Privacy Policy

NOTE: The fol­low­ing pol­i­cy is that of the North East Lon­don LPC, North East Lon­don Pub­lic Phar­ma­cy Part­ner­ship (NELPPP) is a divi­sion of the NEL LPC and is there­fore cov­ered under the same Pri­va­cy Pol­i­cy.

 

NORTH EAST LONDON LOCAL PHARMACEUTICAL COMMITTEE

PRIVACY POLICY

 

ALLOCATION OF RESPONSIBILITY

Data Con­troller: The North East Lon­don LPC

As the data con­troller, the North East Lon­don LPC is respon­si­ble for imple­ment­ing GDPR and is account­able for data pro­tec­tion.

North East Lon­don LPC Secretary/ Senior Infor­ma­tion Risk Own­er: Hemant Patel

Data Pro­tec­tion Offi­cer: Rebec­ca Dew

For queries, con­cerns and requests please con­tact Rebec­ca Dew using the fol­low­ing details

Phone: 01277 849219

Email: rebecca.dew@nellpc.org.uk

LPC Data Pro­tec­tion Office (DPO) respon­si­bil­i­ties

The LPC data pro­tec­tion offi­cer is appoint­ed to ensure the data pro­cess­ing activ­i­ties at the North East Lon­don LPC are law­ful and in com­pli­ance with GDPR guide­lines; to inform and advise staff on the reg­u­la­tions in accor­dance with the com­pa­ny poli­cies and as a con­tact at the organ­i­sa­tion for data pri­va­cy issues and requests.

The data pro­tec­tion offi­cer is able to pro­vide you with infor­ma­tion on your rights as a data sub­ject and sup­port you through the process of exer­cis­ing these rights.

For more infor­ma­tion on the respon­si­bil­i­ties of a Data Pro­tec­tion Offi­cer, please vis­it the ICO web­site: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/accountability-and-governance/data-protection-officers/

 

SCOPE

This pol­i­cy applies to the data col­lec­tion and han­dling process­es of the North East Lon­don LPC, this includes the North East Lon­don Pub­lic Phar­ma­cy Part­ner­ship divi­sion. The fol­low­ing out­lines the type of data we process, our rea­sons for doing so and how we col­lect, use and pro­tect this data.

On col­lec­tion of per­son­al data, you will be asked to con­sent to the pro­cess­ing and stor­age of your per­son­al data in accor­dance with this Pri­va­cy Pol­i­cy.

 

TYPES OF DATA WE COLLECT

The North East Lon­don LPC deals with busi­ness data and anonymised sta­tis­tics on a reg­u­lar basis, this data in itself is not sub­ject to cur­rent data pro­tec­tion reg­u­la­tion. How­ev­er, per­son­al data is col­lect­ed by the LPC in rela­tion to busi­ness data and by the Pub­lic Phar­ma­cy Part­ner­ship divi­sion.

The North East Lon­don LPC col­lect the fol­low­ing data in rela­tion to the busi­ness data han­dled in our usu­al prac­tice:

  • Name
  • Home Address
  • Per­son­al Con­tact details (Phone num­ber, mobile, per­son­al email address)
  • Per­son­al and pro­fes­sion­al inter­ests (such as train­ing, clin­i­cal, polit­i­cal)
  • IP Address (when access­ing our web­site)
  • Train­ing atten­dance details
  • Pro­fes­sion
  • Job title
  • Work Address

The North East Lon­don Pub­lic Phar­ma­cy Part­ner­ship col­lect the fol­low­ing infor­ma­tion from their mem­bers and poten­tial­ly web­site vis­i­tors:

  • Name
  • Home Address
  • Per­son­al Con­tact details (Phone num­ber, mobile, per­son­al email address)
  • Per­son­al inter­ests
  • Health Inter­ests
  • IP Address (through web­site)

 

LAWFUL BASIS AND PURPOSE OF DATA COLLECTION

The pur­pose of the data col­lec­tion out­lined above is for the North East Lon­don LPC to update inter­nal records; com­mu­ni­cate with and sup­port con­trac­tors and phar­ma­cy staff in their dai­ly busi­ness, as well as pro­vide oppor­tu­ni­ties to ben­e­fit the phar­ma­cy and local com­mu­ni­ties across the fol­low­ing bor­oughs of North East Lon­don:

