Rationale: To process your personal information if it relates to a complaint where you have asked for our help or involvement.
Legal Basis
We will need to rely on your explicit consent to undertake such activities.
Complaint Processing Activities
When we receive a complaint from a person we make up a file containing the details of the complaint. This normally contains the identity of the complainant and any other individuals involved in the complaint.
We will only use the personal information we collect to process the complaint and to check on the level of service we provide.
We usually have to disclose the complainant’s identity to whoever the complaint is about. This is inevitable where, for example, the accuracy of a person’s record is in dispute.
If a complainant doesn’t want information identifying him or her to be disclosed, we will try to respect that. However, it may not be possible to handle a complaint on an anonymous basis.
We will keep personal information contained in complaint files in line with NHS retention policy. It will be retained in a secure environment and access to it will be restricted according to the ‘need to know’ principle.
We will publish service user stories, following upheld complaints, anonymously via our governing body. The service user stories will provide a summary of the concern, service improvements identified and how well the complaints procedure has been applied. Consent will always be sought from the service user and carer or both before we publish the service user story.
We will collect and process your personal information where we are required to fund specific treatment for you for a particular condition that is not already covered in our contracts. This may be called an “Individual Funding Request” (IFR).
Type of Information Used
Identifiable – such as NHS number, DOB, Name, registered GP to make payments
Anonymous – to provide reports for analysis of payments made
Legal Basis
Direct Care and Administration UK GDPR/DPA 2018
- Article 6 1 (e)
- Article 9 2 (h)
And common law duty of confidence.
How we collect and use information in relation to funding treatments
Information required to make payments in relation to funding treatments is provided by you, along with relevant information from primary and secondary care with regard to the referral for specialist treatment.
We will collect and process your identifiable information where you have asked us to undertake assessments for Continuing Healthcare (a package of care for those with complex medical needs) and commission resulting care packages.
Type of Information Used
Identifiable – such as name, address, DOB, NHS number
Legal Basis
Direct Care and Administration GDPR/DPA 2018
- Article 6 1 (e)
- Article 9 2 (h)
And common law duty of confidence
How we collect and use information in relation to NHS Continuing Healthcare
The assessment team will collect, use, share and securely store information from / with the Local Authority (Social Services) and other organisations or individuals that are either directly or indirectly involved in the assessment, decision-making process, the arranging of care, the funding and payment of care and appropriate monitoring of and audit of the safety and quality of care.
We will collect and process identifiable information where we need to assess and evaluate any safeguarding concerns.
Legal Basis
Because of our duty to protect the safety and welfare of vulnerable children and adults, we will rely on a statutory basis rather than consent to process information for this use.
Risk stratification is a process GPs use to help them to identify and support patients with long-term conditions and to help prevent un-planned hospital admissions or reduce the risk of certain diseases developing such as type 2 diabetes. This is called risk stratification for case-finding.
Risk stratification tools use historic information about patients, such as age, gender, diagnoses and patterns of hospital attendance and admission collected by NHS England from NHS hospitals and community care services. This is linked to data collected in GP practices and analysed to produce a risk score.
There is currently s251 support in place (23/CAG/0124) for the ICB to be able to receive data with the NHS Number as an identifier from both NHS England and your GP Practice to enable this work to take place. The Data is sent directly into a risk stratification tool from NHS England /GP Practices to enable the data to be linked and processed as described above. Once the data is within the tool ICB staff only have access to anonymised or aggregated data.
GPs are able to identify individual patients from the risk stratified data when it is necessary discuss the outcome and consider preventative care.
Type of information used
Different types of commissioning data are legally allowed to be used by different organisations within, or contracted to, the NHS.
Information put into the risk stratification tools used by the ICB:
- Age
- Gender
- GP Practice and Hospital attendances and admissions
- Medications prescribed
- Medical conditions (in code form) and other things that affect your health.
Legal basis
Statutory requirement for NHS England to collect identifiable information.
A Section 251 approval from the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority, enables the use of pseudonymised information about patients included in the datasets.
