Advanced Care Planning Navigation Service

Privacy and Data Protection Policy

1. Purpose and commitment

Our service is committed to protecting the privacy, confidentiality and personal information of everyone who contacts or works with us. We handle sensitive information about health, family circumstances, advance decisions to refuse treatment (ADRTs), lasting powers of attorney (LPAs), mental capacity and end-of-life preferences. We will collect only what is necessary, explain how it is used, keep it secure and respect individuals’ information rights.

2. Scope and accountability

This policy applies to all founders, staff, contractors, volunteers and service providers processing personal data on behalf of the organisation, across telephone, video, email, website enquiries, education, outreach and written records. The organisation acts as data controller where it determines the purposes and means of processing. External providers may be processors or independent controllers depending on the arrangement. The Data Protection Lead coordinates compliance, but every team member remains responsible for safe handling.

3. Legal and professional framework

We comply with the UK General Data Protection Regulation (UK GDPR), Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 (PECR) where applicable, and the common-law duty of confidentiality. Registered nurses also follow the NMC Code and professional record-keeping standards. Confidentiality is distinct from data protection: a lawful basis to process information does not automatically justify disclosing confidential clinical information.

4. Information we may collect

Depending on the service requested, we may collect names, contact details, preferred communication methods, enquiry and appointment records, billing information, correspondence, and information about health, disability, care needs, treatment preferences, attorneys, relatives and professionals. We may receive information about third parties; staff should minimise unnecessary third-party details. Video or audio recordings are optional and require a separately documented purpose, lawful basis, retention period and appropriate permissions. We do not routinely request identity documents or full medical records unless necessary for an agreed service.

5. Purposes and lawful bases

We use information to respond to enquiries, provide agreed specialist nurse-led navigation and education, prepare or review documents at the person’s request, communicate with nominated professionals where authorised, manage appointments and payments, maintain safe records, respond to complaints and safeguarding concerns, and meet legal and regulatory obligations. A UK GDPR Article 6 lawful basis must be identified for each purpose, such as contract, legal obligation, legitimate interests, vital interests or consent where genuinely appropriate. For health and other special-category data, an additional Article 9 condition is required; explicit consent may be suitable for certain optional services, while other conditions depend on the specific processing and statutory requirements. Staff must not assume that clinical qualifications alone establish an Article 9 condition. The organisation will maintain a documented lawful-basis and special-category-condition register before processing begins.

6. Transparency and consent

At or before collection, people will be given an accessible privacy notice explaining the controller’s identity, purposes, lawful bases, recipients, retention, rights and contact routes. Consent for a consultation or to share information with a GP is not necessarily the same as UK GDPR consent for processing. Where consent is the chosen lawful basis, it must be freely given, specific, informed, unambiguous and withdrawable; explicit consent must be recorded for relevant special-category processing. Withdrawal does not retrospectively invalidate earlier lawful processing.

7. Confidentiality and information sharing

Information is shared on a need-to-know basis and only where a valid legal basis and confidentiality justification exist. With appropriate authority, we may share relevant documents or summaries with a GP, care team, attorney or other named recipient, using secure channels and verifying identities and contact details. An attorney’s authority must be checked against the type, registration, scope and applicability of the LPA; being a relative does not itself confer authority. We will not promise absolute confidentiality where disclosure is necessary and lawful to protect someone from serious harm, respond to safeguarding concerns or comply with a legal requirement. Decisions to share without consent must be proportionate, documented and escalated where practicable.

8. Safeguarding, capacity and complex cases

Where concerns arise about coercion, abuse, neglect, exploitation or risk of serious harm, staff follow the Safeguarding Adults and Children Policy and record the rationale for any information sharing. Mental capacity is decision-specific and time-specific; a person’s diagnosis, disability or unwise decision does not by itself demonstrate lack of capacity. Where authority or capacity is uncertain, seek appropriate clinical, safeguarding or legal advice rather than disclosing information prematurely. An ADRT or advance statement should not be routinely circulated without the person’s knowledge or another lawful justification.

