NEMS Community Benefit Services (NEMS) Data Protection Privacy Notice 

Introduction 

This Privacy Notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you from other organisations. 
 
This privacy notice applies to personal information processed by or on behalf of NEMS. 
 
This Notice explains: 
 
Who we are and how we use your information 
Information about our Data Protection Officer (DPO) 
What kinds of personal information about you we hold and use (process) 
The legal grounds for our processing of your personal information (including when we share it with others) 
What you should do if your personal information changes 
How long we retain your personal information 
Your rights under data protection laws 
 
The UK General Data Protection Regulation (UKGDPR) and the Data Protection Act 2018 (DPA 2018) became law on 25th May 2018, and 1st January 2021 when the UK exited the EU. 
 
For the purpose of applicable data protection legislation ((including but not limited to the General Data Protection Regulation (Regulation (UK) 2016/679) (the "UKGDPR"), and the Data Protection Act 2018) NEMS is responsible for your personal data. 
 
This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights. 

How we use your information and the law 

NEMS acts as the ‘Controller’ of the personal data that you provide to us. 
 
We may collect and process the following types of personal information: 
 
Name 
Email address 
Phone number 
Address (Work or Home) 
Post Code 
Internet Protocol (IP) address 
Account Name(s), Account Number, Sort Code 
Signature 
Identification Number (e.g., Pharmacy Registration) 
Job Role 
Employing Organisation 
Education or Training Provider 
Course of Study (including dates) 
 
We may also collect sensitive confidential data known as “special category data”, in the form of religious beliefs, ethnicity, age, gender and sexual orientation. 

Why do we need your information? 

Most of the personal data we process is provided to us directly by you, and is used for one or more of the following reasons: 
 
Coordinating, processing and managing funding requests for Apprenticeship Levy, Spirometry Licenses, Continued Professional Development (CPD) and Workforce Development Funds (WDF). 
Facilitating the transfer of Apprenticeship Levy, Spirometry License Codes, CPD and Workforce Development Funding to successful applicants. 
Monitoring engagement with NATH services (e.g., funding requests, attendance at events), and other learning activity (e.g., student placements, apprenticeships) across Nottingham and Nottinghamshire. 
Undertaking trend analysis to understand differences in engagement with NATH services between groups (e.g., professional), including differences based on protected characteristics in order to identify current and future needs, and possible inequalities including problems accessing services and information. 
To facilitate payments to contractors and associates who provide services for NATH. 
To maintain evidence of contractual agreements, terms and responsibilities between NATH and other parties for legal purposes. 
To contact individuals who express an interest in delivering training or events; or receiving services from NATH in order to: 
a) offer support and advice with finding appropriate course information, training providers, development opportunities, securing funding; and/or, 
b) confirm the outcome or status of applications and funding requests. 
To maintain a record of all expressions of interest in services provided by NATH including learning activity in primary and social care across Nottingham and Nottinghamshire for the purpose of preparing accurate workforce or other statistical returns, to the NATH Board, Nottingham and Nottinghamshire ICB, NHS England and other statutory bodies. 
To contact individuals for feedback on their experience of training events and funding processes, and/or request participation in further evaluation activity. 
To facilitate course bookings and attendance at training events hosted by NATH. 
To confirm attendance of the data subject in training or events hosted by NATH. 
To gauge interest from users of services in writing a testimonial or case study which may be used to support a business case(s) for future funding. 
To maintain an accurate and up to date Register of NMC SSSA trained Supervisors and Assessors which can be checked to ensure organisations have a suitably trained supervisor or assessor in place when facilitating placements. 
To contact individuals for further information in relation to incomplete training activities, funding request forms or other applications. 
To issue certification to those who successfully complete training (e.g., NMC SSSA Supervisor and Assessor) and/or attend events hosted by NATH. 
Helping to facilitate and manage student placements in primary or social care. 
As part of the annual Training Needs Analysis (TNA) Survey exploring the learning priorities, development needs and barriers to learning of the primary care workforce, results from the survey may be used to; 
Assist NATH in identifying training requirements of the primary care workforce. 
Inform the design and development of educational and training packages to meet local needs. 
Establish training priorities of different groups of staff working in Primary Care across Nottingham and Nottinghamshire. 
Assist in planning Continuing Professional Development (CPD) training events open to the whole workforce. 
Assist in allocating CPD and WDF across Nottingham and Nottinghamshire. 
Signpost individuals to relevant training from other providers (if requested). 
Report training needs based on the Place-Based Partnership (PBP) localities and Primary Care Networks (PCNs) to support any local discussions about workforce needs. 
Share a summary of the feedback with PLT planning groups and partner organisations to foster inclusive partnerships and collaboration. 
To initiate contact with colleagues, or respond to general enquiries for one or more of the following purposes: 
a) to make professional connections and/or increase engagement with NATH by inviting colleagues to join peer support networks or meetings. 
b) To send updates about services provided by NATH. 
c) To exchange best practice knowledge with networks. 
d) To provide advice and/or support with training, education, learning and development opportunities. 
e) To disseminate surveys and/or other informational material (e.g., TNA survey to ambassadors who can help promote the survey among colleagues). 
f) To address comments, compliments or complaints about NATH services. 
g) To maintain up to date records of learning activity in Nottinghamshire. 
h) To connect mentors and mentees who express an interest in mentorship. 
To create and maintain a database(s) of professional contacts and peer support networks for operational and professional purposes. 
To coordinate events or facilitate participation in events and interventions offered by NATH, as requested by the client. 
For use in communications (e.g., Newsletters) and/or other promotional material created by NATH, only where the data subject has provided their consent to do so. 