  • Bark­ing and Dagen­ham
  • Haver­ing
  • Newham
  • Red­bridge
  • Tow­er Ham­lets
  • Waltham For­est

The activ­i­ties of the North East Lon­don LPC (and PPP divi­sion) falls under the fol­low­ing as law­ful basis for data pro­cess­ing

Arti­cle 6 (1) (e) “pro­cess­ing is nec­es­sary for the per­for­mance of a task car­ried out in the pub­lic inter­est or in the exer­cise of offi­cial author­i­ty vest­ed in the con­troller;”

Arti­cle 6 (1) (f) “pro­cess­ing is nec­es­sary for the pur­pos­es of the legit­i­mate inter­ests pur­sued by the con­troller or by a third par­ty, except where such inter­ests are over­rid­den by the inter­ests or fun­da­men­tal rights and free­doms of the data sub­ject which require pro­tec­tion of per­son­al data…”

 Pseu­do­nymised Health Data

 On occa­sion, the LPC may be required to process pseu­do­nymised patient data. The LPC would not be able to iden­ti­fy the patient by their name, address or con­tact infor­ma­tion but can access health and med­i­cine infor­ma­tion. There­fore, this pseu­do­nymised data falls under the scope of GDPR and is classed as a spe­cial cat­e­go­ry.

The pur­pose of the LPC expos­ing this data would be with respect to the care of the patient or poten­tial­ly due to a pay­ment or ser­vice dis­rup­tion issue from a con­trac­tor, NHSE or the com­mis­sion­er. This would fall under the same law­ful basis as the LPC, with the addi­tion of the fol­low­ing for spe­cial cat­e­gories:

Arti­cle 9 (2) (b) “pro­cess­ing is nec­es­sary for the pur­pos­es of car­ry­ing out the oblig­a­tions and exer­cis­ing spe­cif­ic rights of the con­troller or of the data sub­ject in the field of employ­ment and social secu­ri­ty and social pro­tec­tion law in so far as it is autho­rised by Union or Mem­ber State law or a col­lec­tive agree­ment pur­suant to Mem­ber State law pro­vid­ing for appro­pri­ate safe­guards for the fun­da­men­tal rights and the inter­ests of the data sub­ject;”

 

HOW IS DATA COLLECTED

The North East Lon­don LPC receive data from com­mu­ni­ca­tions with con­trac­tors and com­mis­sion­ers, as well as NHS Eng­land, PSNC, NHSBSA and PCSE as appro­pri­ate. This infor­ma­tion is most­ly busi­ness data but may con­tain the per­son­al data men­tioned pre­vi­ous­ly, which is there­fore sub­ject to reg­u­la­tion.

The North East Lon­don LPC receives per­son­al data from our web­site form sub­mis­sions, when atten­dees reg­is­ter for events or local health and social care staff indi­cate inter­ests in train­ing or ser­vices. The LPC also hold an annu­al con­trac­tor sup­port sur­vey to ensure our data­bas­es are up to date, these sub­mis­sions may include the per­son­al data men­tioned pre­vi­ous­ly.

The North East Lon­don Pub­lic Phar­ma­cy Part­ner­ship col­lects per­son­al data from mem­bers when they reg­is­ter. This is done in the fol­low­ing two ways:

  • Com­plet­ing an online reg­is­tra­tion form
  • Com­plet­ing a hard copy reg­is­tra­tion form, which is then sent to the LPC office to reg­is­ter elec­tron­i­cal­ly.

Cook­ies- Our web­sites use cook­ies which col­lect poten­tial­ly per­son­al data for web­site oper­a­tional and ana­lyt­i­cal pur­pos­es. The col­lec­tion of this data is in accor­dance with this pri­va­cy pol­i­cy, for more detailed infor­ma­tion on cook­ies this please see our cook­ie pol­i­cy.

Pseu­do­nymised Health Data – As appro­pri­ate, any data of this nature would be shared with the LPC from the data proces­sor such as Phar­maout­comes or Sonar Infor­mat­ics. The North East Lon­don LPC would not be able iden­ti­fy­ing patients using this data.