There is no requirement for a legal basis for use of the aggregated information which is available to the ICB as this does not identify individuals.
Data processing activities
The ICB processes this data internally. Data is also processed by Arden & GEM (for DELPHI system) Commissioning Support Unit and Prescribing Services Ltd (Eclipse system) on behalf of the ICB.
Opt- out details
You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do not wish your data to be included in the risk stratification service (even though it is in a format which does not directly identify you) you can choose to opt-out.
In this case, because pseudonymised data is being used, the National Data Opt-Out does not apply. Instead, please inform your GP practice who will apply an opt-out code to your record to ensure that your that your information is not included in the programme.
Where we pay for care, particularly where different providers are caring for the same person, we may ask for evidence before paying, or we may commission a service where the payment is all or partly based on the providers ensuring the service user has a healthy outcome. We need to ensure that we are paying the right amount of money for the right services to the right people.
These invoices are validated within a special secure area known as a Controlled Environment for Finance (CEfF) to ensure that the right amount of money is paid, by the right organisation, for the treatment provided.
A small amount of information that could identify an individual is used within this secure area (such as NHS number or date of birth and postcode). The process followed ensures that only the minimum amount of information about individuals is used by a very limited number of people. The process is designed to protect confidentiality.
Organisations that provide treatment submit their invoices to the ICB for payment. The secure area (Controlled Environment for Finance, within the ICB) receives additional information, including the NHS Number, or occasionally the date of birth and postcode, from the organisation that provided treatment.
Our Providers send information into our secure area, which includes the NHS number and details of the treatment received. The information is then validated ensuring that any discrepancies are investigated and resolved between the Controlled Environment for Finance and the organisation that submitted the invoices. The invoices will be paid when the validation is completed.
Type of information used
- Identifiable – (name, DOB, GP, NHS number) within the Controlled Environment for Finance, for invoice validation.
- Pseudonymised, anonymised or aggregated – within the ICB, for commissioning purposes such as financial planning, management and contract monitoring.
Legal basis
A Section 251 approval from the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority enables the ICB to process identifiable information without consent for the purposes of invoice validation within a Controlled Environment for Finance – CAG 7-07(a)(b)(c)/2013.
Data processing activities
This data is processed in house by Central East ICB. Only authorised staff are able to access this information.
Opt-out details
National data opt-out does not apply
Additionally, your GP practice can apply a code which will stop your identifiable information being used for this purpose.
Additional information is also available from the NHS England website.
If you have asked us to keep you regularly informed and up to date about the work of the ICB or if you are actively involved in our engagement and consultation activities or patient participation groups, we will collect and process personal confidential data which you share with us.
Legal Basis
We will rely on your consent for this purpose
Benefits
Where you submit your details to us for involvement purposes, we will only use your information for this purpose. You can opt out at any time by contacting us using our contact details at the end of this document.
To collect NHS data about service users that we are responsible for. Different types of commissioning data are legally allowed to be used by different organisations within, or contracted to, the NHS.
Legal Basis
Our legal basis for collecting and processing information for this purpose is statutory requirement for NHS England to collect identifiable information.
A Section 251 approval from the Secretary of State, through the Confidentiality Advisory Group of the Health Research Authority, enables the use of pseudonymised information about patients included in the datasets, by the organisations who submitted the information.
There is no requirement for a legal basis for use of the aggregated information which is available to the ICB as this does not identify individuals.
Processing Activities
Hospitals and community setting organisations that provide NHS-funded care must by law submit certain information to NHS England about services provided to you and the population we serve. This information is known as commissioning datasets. The ICB obtains these datasets from NHS England which relate to patients registered with our GP practices. These datasets are then used in a format that does not directly identify you, for wider NHS purposes such as managing and funding the NHS, monitoring activity to understand and plan the health needs of the population and to gain evidence that will improve health and care through research. This enables us to plan, design, purchase and pay for the best possible care available for you.
The datasets we receive from NHS England have been linked and are in a format that does not directly identify you. Information such as your age, ethnicity and gender as well as coded information about any clinic or accident and emergency attendances, hospital admissions and treatment will be included.