How do we lawfully use your data? 

Under the General Data Protection Regulation we will be lawfully using your information in accordance with: - 
 
Article 6, (a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; 
 
Article 9, (a) the data subject has given explicit consent to the processing of those personal data for one or more specified purposes, except where Union or Member State law provide that the prohibition referred to in paragraph 1 may not be lifted by the data subject; 
 
This Privacy Notice only applies to the personal data of individuals using services provided by the Nottinghamshire Alliance Training Hub. 
 
We will never pass on your personal information to anyone else who does not need it, or has no right to it, unless you give us consent to do so. 

Legal justification for collecting and using your information 

The law says we need a legal basis to handle your personal information. Under the UK GDPR, the lawful basis we rely on for processing your personal data is: 
 
(a) Your consent. 
 
Please note that you have the right to withdraw consent at any time if you no longer wish to receive services from us. 

How do we maintain the confidentiality of your records? 

We are committed to protecting your privacy and will only use information collected lawfully in accordance with: 
 
Data Protection Act 2018 
UK GDPR 2021 
Human Rights Act 1998 
Common Law Duty of Confidentiality 
Health and Social Care Act 2012 
NHS Codes of Confidentiality, Information Security and Records Management 
Information: To Share or Not to Share Review 
 
Every member of staff who works for an organisation providing services to the NHS has a legal obligation to keep information about you confidential. 
 
We will not disclose your information to any third party without your permission. 
 
NEMS’ policy is to respect the privacy and confidentiality of your personal data and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data will be protected. 
 
In certain circumstances, you may have the right to withdraw your consent to the processing of data. Please contact the Data Protection Officer (DPO) in writing if you wish to withdraw your consent. 
 
Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individuals cannot be identified. 
 
At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place. This information is not shared with third parties and you can unsubscribe at any time via phone, email or by informing NEMS CBS’ Quality Governance & IG Lead as below. 

Where do we store your information electronically? 

All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance, this information may be located on servers within the European Union. 
 
No third parties have access to your personal data unless the law allows them to do so, and appropriate safeguards have been put in place. We have a Data Protection regime in place to oversee the effective and secure processing of your personal and or special category (sensitive, confidential) data. 

Who are our partner organisations? 

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations; 
 
Integrated Care Boards (ICB) 
NHS Trusts / Foundation Trusts 
GP practices 
NHS Commissioning Support Units 
Independent Contractors such as dentists, opticians, pharmacists 
Private Sector Providers 
Voluntary Sector Providers 
Ambulance Trusts 
Social Care Services 
NHS England (NHSE) and NHS Digital (NHSD) 
Local Authorities 
Education Services 
Training providers 
 
You will be informed who your data will be shared with and in some cases, asked for consent for this to happen, when this is required. 

How long will we store your information? 

We will retain your personal data for up to five years, in order to provide you with information, advice and support where requested, and for the purpose of reporting Training Hub activity and performance to NHS England. If we do wish to hold your data for longer than 5 years, we will request your permission to do so. 
Otherwise, any personal data you have provided will be deleted. 

How can you access, amend or move the personal data that you have given to us? 

Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise. 
 
Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply. 
 
Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example for a research project), you may withdraw your consent at any time. 
 
Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to "erase" your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data are collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so. 
 
Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. 

Access to your personal information 

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information NEMS holds about you and to have it amended should it be inaccurate. To request this, you need to do the following: 
 
Your request should be made to Nemsl.governance@nhs.net or 0115 883 6294. 
There is no charge to have a copy of the information held about you 
We are required to respond to you within one month 
You will need to give adequate information (e.g., full name, details of your request) so that your identity can be verified, and your records located. 

What should you do if your personal information changes? 

You have the right to ask us to rectify any personal information that you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. You can do this by contacting NATH on alliance.hub1@nhs.net or 0115 883 6294. 
 
Once we are informed that any personal data processed by us is no longer accurate, we will update the information. 

Our website 

The only website this Privacy Notice applies to is the Nottinghamshire Alliance Training Hub (NATH) website. If you use a link to any other website from the NATH website, then you will need to read their respective Privacy Notice. We take no responsibility (legal or otherwise) for the content of other websites. 
The NATH website uses cookies. For more information on which cookies we use and how we use them, please see our Cookies Policy. 

Objections / complaints 

Should you have any concerns about how your information is managed, please contact us using the details below. 
 
Postal: Quality Governance Team 
NEMS Community Benefit Services Ltd 
NEMS Platform One 
Station Street 
Nottingham 
NG2 3AJ 
Telephone: 0115 883 6294 
 
Data Protection Officer: 
 
The NEMS Data Protection Officer is Paul Couldrey of PCDC. Any queries in regard to Data Protection issues should be addressed to him at: - 
 
 
Postal: Paul Couldrey 
PCDC 
NBV Enterprise Centre 
6 David Lane 
Nottingham 
NG6 0JU 
 
NEMS CBS Quality Governance & IG Lead: 
 
Chantelle Heanue 
 
NEMS Community Benefit Services Ltd 
NEMS Platform One 
Station Street 
Nottingham 
NG2 3AJ 
 
If you are still unhappy following a review by NEMS, you have a right to lodge a complaint with a supervisory authority: You have a right to complain to the UK Supervisory Authority as below. 
 
Information Commissioner: 
 
Wycliffe house 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF 
Tel: 01625 545745 
 
If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have any concerns about how your data is shared, then please contact the NEMS DPO. 
 
If you would like to know more about your rights in respect of the personal data we hold about you, please contact the DPO as above. 

Changes 

It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Data Protection Officer.