monitoring devices in one secure platform. The license for use is provided by Glooko and enables HCPs to download patient data from insulin pumps, CGM (Continuous Glucose Meter) devices and compatible BG (Blood Glucose) meters. This enables HCPs to generate crucial reports to assist with patients’ diabetes management and care plans.

How your records are used to help the Trust

Your information will also be used to help us manage the Trust and protect the health of the public by being used to:

• Review the care we provide to ensure it is of the highest standard and quality
• Ensure our services can meet service user needs in the future
• Investigate service users’ queries, complaints, and legal claims
• Prepare statistics on the Trust’s performance
• Audit Trust accounts and services
• Undertaking heath research and development (you may choose whether to be involved)
• Helping to train and educate healthcare professionals
• Test that current / new patient and clinical systems are working effectively
• Support the Lampard Inquiry which is a public inquiry established under the Inquiries Act 2005, and chaired by Baroness Kate Lampard CBE, to investigate mental health deaths in Essex in accordance with terms of reference. The Lampard Inquiry processes personal data provided to it by the Trust and others in accordance with its Privacy Information Notice which is available on its website.

Some of this information is held centrally within the Trust, but where this is used for statistical purposes stringent measures are taken to ensure that individual service users cannot be identified. Anonymous statistical information may also be passed to organisations with a legitimate interest, including Universities and Research Institutions.

Where it is not possible to use anonymised information, personally identifiable information may be used for essential NHS purposes. They may include research and auditing services.

You have a choice about whether your confidential patient information is used for research and planning. If you are happy with this use, you do not need to do anything.  If you choose to opt-out, your confidential information will still be used to support your individual care.

To find out more or to register your choice to opt-out, please visit the Your NHS Data Matters website or call the national helpline on 0300 303 5678. You can change your mind about your choice at any time. 

How we keep your records confidential and secure

Everyone working for the NHS has a legal duty to keep information about you confidential and secure.

We keep your information safe and secure and comply with industry standards, such as, Cyber Security Essential and the Data Security and Protection Toolkit (DSPT).

You may be receiving care from other organisations as well as the NHS e.g. Social Services and the Voluntary Sector. We may need to share some information about you so we can all work together for your benefit. We will only ever use or pass on information about you if others involved in your care have a genuine need for it. When we pass on any information, we will ensure it is kept confidential and secure.

We are required by law to report certain information to the appropriate authorities. This is only provided after formal permission has been given by a qualified health professional, as defined under Data Protection. Occasions when we must pass on information include:

• Notification of births and deaths
• Where we encounter infectious diseases, which may endanger the safety of others such as meningitis or measles
• Child Protection cases
• Where a formal court order has been issued
• Benefits Agency cases
• National Treatment Agency for Substance Misuse to monitor the availability, capacity, and effectiveness of treatment for drug misuse in England 

Retention periods

We follow the local Trust policies and guidance in regard to the retention periods of data and information that we hold.

The Lampard Inquiry terms of reference and restrictions state that the Trust cannot delete any data and information until the Inquiry has concluded. Once the Inquiry has concluded, the Trust will start to align its retention periods with the national Records Management Code of Practice 2023, policies and guidance.

Who do we share your information with?

Everyone working within the NHS has a legal duty to keep information about you confidential and secure. Similarly, anyone who receives information from us has a legal duty to keep it confidential and secure.

We will share information with the following main partner organisations:

• Other NHS Trusts, hospitals that are involved in your care
• Clinical Commissioning Groups and other NHS bodies
• General Practitioners (GPs)
• Ambulance Trusts

You may be receiving care from other service providers as well as the NHS, for example Social Care Services. We may need to share some information about you with them so we can all work together for your benefit if they have a genuine need for it as part of your care or we have your permission. Therefore, we may also share your information with:

• Social Care Services
• Education Services
• Local Authorities
• Voluntary and private sector providers working with the NHS
• Police in emergency situations
• The Essex Mental Health Independent Inquiry

We are supporting the Lampard Inquiry which is in place to investigate deaths that took place in mental health inpatient facilities, or within three months post discharge, across NHS Trusts in Essex between 1 January 2000 to 31 December 2023. You may be written to by the Inquiry in order that they can share information with you regarding the Inquiry and to request your support to share experiences with them. We will endeavour to comply with all the Inquiry’s information requests that meet legal standards and the agreed terms of reference.

