Outpatients Online Consultation Service Privacy Notice

1. Introduction

By law, all organisations using personal information or data must provide a clear description of how it is used, providing related information to ensure processing is carried out lawfully and fairly. Your Trust’s main privacy notice is available on their website, or by contacting their reception.

Additional information provided below describes only the use of information when you use (for yourself, or on behalf of someone else) your Trust's online consultation service. Where there are differences depending on the Trust's location (England, Wales, Scotland or Northern Ireland), these are specifically noted below.

Please read your Trust’s main privacy notice - if you wish to use their online consultation service here, please also read information below which explains how the Trust uses the online consultation service.

1a. Online consultation service for Trust practices in England

Your (or the person you’re filling the form in for’s) Trust has engaged a specialised online consultation supplier - approved to NHS England technical standards - which has gone through stringent scrutiny, achieving all necessary requirements to provide online consultations. NHS England, on your Trust’s behalf, contracts with the supplier and acts as a joint system controller with your Trust. However, NHS England will not receive any personal information, so your Trust remains responsible for this data, ensuring that any provided data to use this service is for online consultation purposes only.

The UK GDPR and The Data Protection Act 2018 (the data protection laws) protect individuals with regard to the processing of personal data.

The organisation providing this service is eConsult Health Ltd. (eConsult), who will act as a personal data processor under the data protection laws. The registered office address is Nightingale House, 46-48 East Street, Epsom, Surrey, KT17 1HQ

NHS England enables connection to eConsult (your Trust’s specialised online consultation supplier) through their secure authentication service known as NHS login. NHS England does this on your Trust’s behalf. If you use NHS login, NHS England will also act as a data processor.

1b. Online consultation services for Trusts in Wales, Scotland or Northern Ireland

Your (or the person you’re filling the form in for’s) Trust has engaged a specialised online consultation supplier, which has gone through stringent scrutiny, achieving all necessary requirements to provide online consultations. The Trust has contracted with the supplier, so acts as a system controller. They remain responsible for personal data and will ensure that any provided data to this service is used for online consultation purposes only.

The organisation providing this service is eConsult Health Ltd (eConsult), who act as a personal data processor under the data protection laws. The registered office address is Nightingale House, 46-48 East Street, Epsom, Surrey, KT17 1HQ

2. The lawful basis for your Trust’s online consultation service

The following legal bases set out in the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018 allow your (or the person you’re filling forms in for’s) Trust to use personal information when you use their provided online consultation service (for yourself, or on someone else’s behalf):

  1. When using your (or who you’re filling the form in for’s) personal information (Personal Data):

    Article 6 (1) (e) of the GDPR, which permits your Trust practice to process necessary personal information to provide a service in the public interest

  2. When using your (or who you’re filling the form in for’s) medical data or other personal data of a sensitive nature:

    Article 9(2) (h) of the GDPR, which permits your Trust practice to process necessary health information for health treatment provision

3. Data processing purposes

Online consultations allow hospital trusts to pre-screen patients, assessing the best pathway to manage condition(s) and offer treatment options, without having to speak on the phone or make unnecessary hospital trips. Online consultations are a secure online system, which enable patients (or a nominated proxy) to ask questions, report symptoms, and inform a consultant what’s happened. Consultants can then respond by offering the right course of action according to a patient’s condition.

Because this service is online, consultants must ensure they continue to provide a confidential, high-quality service. To do so, they must properly identify you - or the person you are filling the form in for - accurately recording each request and their responses.

4. Personal information used

This service is online, so the Trust needs to ensure it’s confidential and high-quality. To do this, they need to properly identify you (or the person you’re filling in forms for), accurately noting both initial requests and their responses. If they are prevented from having this essential information, they will be unable to provide a secure, confidential service.

eConsult doesn’t collect any personal data which is not needed to deliver the service to you (or to the person you are filling in the form for).

4a. Trusts in England:

Trusts use the following information to identify and deal with each request:

Identity and contact information

Including:

  1. name
  2. gender
  3. date of birth
  4. NHS number
  5. email address
  6. telephone number
  7. postal address

If you (or the person you’re filling information in for) have NHS login details, you will already be verified, so can (if you wish) use these details on your online consultation, to save time and avoid manually entering details, or re-identifying yourself.

Special personal information categories

Health information, like:

  1. symptoms
  2. conditions
  3. medication
  4. other details held in Trust records, and/or which you provide during an online consultation.

4b. Trusts in Wales, Scotland or Northern Ireland:

Your Trust uses the following information to identify and deal with each request:

Identity and contact information

Including:

  1. name
  2. gender
  3. date of birth
  4. NHS number
  5. email address
  6. telephone number
  7. postal address

Special personal information categories

Health information, like:

  1. symptoms
  2. conditions
  3. medication
  4. other details held in Trust records, and/or which you provide during the online consultation.

Please refer to each Trust's main privacy notice for any further information.

5. Personal information sharing

5a. Your Trust controls your information

As mentioned earlier, your (or the person you’re filling forms in for’s) Trust has engaged the specialised organisation eConsult Health Limited to provide an online consultation service on their behalf - personal data will be shared with them so they can provide this service. If you are advised to seek urgent care, your information will not be shared with other health and care providers.

For Trusts in England, NHS England confirms they will only use personal information to provide health services.

For Trusts in Wales, Scotland and Northern Ireland, please refer to individual Trustmain privacy notice(s), relating to personal information use.

6. Information processing and storage

Your personal data is processed and stored within the United Kingdom.

6.a How long personal information is kept

Your (or the person you’re filling forms in for’s) Trust sets personal information retention periods and instructs eConsult Health Limited, the engaged contractor providing online consultations on their behalf, to comply with these. When information is copied to internal Trust systems, sensitive information will be deleted by eConsult. eConsult retains contact details (name, email) for up to 5 weeks, to allow communication relating to consultations, after which this is automatically deleted. If you are advised to seek urgent care elsewhere, personal information will not be transferred to us, or retained after you have read this advice.