UK Data Protection Laws:

• UK General Data Protection Regulation (UK GDPR).
• Data Protection Act 2018 (DPA 18).

Personal data: Any information relating to an identifiable individual. This might include your name, NHS number, contact details. It can also be location data or an online identifier.

Special categories of personal data are defined as: Racial or ethnic origin, politics, religious or philosophical beliefs, trade union membership, genetics, and biometrics (where used for identification) information concerning your health, sex life or sexual orientation.

Data Controller: An entity or individual that determines how and why personal data is processed.

Data Processor: An entity or individual that processes personal data on the behalf of the data controller.

Surrey Children Community Health services are provided by HCRG Care Ltd. We are the data controller for any personal information we hold about you.

HCRG Care Ltd is a limited company registered in England and Wales, registered number 05466033. Registered office: The Heath Business and Technical Park, Runcorn, Cheshire, WA7 4QX. Part of the HCRG Care Group of companies.

Please see our website for further information about the services we provide https://surreychildandfamily.co.uk/

HCRG Care Ltd is contracting Kingston and Richmond NHS Foundation Trust to provide paediatric audiology services. Details on how Kingston deliver this service and handle, process and store patient data can be found at Privacy notices :: Kingston and Richmond NHS Foundation Trust

Data Protection Officer

Deborah Tonkin
The Heath Business Park
Runcorn
Cheshire
WA7 4QX
via email: Ask.IG@hcrgcaregroup.com

If you are not happy about the way your information is handled, you have the right to lodge a complaint with a supervisory authority.  In the UK, this is the Information Commissioners Office (ICO).

The Information Commissioner’s Office
Wycliffe House
Cheshire
SK9 5AF
Helpline: 0303 123 1113 (local rate)
Email: casework@ico.org.uk
Website: www.ico.org.uk

We will collect ‘personal data’ about you such as your:

• Name
• Date of birth
• Home address and Post Code
• Age
• Gender
• NHS number
• Contact details
• GP Name and Address

This is required for verification of identity and to provide you with best possible healthcare

We may also ask you for more sensitive data, called ‘special category data’, such as your ethnicity and information about your health.

Health care professionals are required by law to maintain records about your health. Your health record may include:

• Your contact details.
• Information about the treatment or care you have received.
• Supporting information such as test results, letters, or reports.
• Relevant information from other health professionals, relatives or those who care for you.

These records help to provide you with the best possible healthcare.

In order for HCRG Care Ltd to legally process your information a ‘lawful basis’ needs to be identified.

Our legal basis for processing your personal information falls under one of the following legal bases:

• It is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
• It is necessary for a legal obligation or such as responding to a request from a coroner.
• It is necessary for the purposes of our legitimate interests and does not prejudice your rights and freedoms.
• We have your explicit consent (where none of the above bases apply).

Our legal basis for processing special category data falls under one of the following legal bases:

• The provision of health or social care.
• Social protection law for safeguarding purposes.
• Where it is necessary to protect your vital interests – when you are physically or legally incapable of providing consent.
• It is necessary for reason of public interest in area of public health.
• For archiving purposes in the public interest.
• We have your explicit consent (where none of the above bases apply).

The information we hold about you is used to:

To provide services to you such as

• Diagnosis, treatment and follow up care (including sharing relevant information with healthcare professionals directly involved in your care).
• Preventative care.
• Providing social care.

To contact you regarding your care, such as

• Appointment reminders via different methods such i.e., SMS text message, telephone, or email.
• Health related updates.
• Service-related Surveys.
• Other important information relating to your care.

We may also use, or share, your information for the following purposes:

Quality, Improvement, and Research

• Training and education of staff and general public.
• Medical research (We will always seek your consent).
• Organisational research i.e., patient surveys (We will always seek your consent).
• Preparing statistics on NHS performance and activity.
• Investigating concerns, complaints, or legal claims.
• Internal quality improvement initiatives.

NHS organisations including HCRG Care Group are required to use the Friends & Family Test (FFT) to capture feedback and submit response data to NHS England each month.

Patients can access the data which will then help them make informed choices about their future care. We collect feedback from a number of different channels, including SMS text messaging, online – via our HCRG Care Group website and paper questionnaires/feedback forms.

Invoice Validation

Invoice validation enables us to identify which ICB is responsible for paying for your treatment.

