This privacy notice relates to Public Health Dorset, including our LiveWell Dorset service.

To do our job we need information about people’s health and wellbeing. This comes from lots of different places. Some is data we collect ourselves, some is data collected through the services that we pay for, and some data comes from our partners in other parts of the local authorities, the NHS, and other national bodies.

We use this information for delivering our LiveWell service, measuring health and care needs of the population, for planning, evaluating and monitoring health, and for protecting and improving public health.

In bringing together this information we have one aim – to protect and improve the health of people in Dorset.

Much of the information we use is in aggregate form, in other words, it is made up of statistics that relate to groups of people rather than to individuals. For example, we use aggregate data to produce statistics to help the public sector in Dorset identify local priorities to improve and protect the communities we serve. Using data that is already based on groups means this information is anonymous, which means it does not identify individuals within these groups.

We sometimes get data that is not already grouped, but where all identifying data (including name, NHS number, date of birth, date of death, address, and postcode) has been removed so that we can group the data ourselves. For example, we get age in years instead of date of birth, or a code that covers a larger geographical areas instead of address or postcode. The data may have a ‘pseudonym’ (or coded reference) attached to it that links it to a particular individual without that individual being identified. This would allow us to understand, for example, how many people had one, two, three or more admissions to hospital.

Sometimes we collect personal data; where we do so we will make it clear when we collect this personal information, why we need this and what we intend to do with it. An example of this is our LiveWell service where we collect personal information to be able to provide health improvement services to the service user.  With consent from the service user, this information is collected on registering with the service and if service users want to take part in a service or need other support then LiveWell may need to use and share personal information with other organisations involved in their care.

When we do need to use personal data we try to remove as much of the detail as possible that could identify an individual. For example, we may use the NHS number but replace date of birth with age in years and addresses with codes that cover larger geographical areas.

Your personal information will be used and processed lawfully. The lawful basis for processing your personal data will take place under the General Data Protection Regulation specific purpose of Legitimate Interests (6.1.c), Public Task (6.1.e) or Vital Interests (6.1.d).

Some of the personal information we process is special category data. Special category data is personal data which the General Data Protection Regulation (GDPR) says is more sensitive, and so needs more protection. We process this under 9.2.i of the GDPR. Processing of special category data is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care.

The legislation that allows us to hold and use your information includes the Data Protection Act 2018, Health & Social Care Act 2012, the Care Act 2014, the NHS Act 2006, and the Children Act 2004. We also take into account the Caldicott Principles.

We take our legal and professional obligations to protect the confidentiality of personal information very seriously.

As well as limiting the amount of personal information we hold, we make sure that our staff can only see information that is essential to their job. We take appropriate security measures to prevent the personal data we hold being accidentally or deliberately compromised. These measures are backed up by reliable policies and procedures and well-trained staff. We ensure that we permanently delete any information that we no longer need to hold.

Much of the information we produce is in the form of anonymous statistics published through our website and in reports and papers to the Joint Public Health Board, the two Health and Wellbeing Boards and other partners.

We never publish information that could be used to directly identify an individual. We only share information about individuals when the direct consent of patients has been obtained or when there is a clear basis in the law for that information to be shared. The Dorset Information Sharing Charter provides us with a robust foundation for the lawful, secure and confidential sharing of personal information with partner organisations that we work with. It enables us to meet our statutory obligations and share information safely to enable integrated service provision across the county and better outcomes for its residents.

When someone visits our website they do not need to give us any personal information. We do use a third party service to collect standard internet log information and details of visitor behaviour patterns. We use this to find out things such as the number of visitors to the various parts of the site to help us in developing and improving our site. This information is only processed in a way which does not identify anyone. We do not make, and do not allow this service to make any attempt to find out the identities of those visiting our website.

In some parts of the website we may give you the option to provide views or comments, or to sign up for particular features of the website. Where this happens we may ask for contact details and personal information so that we can act on your comments or requests accordingly. We may contact you if we need to understand more about your comment or request using the contact details you provide.

If we do want to use personal information collected on the website in any other way we will make this clear as we collect it so that you can choose whether to give us this information or not. We may process this information so that it does not identify anyone, and then use it to help us and people we work with to plan how we develop and improve what we all do.

• The right to be informed – you have the right to be given information about how your data is being processed, who it will be shared with, for what purpose and how long it will be retained for.
• The right of access – you have the right to see or have a copy of your personal data.
• The right to rectification – you have the right to request that your personal data is rectified if it is inaccurate or incomplete.
• The right to erasure – you have the right to request that your personal data is removed to prevent processing in certain circumstances.
• The right to restrict processing – you have the right to block or stop processing of your personal data.
• The right to data portability – you have the right, when requested, to be provided with your personal data in a structured, commonly used and machine readable format.
• The right to object – you have the right to object to processing of your personal data in relation to legitimate interests, direct marketing (e.g. profiling) or for scientific/historical research and statistics.
• Rights in relation to automated decision making and profiling – you have the right to not be subject to a decision based solely on automated processing, including profiling, which significantly affects you.

This privacy notice was written to be clear and concise. It does not provide exhaustive detail of all aspects of Public Health Dorset’s collection and use of information, including personal information. However, we are happy to provide any additional information or explanation needed. Any requests for this should be sent to the address below.

You may also ask to find out if we hold any personal information by making a ‘subject access request’ under the Data Protection Act 1998 using the contact details below. If you agree, we will try to deal with your request informally, for example by providing you with the specific information you need over the telephone.

If you require independent advice please visit the website of the Information Commissioner’s Office.