We use these datasets for a number of purposes such as:
- Performance managing contracts;
- Reviewing the care delivered by providers to ensure service users are receiving quality and cost effective care;
- To prepare statistics on NHS performance to understand health needs and support service re-design, modernisation and improvement;
- To help us plan future services to ensure they continue to meet our local population needs;
- To reconcile claims for payments for services received in your GP Practice;
- To audit NHS accounts and services;
Within the ICB Groups work collaboratively to assess the need for services, and to work together in procuring, negotiating and managing contracts with Hospitals, Mental Health Providers and Community Health Providers. This collaboration is known locally as a Host and Associate Agreement and requires the ICB to receive Pseudonymised data (see definitions further on in this document). The information that is shared is governed by a written agreement and a commitment that we will not re-identify it.
Type of information used
Different types of commissioning data are legally allowed to be used by different organisations within, or contracted to, the NHS.
Data processing activities
The ICB processes this data internally. Data is also processed by MedeAnalytics and Arden & Gem on behalf of the ICB.
Opt out details
You are able to opt-out of the use of your personal data for research or planning purposes at a national level. Get further information or exercise your right to opt-out online.
If you do not wish your information to be included in these datasets, even though it does not directly identify you, Email: [email protected] and include “National data opt-out policy” in the subject line. Telephone: 0300 303 5678.
Alternatively, speak to your GP practice, they can apply a code to your records which will stop your identifiable information being used for this purpose, and be shared with the national register of opt-outs.
National Registries (such as the Learning Disabilities Register) have statutory permission under Section 251 of the NHS Act 2006, to collect and hold service user identifiable information without the need to seek informed consent from each individual service user.
Research
To support research-oriented proposals and activities in our commissioning system
Legal Basis
Your consent will be obtained by the organisation holding your records before identifiable information about you is disclosed for any research.
Sometimes research can be undertaken using information that does not identify you. The law does not require us to seek your consent in this case, but the organisation holding your information will make notices available on the premises and on the website about any research projects that are undertaken.
Benefits
Researchers can provide direct benefit to individuals who take part in medical trials and indirect benefit to the population as a whole.
Service user records can also be used to identify people to invite them to take part in clinical trials, other interventional studies or studies purely using information from medical records.
Processing Activities
Where identifiable data is needed for research, service users will be approached by the organisation where treatment was received, to see if they wish to participate in research studies.
The ICB is required by law to protect the public funds it administers. It may share information provided to it with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.
The Cabinet Office conducts data matching exercises to assist in the prevention and detection of fraud. This is one of the ways in which the Minister for the Cabinet Office takes responsibility within government for public sector efficiency and reform. The Minister for the Cabinet Office is also the Chair of the Fraud, Error and Debt Taskforce, the strategic decision-making body for all fraud and error, debt and grant efficiency initiatives across government.
Data matching involves comparing sets of data, such as the payroll or benefits records of a body, against other records held by the same or another body to see how far they match. The data is usually personal information. The data matching allows potentially fraudulent claims and payments to be identified. Where a match is found it may indicate that there is an inconsistency that requires further investigation. No assumption can be made as to whether there is fraud, error or other explanation until an investigation is carried out.
The processing of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under its powers in Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under the UK GDPR / Data Protection Act 2018.
All bodies participating in the Cabinet Office’s data matching exercises receive a report of matches that they should investigate, so as to detect instances of fraud, over- or under-payments and other errors, to take remedial action and update their records accordingly.
From 1 October 2025 we moved to a new Finance and Procurement system called Oracle Integrated Single Financial Environment Programme. (ISFE2).
The new system will improve and support payment and business processes within the ICB. As part of this system upgrade, the ICB is now able to accept card payments. The information we process about staff members employed by the ICB, suppliers and patients will continue to be protected securely.
Legal basis
Integrated Care Boards (ICBs) have specific legal obligations to maintain accurate and clear financial reporting for the use of public funds. These obligations are outlined in the Health and Care Act 2022.
The ICB collects and uses information from Serious Incident Reports from Primary and Secondary Care Providers to ensure incidents are dealt with appropriately and lessons learnt.