Section 251 of the NHS Act 2006 provides a statutory legal basis to process data for invoice validation purposes and uses your NHS number to validate payment. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly.

For further information please see: NHS Digital – how we use your information for invoice validation

CCTV

We have installed CCTV systems in our premises for the purposes of public and staff safety and crime and prevention and detection. In all locations, signs are displayed notifying you that CCTV is in operation and providing details of who to contact for further information.

Images captured by CCTV will be deleted 30 days after the CCTV footage was taken. However, on occasions there may need to be a need to keep images for longer, for example where a crime is being investigated.

You have the right to see CCTV images of yourself and be provided with a copy of the images. We will only disclose images to authorised bodies such as the police, who intend to use it for the purposes stated above. Please see Section 8 for details of how to request a copy of your information.

SMS Text Message Reminder Service

We provide a text messaging reminder service which automatically sends SMS messages to remind you of your appointments with us. We will not send any information which is not related to your direct care, and you have the option to opt out of this service if you wish by contacting the team you are in contact with.

Call Recordings

We may record telephone calls you make to our service for training and monitoring purposes. If this is the case, you will be informed via an automated message. The recording would include any personal information you provide to us during your call, such as your name and date of birth, as well as any information relating to your care.

Any recordings made are automatically deleted after one year. Please see Section 8 for details of how to request a copy of your information.

Safeguarding and Information Sharing:

In carrying out our safeguarding duties, we may access and share limited health information where necessary to protect a child or vulnerable person from harm.

When a child safeguarding concern is raised, our Safeguarding Nurses may create a connection within our clinical system to the child’s main carer. This allows the Safeguarding Nurse to view, on a read-only basis, relevant GP records of the main carer solely to assess and manage safeguarding risks.

We do not routinely access or process adult records of individuals who are not under our care. Only information necessary and proportionate to the safeguarding concern will be viewed or shared with other professionals involved in the Multi-Agency Partnership (MAP) safeguarding process.

This processing is carried out under:

• Article 6(1)(e) UK GDPR – performance of a task in the public interest; and
• Article 9(2)(g) UK GDPR, with Schedule 1, Part 2, Paragraph 18 of the Data Protection Act 2018 – safeguarding of children and individuals at risk.

All access is logged, restricted to trained safeguarding professionals, and conducted in accordance with the Data Protection Act 2018, NHS confidentiality principles, and the Working Together to Safeguard Children statutory guidance.

We may share your information for the purpose of providing you with care, or another lawful reason, with our partners and other recipients. This could include the prevention or detection of fraud.  We work in partnership with our commissioners and other health and care providers. These may include:

• NHS England and NHS Digital
• Integrated Care Boards (ICB’s)
• Other health service providers such as hospitals, GPs, ambulance services, urgent care, mental health, acutes, maternity units
• Local Authorities
• Regulatory Bodies
• Police
• Trusted providers that host our IT, archiving, email and texting services and surveys.
• Kingston and Richmond NHS Foundation Trust
• Child Health Information Services (CHIS)
• Community Providers
• Local Safeguarding
• HCRG Care Group corporate teams who provide our ‘back office’ support – such as IT.
• Translation and interpretation services.
• Other HCRG Care Group services (where relevant for your care).
• iPlato Healthcare Limited
• Cinnamon Digital Applications Limited
• Multi Health Systems (MHS)

For further information about the data processors we use, please see Appendix A.

Your information is stored in secure locations and only accessible on a need-to-know basis. These include:

• Electronic Health Records (EHR’s) on our clinical systems.
• Secure Clinical Areas.
• Internal encrypted servers.
• Approved storage companies.

We will keep your healthcare records in accordance with the NHS Records Management Code of Practice for Health and Social Care.

Please note that due to a legal hold on the destruction of records by NHS England, we are currently not destroying records that have reached their retention period. This is to support ongoing statutory public inquiries including:

• UK Covid 19 Inquiry
• Infected Blood Public Inquiry
• Historic Child Sexual Abuse Inquiry

At HCRG Care Group, we take the security and privacy of your information extremely seriously.

We recognise that you trust us with sensitive and personal data, and we are fully committed to keeping it protected at all times.

We follow NHS and UK data protection standards to ensure your information is stored, shared, and managed securely and responsibly.