The Inquiry has its own Privacy Notice which is available here Privacy Information Notice – The Lampard Inquiry – investigating mental health deaths in Essex

However, a person’s right to confidentiality is not absolute and there may be other circumstances when we must share information from your patient record with other agencies. In these rare circumstances, we are not required to have your consent. Examples of this are:

• If there is a concern that you are putting yourself at risk of serious harm
• If there is concern that you are putting another person at risk of serious harm
• If there is concern that you are putting a child at risk of harm
• If we have been instructed to do so by a Court
• If the information is essential for the investigation of a serious crime
• If you are subject to the Mental Health Act (1983), there are circumstances in which your ‘nearest relative’ must receive information even if you object

If your information falls within a category that needs to be notified for public health or other legal reasons, such as certain infectious diseases

The information from your patient record will only be used for purposes that benefit your care – we would never share it for marketing or insurance purposes.

All Trust servers are based in the UK, however, if we do transfer your personal information outside the UK, we will make sure that it is protected to the same extent as it would be within the UK.

What are your data protection rights?

You have a right to have your privacy respected and your data protected. The new law gives you easier access to the personal information we hold about your if you wish to check or change it. It is designed to give you confidence that this information is accurate, up to date and well managed.

Your rights are listed below.

• The right to request access to information we hold about you
• The right to be informed about how we collect and process the information we hold about you
• The right to have your information rectified if the information we hold about you is not correct
• The right to request erasure of the information we hold about you that falls outside our legal basis
• The right to restrict processing which gives you an alternative to the erasure of the information we hold about you. This means we can hold the information, but we cannot use it or share it with external organisations.
• The right to object to the use of your information for reasons other than to provide you with care.

Our lawful reasons for using your data

Please visit the lawful reasons for using your data webpage for more information.

My Care Record

Essex Partnership NHS University Foundation Trust is part of My Care Record, an approach to improving care by joining up health and care information. Health and care professionals from other services will be able to view information from the records we hold about you when it is needed for your care. Please see the My Care Record website for more information.

Shared Care Records and information sharing

Shared Care Records (SCR), were previously called Local Health and Care Records. The SCR will allow people involved in your care to access your health and care records safely and securely so that they can provide better joined-up care as you move between different parts of the health and social care system. You can read more about Shared Care Records on the NHS England website.

The use of Artificial Intelligence (AI)

We may use AI technology to support our clinicians in identifying potential health issues. The AI technology may be used to review the data to identify potential findings and assist the clinician in decision-making and in no way will replace the final decision of a clinician. In addition, we may also use AI technology as part of our system security initiatives. We will also abide by the code of practice regarding the use of digital and data-driven health technologies, please refer to “A Guide to Good Practice for Digital and Data-Driven Health Technologies” – GOV.UK (www.gov.uk), Information Commissioners Office (ICO) guidance – Artificial intelligence | ICO, NHS England guidance – NHS England » Artificial intelligence (AI) and machine learning.

Patient Knows Best (PKB) patient portal

Essex Partnership University Trust (EPUT) and Mid and South Essex NHS Foundation Trust (MSEFT) are working together to launch the new patient portal in partnership with our third-party data processor, PKB.

Please see Patients Know Best for more information.

Lead generation campaigns

EPUT is committed to protecting your privacy. This Privacy Policy outlines how we collect, use, and protect your personal information when you participate in our lead generation campaigns through Facebook.

Information we collect

When you engage with our campaign, we may collect the following information:

• Name
• Email Address
• Phone Number
• Any additional information you voluntarily provide

How we use your information

The information we collect is used for the following purposes:

• The data will be used solely for the purpose of delivering the requested content and will not be shared with third parties.

Data retention and deletion

We will retain your personal information only for as long as necessary to fulfil the purposes outlined in this policy. Once the campaign has concluded, we will delete your data securely within 30 days to ensure your privacy is maintained.

Your rights

You have the right to:

• Access your personal information
• Request correction of inaccurate data
• Request deletion of your data at any time

Changes to this policy

We may update this Privacy Policy from time to time. We will notify you of any changes by posting the new policy on our Facebook page and updating the effective date.

Child friendly privacy policy print

Privacy policy print