 

HOW IS DATA USED

 The North East Lon­don LPC (Includ­ing the NEL PPP divi­sion) uses data for the fol­low­ing:

  • Com­mu­ni­ca­tion to inform and sup­port con­trac­tors, phar­ma­cy staff and phar­ma­cy users
  • To rep­re­sent con­trac­tors where appro­pri­ate
  • Updat­ing inter­nal data­bas­es
  • Adver­tis­ing local train­ing and oppor­tu­ni­ties
  • Estab­lish­ing health and social care train­ing needs in the local area
  • Mak­ing busi­ness cas­es when dis­cussing oppor­tu­ni­ties with com­mis­sion­ers

 Pseu­do­nymised Health Data – is used by the North East Lon­don LPC for analy­sis pur­pos­es, such as at the end of a pilot to mea­sure the need, impact, use­ful­ness and sus­tain­abil­i­ty.

 

DATA RETENTION & SECURITY

Dig­i­tal records

The North East Lon­don LPC’s dig­i­tal records are stored on pass­word pro­tect­ed, desk­top com­put­ers in the LPC office. Access to these com­put­ers is strict­ly autho­rised employ­ees only, to which each employ­ee is sub­ject to a con­fi­den­tial­i­ty agree­ment. All desk­tops are rou­tine­ly mon­i­tored using virus and breach detec­tion soft­ware.

Dig­i­tal records for the phar­ma­cy is held until they are no longer an LPC con­trac­tor and for 7 years after. How­ev­er, the per­son­al details of the staff mem­bers at the phar­ma­cy will be changed when they cease employ­ment (once we are noti­fied of this change). Train­ing and event atten­dance infor­ma­tion is also held by the LPC for 7 years after the event has tak­en place, at which point the details will be anonymised for the pur­pos­es of train­ing analy­sis, your per­son­al data will not be kept.

North East Lon­don PPP mem­ber­ship records are held in a pass­word pro­tect­ed data­base in the LPC office. Mem­ber­ship records are erased when mem­ber­ship is can­celled.

Paper records

Any phys­i­cal, paper records are kept in the North East Lon­don LPC office, which is both locked and alarmed dur­ing non-work­ing hours. Again, access to these records are strict­ly employ­ees only.

These records are kept for the dura­tion of the project they serve and then dis­posed of annu­al­ly via an accred­it­ed, secure dis­pos­al com­pa­ny. The LPC is pro­vid­ed with cer­ti­fi­ca­tion for the destruc­tion of con­fi­den­tial mate­ri­als.

Web­site

Infor­ma­tion that is sub­mit­ted to the North East Lon­don LPC web­site is stored on the LPC serv­er until down­loaded onto the office desk­tops. Once down­loaded, data com­plete­ly removed from the web­site and then adheres to the ‘dig­i­tal record’ guide­lines above. Only office employ­ees have access to any form sub­mis­sions.

Per­son­al Infor­ma­tion that is stored on the NELPPP web­site (mem­ber­ship infor­ma­tion) is pri­vate­ly stored on the site on the same serv­er as is used for nellpc.org.uk, with the con­sent of the mem­ber upon reg­is­tra­tion. This data will be retained until mem­ber­ship is can­celled, at which point a data sub­jects details will be removed upon request and destroyed.

Access

Only those who work in the LPC office are exposed to your per­son­al data. Each mem­ber of staff has signed and returned a con­fi­den­tial­i­ty agree of which they must adhere to dur­ing their employ­ment at the LPC.

Both the North East Lon­don LPC and North East Lon­don PPP will obtain your con­sent before stor­ing any of your per­son­al infor­ma­tion.

 

THIRD PARTIES

The LPC will nev­er sell or rent your infor­ma­tion to a third-par­ty organ­i­sa­tion.

The LPC will not share your per­son­al infor­ma­tion to a third par­ty with­out your pri­or con­sent. Once con­sent­ed, the North East Lon­don LPC will only share the infor­ma­tion agreed but can­not be held respon­si­ble for the third party’s han­dling and pro­tec­tion of the data shared. Any Third Party’s pro­cess­ing of data will be in accor­dance with their rel­e­vant pri­va­cy poli­cies and pro­ce­dures.