Here’s how we protect your data:

• Strong encryption: All data is protected with industry-standard encryption when stored and when sent, preventing unauthorised access or misuse.
• Strict access controls: Only staff who need access to your information to provide care or manage services can view it. We use secure logins, multi-factor authentication (MFA), and role-based access permissions.
• Secure infrastructure: Our systems are hosted in trusted, NHS-approved environments that hold ISO 27001 certification as a minimum and are supported by partners who maintain additional internationally recognised security standards. Firewalls, continuous monitoring, and round-the-clock security operations protect these environments.
• Regular testing and assurance: We conduct ongoing security testing, vulnerability assessments, and independent audits to make sure our systems remain robust and resilient.
• Incident management: In the unlikely event of a security incident, we have a clear and well-practised process for responding quickly, containing the issue, and notifying the appropriate authorities in line with NHS and legal requirements.
• NHS compliance: HCRG Care Group completes the NHS Data Security and Protection Toolkit (DSPT) every year and aligns its controls with NHS Digital and relevant other stakeholders.

Your trust, privacy, and safety are at the heart of everything we do, and we are committed to maintaining the highest standards of information security across all our services.

UK data protection laws provide you with the following rights:

The right to be informed

As a data controller, we are obliged to provide understandable and transparent information about the way we process your data (this is provided by our privacy policy)

The right of access

You are entitled to request a copy of the personal data we hold about you.

The right to rectification

You are entitled to request changes to information if it is inaccurate or incomplete.

The right to erasure

Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that we delete the personal data.

The right to restrict processing

Under certain circumstances, you may ask us to stop processing your personal data. We will still hold the data but will not process it any further.

The right to data portability

Subject to certain conditions, you may request a copy of your personal data to be transferred to another organisation.

The right to object to processing

You have the right to object to our processing of your data where:

• Processing is based on legitimate interest.
• Processing involves automated decision-making and profiling.
• Processing would be for a purpose beyond your care and treatment, e.g., direct marketing and scientific or historic research.

You can opt-out to the sharing of this information under the National Data Opt-Out. Further information can be found on the following website: https://digital.nhs.uk/national-data-opt-out

Please note that the above rights may not apply in all circumstances, but we will respond within a month of any requests. If you have any questions or concerns about the information we hold on you, please contact our Data Protection Officer.

How to request a copy of your information

Please email the Access to Records Team accesstorecordsteam@hcrgcaregroup.com or write to us at The Heath Business Park, Runcorn, Cheshire, WA7 4QX.

Keep us updated of any changes

Please let us know if you change your address or contact details etc. so that we can keep your information accurate and up to date.

In the event of the contract with the service and HCRG Care Group coming to an end, all relevant documentation and records will be transferred to the new provider (s).

The transfer of records will be conducted in accordance with the current UK Data Protection Law.

We will update this privacy notice from time to time to reflect any changes to our ways of working.

Date privacy notice last updated: February 2026.

Riviam – Riviam is a single point of access (SPoA) portal, ensuring seamless access to community-based healthcare services. The system integrates with clinical systems and supports new care pathways, allowing health and social care providers to collaborate effectively and improve care. The system is provided by Riviam Digital Care Limited.

Cinnamon – Cinnamon is an online e-consent portal for schools, parents/carers and HCRG clinical staff to manage the national immunisation programme. Cinnamon collects Height, Weight and BMI data in addition to the general data already contained in the privacy notice. Cinnamon is provided by Cinnamon Digital Applications Ltd

SystmOne – SystmOne is an electronic patient record (EPR) system that facilitates secure, real-time access to patient records, enhancing clinical efficiency and improving patient outcomes. SystmOne is provided by The Phoenix Partnership Ltd (TPP)

EMIS Web – EMIS is the core community system for electronical records, where clinical staff can work from and has a storage base. The system is supplied by EMIS Group Ltd, Egton Medical Information Systems Limited, Optum Health Solutions (Uk) Limited.

Mobile Rocket- Mobile Rocket is a digital tool that enhances self-care, service navigation and engagement with local teams. It provides self-help information oh how to interact with the service.

Digital Conners4 – Digital Conners4 is a digital scoring system used as part of a young person’s ADHD diagnostic assessment. The system is provided through a company called Multi Health Systems (MHS).  MHS process the assessment outside of the UK and EEA and we have undertaken due diligence with the supplier to ensure that appropriate safeguards are in place under UK GDPR. A Data Processing Agreement and an International Data Transfer Agreement are in place to support this.