Legal Basis
Explicit consent.
How we collect and use information in relation to serious incident reports
We are statutorily required to fully investigate and review incidents. Where there is a requirement to provide incident reports externally the information will be anonymised unless there is a legal requirement to provide your details. You will be kept informed of the requirements we are required to meet and asked for consent where information is to be shared externally.
The ICB is responsible for planning the delivery of NHS services in its area including deciding how resources are allocated. We use several products to help decide what services to commission and to improve the NHS services provided to you. The products that we use enable care organisations to assess the effectiveness of their services, supporting them to plan and deliver care.
We use the following data processors for population health management:
- Arden and GEM Commissioning Support Unit
- Oracle Corporation UK Limited (including Cerner Ltd) and their pseudonymisation at source tool
- Palantir Technologies UK Ltd for the Federated Data Platform acting on behalf NHS England who are using this product. They provide the data platform and the technology that the product uses and only act on the instructions of the NHS England and the ICB.
- Accenture support Palantir Technologies UK Ltd in their role as processor for the above purposes.
- Amazon Web Services
- Circle Health Group Limited
- NHS South, Central and West CSU
- NHS North of England Commissioning Support Unit
- Prescribing Services Ltd (Eclipse system)
Purposes for processing personal data within the products
The products enables the ICB to better understand how NHS organisations in your area are providing care. It is a tool to: improve population health; enhance the patient experience; reduce unfairness in health outcomes, and support staff well-being.
Personal data processed with the products
Personal data which has been de-identified (we call this de-identified data) will be processed by ICB in your area for the purposes above. De-identified data that is processed to create the Product and to create anonymous data that is shown in the dashboards may include data about a patient:
• Postcode
• Date of birth and age
• Sex and Gender
• Living habits
• Professional Training / Awards / Education
• General Identifier e.g NHS Number
• Physical / Mental Health or Condition, Diagnosis / Treatment
• Racial or ethnic origin
This data is used to create dashboard where the information is ‘aggregate (grouped together) so that no individuals are identifiable.
Who personal data is shared with
De-identified data is securely analysed by a small number of data analysts in the ICB for the purposes of creating anonymous aggregated data to display in dashboards. This is data that doesn’t identify you. It is therefore not personal data.D
Data controller
The ICB is using the products are the legal controllers of your personal data under data protection laws.
Legal basis for processing personal information for this purpose
- There is currently s251 support in place 23/CAG/0124 for the flow of Primary Care data (mainly from GPs) and link to NHS England Commissioning datasets, to be used to undertake population health management. The data collected will be used to support improvement of the physical and mental health outcomes of patients.
- Population Health Management analysis will be undertaken on anonymised or aggregated data. There is no requirement for a legal basis for use of the aggregated information which is available to the ICB as this does not identify individuals.
Opt-outs
Population Health Management
- National Data Opt-outs
- Type 1 Opt-outs apply to this process.
- Under approval agreement with Health Research Authority Confidentiality Advisory Group (CAG) we have put in place a local opt out which you can request your data not be used for this process.
Federated Data Platform
For more information about how personal data is processed within the Federated Data Platform please see the NHS Federated Data Platform Privacy Notice here.
The National Data Opt Out policy does not apply to this Product as the data shared with the ICB to create the Product has been collected and shared under a legal obligation (the Legal Direction) and therefore the National Data Opt out does not apply.
Type 1 Opt Outs do not apply to this Product because the Datasets used to create the Product does not contain Confidential Patient Information that has been collected by the ICB from GP Practices.
We commission a number of organisations (both within and outside the NHS) to provide healthcare services to you. We may also share anonymised statistical information with them for the purpose of improving local services, for example understanding how health conditions spread across our local area compared against other areas.
In order to perform our commissioning functions, information may be shared between various organisations including: acute and mental health hospitals, GP practices, community services, other ICBs, commissioning support units (CSU), ambulance services, local councils (social services and public health), voluntary sector and other health organisations.