9. Security and access controls

Use approved, access-controlled systems, strong unique passwords and multi-factor authentication wherever supported. Devices must be encrypted, updated and protected against unauthorised access. Do not store service information in personal email, messaging apps or unapproved cloud accounts. Apply role-based access, secure file transfer, screen privacy and appropriate secure disposal. Work-from-home and outreach arrangements must protect against overheard conversations and unattended records. Access permissions are reviewed when roles change or people leave.

10. Records, retention and deletion

Records must be accurate, relevant, dated and proportionate, with clear distinction between facts, reported information and professional observations. The organisation will approve a documented retention schedule by record category (enquiries, consultation notes, drafted documents, billing, complaints, safeguarding, recordings and employee records), including legal, professional and insurance considerations. No universal retention period is assumed. At the end of the approved period, records will be securely deleted or anonymised, unless a documented legal hold or other justified exception applies. Backups and processor deletion arrangements must also be addressed.

11. Individual information rights

Subject to applicable exemptions and conditions, individuals have rights to be informed, access their data, request rectification or erasure, restrict or object to processing, and data portability where applicable. They may also have rights concerning solely automated decisions. Requests should be promptly forwarded to the Data Protection Lead, identity verified proportionately, and responded to without undue delay, normally within one month; lawful extensions must be communicated. A request is not to be refused merely because it is informal or verbal.

12. Personal data breaches and incidents

Any suspected loss, misdirected email, unauthorised disclosure, cyber incident or inappropriate access must be reported immediately to the Data Protection Lead. Staff should preserve evidence and take safe containment steps without concealing or deleting records. The lead will assess risk to individuals, document the breach and determine whether notification to the Information Commissioner’s Office (ICO) is required within 72 hours of awareness where feasible. Where a breach is likely to result in a high risk to individuals, affected people must also be informed without undue delay unless a lawful exception applies.

13. Suppliers, transfers and digital services

Before using booking, video, payment, cloud storage, email marketing, website analytics or document-management services, the organisation will assess security, contractual roles and any international data transfers. UK GDPR Article 28 processor contracts are required where a supplier acts as processor. Restricted transfers outside the UK require an applicable adequacy regulation or appropriate safeguards and any required assessment. Non-essential cookies or similar technologies require appropriate PECR consent; the website must provide a separate cookie notice and controls where relevant.

14. Marketing, research and training

We will not use sensitive enquiry information for marketing without an appropriate legal basis and compliance with PECR. Service improvement, audit, teaching and case discussions should use anonymised or minimised information wherever possible. Identifiable case studies, testimonials, photographs and recordings require a clear documented justification and appropriate permission. People must be able to opt out of direct marketing easily.

15. Training, assurance and governance

All personnel receive proportionate induction and refresher training covering confidentiality, phishing, secure records, safeguarding disclosures, information rights and breach reporting. The organisation will maintain a record of processing activities where required, review privacy risks, complete data protection impact assessments for high-risk processing and audit access and retention practices. Significant incidents, complaints and recurring risks will be reviewed by the service leadership and escalated as appropriate.

16. Complaints and contact details

Privacy concerns or requests should be directed to the designated Data Protection Lead by email at acpnavigationservice@gmail.com or through our contact page. Individuals may also complain to the Information Commissioner’s Office at ico.org.uk. This policy is an internal governance document; a clear public-facing privacy notice must separately provide all information required by Articles 13 and 14 UK GDPR.

17. Policy owner and review

  • Policy owner: Sarah White & Sarah Malik
  • Approved by: Sarah White & Sarah Malik
  • Data controller: Advanced Care Planning Navigation Service (Sarah White & Sarah Malik)
  • Information Commissioner’s Office (ICO) reference: CSN5559666
  • Contact: acpnavigationservice@gmail.com
  • Version: 1.0
  • Next scheduled review: 09/2027
  • Earlier review triggers: Material changes to legislation, service delivery, suppliers, incidents or regulator guidance.