Third Par­ty Cook­ies- Our web­sites use plu­g­ins which require cook­ies in order to func­tion prop­er­ly and improve your expe­ri­ence of our web­site. The third-par­ty cook­ies may col­lect user infor­ma­tion once you have con­sent­ed, as out­lined in our cook­ie pol­i­cy.

 

EXTERNAL WEBSITE LINKS

Our newslet­ters, emails, web­sites (nellpc.org.uk and nelppp.org.uk) and their asso­ci­at­ed sub­do­mains may pro­vide links to exter­nal sites. The North East Lon­don LPC is not respon­si­ble for the sites con­tent, the web­site will be sub­ject to its own pri­va­cy poli­cies and pro­ce­dures which you are encour­aged to read in the first instance.

 

RIGHTS OF DATA SUBJECT

Under GDPR, as a data sub­ject you have the fol­low­ing rights:

  • The right to be informed on why and how your per­son­al data is processed
  • The right to request access to your per­son­al data and infor­ma­tion on how and why it is processed
  • The right to rec­ti­fy any inac­cu­rate or incom­plete per­son­al data
  • The right to the era­sure of your per­son­al infor­ma­tion (to ‘be for­got­ten’)
  • The right to restrict the pro­cess­ing of your per­son­al data
  • The right to data porta­bil­i­ty (copy­ing or trans­fer­ring your per­son­al data)
  • The right to object to the pro­cess­ing of your per­son­al data
  • Rights in rela­tion to auto­mat­ed deci­sion mak­ing and pro­fil­ing (where there is no Human involve­ment)

Not all of these rights are appro­pri­ate for all data. If you have any queries, con­cerns or wish to exer­cise any of the above rights, please con­tact our Data Pro­tec­tion Offi­cer, who will sup­port you fur­ther.

You have the right to a copy of the data we hold for you, should you wish to request it there would be no charge for this ser­vice.

 

NEL LPC DETAILS

The NEL LPC rep­re­sents the per­sons pro­vid­ing phar­ma­ceu­ti­cal ser­vices in the fol­low­ing Pri­ma­ry Care Trusts locat­ed with­in the Lon­don Strate­gic Health Author­i­ty area: Bark­ing and Dagen­ham; Haver­ing; Newham; Red­bridge; Tow­er Ham­lets; and Waltham For­est.

NEL LPC is an unin­cor­po­rat­ed asso­ci­a­tion recog­nised under the Nation­al Health Ser­vice Act 2006 as rep­re­sen­ta­tive of the phar­ma­cy con­trac­tors in NE Lon­don areas and oper­ates under an agreed con­sti­tu­tion and gov­er­nance arrange­ments. As such, it is required to act inde­pen­dent­ly of all the con­trac­tors it rep­re­sents but rep­re­sent the gen­er­al body of the con­trac­tors. In com­mon with all LPCs, all the mem­bers and staff are bound by a stan­dard con­fi­den­tial­i­ty agree­ment that they are required to sign on appoint­ment.

 Address:

The North East Lon­don LPC

1 Spur­gate,

Hut­ton,

Brent­wood,

CM13 2LA

ICO Reg­is­tra­tion

Reg­is­tra­tion num­ber: ZA206705

Date reg­is­tered: 21 Sep­tem­ber 2016

Reg­is­tra­tion expires: 20 Sep­tem­ber 2018

Data con­troller: North East Lon­don LPC

Con­tact Details

Phone: 01277 849219

Email: nellpc@outlook.com

Data Pro­tec­tion Offi­cer:

Rebec­ca Dew

Phone: 01277 849219

Email: rebecca.dew@nellpc.org.uk

The North East Lon­don LPC has the right to make changes to this Pri­va­cy Pol­i­cy to main­tain com­pli­ance as reg­u­la­tions and laws are changed. Those who have con­sent­ed to us hold­ing their per­son­al data in accor­dance with this pol­i­cy will be noti­fied of any changes and hold the right to revoke their con­sent.

 

Comments are closed.