The law provides some NHS bodies, particularly NHS England ways of collecting and using patient data that cannot identify a person. This information helps commissioners to design and procure the combination of services that best suit the population they serve.
We may also share information with NHS England. If you do not want your information to be used for purposes beyond providing your care you can choose to opt-out. If you wish to do so, please inform your GP practice who will advise you of how to opt out. You can opt out of your data being used for some purposes. You can withdraw your opt-out choice at any time by information your GP Practice. More information is available on NHS Digital Your personal information choices and in the section ‘Your Rights’ below.
NHS England recognises the importance of protecting personal and confidential information in all that they do, directly or through commissioning and takes care to meet its legal duties. Follow the links on the How NHS England uses your information page for more details.
Data may be de-identified and linked so that it can be used to improve health care and development and monitor NHS performance. Where data is used for these statistical purposes, stringent measures are taken to ensure individual patients cannot be identified.
When analysing current health services and proposals for developing future services it is sometimes necessary to link separate individual datasets to be able to produce a comprehensive evaluation. This may involve linking primary care GP data with other data such as secondary uses service (SUS) data (hospital inpatient, outpatient and A&E data). In some cases there may also be a need to link local datasets which could include a range of acute-based (hospital) services such as radiology, physiotherapy, audiology etc, as well as mental health and community-based services such as Improving Access to Psychological Therapies (IAPT), district nursing, podiatry etc. When carrying out this analysis, the linkage of these datasets is always done using a unique identifier that does not reveal a person’s identity as the ICB does not have any access to patient identifiable data for this purpose.
We may also contract with other organisations to process data. These organisations are known as data processors. We ensure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed.
We use information collected by NHS England from healthcare providers such as hospitals, community services and GPs, which includes information about the patients who have received care and treatment from the services that we fund.
The data we receive does not include any direct identifiable information about patients such as names, home addresses, NHS number, postcode, and date of birth but is pseudonymised using a system called Pseudonymisation at Source, for further information please refer to the separate section within this privacy notice. This data includes information on age, ethnicity and gender as well as coded information about your visits to clinics, Emergency Department, hospital admissions and other NHS services.
The Secretary of State for Health has given limited permission for us (and other NHS commissioners) to use certain confidential patient information when it is necessary for our work and whilst changes are made to our systems that ensure de-identified information is used for purposes other than direct care. This approval is given under Regulations made under Section 251 of the NHS Act 2006 and is based on the advice of the Health Research Authority’s Confidentiality and Advisory Group.
In order to use this data, we have to meet strict conditions that we are legally required to follow, which includes making a written commitment to NHS England that we will not use information in any way that would reveal your identity. These terms and conditions can be found on the NHS England website.
We may use social media channels to share news and information with the public.
We will only publish photos and names of individuals on our social media channels where they have given us express permission to do so, unless the photos in question are stock photos. For example, we may share photos and names of some of our nurses to mark International Day of the Nurse, or share a local person’s experience of health and care with their express consent.
If you post a comment on our social media channels or send us a private or direct message, we will assume you give permission for us to respond.
Comments that you post on our social media channels are publicly visible. We may share your comments with relevant teams in our organisation to help us better understand our audiences. We may also share your direct messages with relevant teams in order to answer your message, or to share feedback you have provided.
Legal Basis – Public task. GDPR Article (1)(e) applies i.e. it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Data Processor/Controllers – The social media platforms we use are the data controllers and processors of the information shared.
Each of the social media platforms has its own privacy policy and we may use the following platforms. You can read these policies via the links below.
- Facebook: Meta Privacy Policy – How Meta collects and uses user data (facebook.com)
- Instagram: Meta Privacy Policy – How Meta collects and uses user data | Privacy Centre | Manage your privacy on Facebook, Instagram and Messenger | Facebook Privacy
- LinkedIn: LinkedIn Privacy Policy
- Twitter: Twitter Privacy Policy
- YouTube: Privacy Policy – Privacy & Terms – Google
Where we have entered data onto the platforms, we have the ability to control as so far as the terms and conditions of the companies allow. In some instances it may be necessary to contact the social media company directly to exercise rights under UK GDPR.