Privacy Policy

This notice explains how HS Health Group Ltd collects, uses, shares and protects your personal information.

Part 1 sets out what to expect from us in general terms, whenever we process your personal information, whether you are referred to us for an NHS-commissioned service or you book a private appointment with us directly.

Part 2 then sets out, service by service, how we handle your information for each of the NHS-commissioned and private services we provide.

Part 1 - General Information

1.1 Who We Are

HS Health Group Ltd is an independent healthcare provider registered with the Care Quality Commission (CQC Provider ID: 1-17971104436, ODS code: NKX). We provide both NHS-commissioned services and private healthcare services from our Head Office and clinic at Read House, Gilbert Drive, Boston, Lincolnshire, PE21 7TQ, and from our other clinic sites in Spalding, Grimsby, Mablethorpe and Reading/West Berkshire.

NHS-commissioned services (for example our AQP Musculoskeletal Physiotherapy Service, First Contact Physiotherapy services): HS Health Group Ltd is the controller for the clinical assessment, treatment and management decisions we make and record as part of delivering that care under our NHS contracts. Where you are referred to us by your GP practice, your GP practice remains a separate, independent controller for your wider GP record.

Private services (for example Private GP, private ENT, phlebotomy, aesthetics, vitamin B12 injections and Hepatitis B vaccination): HS Health Group Ltd is the controller for all personal information we hold about you as our private patient.

Our Data Protection Officer is Mr Sandesh Rayamajhi. You can contact him at contact@hshealthgroup.co.uk (mark the email ‘FAO: DPO’) or by post to the address above, marked ‘Data Protection Officer’.

HS Health Group Ltd is registered with the Care Quality Commission and the Information Commissioner’s Office, and is compliant with the NHS Data Security and Protection Toolkit (DSPT).

1.2 What Information We Collect

To provide you with safe, high-quality care, we only collect information that is relevant to that purpose. Depending on the service you use, this may include:

Your basic details and contact information, e.g. name, address, date of birth and next of kin;
Health and care information relevant to your assessment, treatment and ongoing care, including relevant medical history, medication and physical or mental health data;
Special category data, where relevant and necessary to your care (for example information about a disability, or, where clinically or legally relevant, information about race, ethnic origin, religion or sexual orientation);
Details of your contact with our services, such as referrals, appointments and clinic visits;
Notes, assessments and outcomes from your episode of care;
Results of investigations, such as diagnostic ultrasound scans, laboratory tests or other imaging;
Relevant information from other health professionals, relatives or those who care for you;
For private patients, information needed to manage your booking and payment for services.

We will only use your personal information for the purpose(s) for which it was obtained. We may process your information without your knowledge or consent only where this is required by law.

1.3 How We Get Your Information

We obtain your personal information in the following ways:

Directly from you, during your assessment, consultation and treatment with us;
From your GP practice, where you are referred to one of our NHS-commissioned services, either through access to your practice’s own clinical record, or through the NHS e-Referral Service (eRS) – see Part 2 for how this differs by service and referral route;
From other organisations involved in your wider care, where relevant to your treatment with us (for example a hospital, specialist, or diagnostic provider you have also seen);
Directly from you when you book a private appointment or service, or from a private medical insurer, where relevant, if your treatment is funded through insurance.

1.4 Sharing Your Information

We will not share your information with any third party for the purposes of direct marketing, and we will not transfer your information outside the UK.

We use third parties to provide elements of our service, such as SystmOne, our NHS patient records management system. We have contracts in place with these suppliers so they cannot do anything with your personal information beyond our instructions, cannot share it with any other organisation, and must hold it securely for the period we specify.

We will only ever use or pass on information about you where others involved in your care have a genuine need for it, or with your explicit consent. In limited circumstances we may be legally obliged to share information, for example under a court order, or where there is a risk of death or serious harm.

This is supported by the information-sharing principle set out in Dame Fiona Caldicott’s review, ‘Information to Share or Not to Share’, that the duty to share information can be as important as the duty to protect confidentiality, within the framework of the Caldicott principles. Full detail on how we share your record for each specific service is set out in Part 2.

1.5 Our Legal Basis for Using Your Information

NHS-commissioned services: we process your personal data under Article 6(1)(e) UK GDPR – performance of a task carried out in the public interest, being the provision of NHS-commissioned care under our contract with the relevant Integrated Care Board (ICB), NHS trust or practice – and Article 9(2)(h) UK GDPR, processing necessary for the provision of health or social care treatment and the management of health care systems.

Private services: we process your personal data under Article 6(1)(b) UK GDPR – performance of a contract with you for the service you have booked – or, where appropriate, Article 6(1)(a) explicit consent, together with Article 9(2)(h) UK GDPR (health or social care treatment provided by, or under the responsibility of, a health professional subject to a duty of confidentiality) or Article 9(2)(a) explicit consent for special category data.

Where explicit consent is required for a particular purpose, we will ask for it clearly and explain how you can withdraw it at any time. Your consent, where given, is recorded in your clinical record.

1.6 National Data Opt-Out

For NHS-commissioned services, we comply with the National Data Opt-Out programme. This means that where a data request falls within the scope of the National Data Opt-Out, and you have registered your choice with the programme, your data will not be shared by us for purposes beyond your individual care, such as planning or research.

Your individual care is not affected if you apply the National Data Opt-Out. To manage your preferences or find out more, visit www.nhs.uk/your-nhs-data-matters or call 0300 303 5678.

1.7 Laws and Guidance We Follow

We protect your privacy and confidentiality by adhering to the following laws and guidance:

UK General Data Protection Regulation (UK GDPR);
Data Protection Act 2018;
Human Rights Act 1998;
Common Law Duty of Confidentiality;
Health and Social Care Act 2012;
NHS Codes of Confidentiality and Information Security;
Information Governance: To Share or Not to Share Review (the Caldicott principles);
NHS Records Management Code of Practice 2023.

Staff only access your records where they have a legitimate purpose to do so, for example because they are directly involved in your care. All access to our clinical systems is logged for audit and monitoring purposes, and unauthorised access to your record is treated as a serious data breach, dealt with under our disciplinary procedures and, where appropriate, reported to the Information Commissioner’s Office. Our staff have a common law and contractual duty of confidentiality to protect your information.

1.8 Your Information Rights

Under UK GDPR, the rights available to you include:

Right to be informed: to be told what information is collected, how it’s used, how long it’s kept, and whether it’s shared with any third parties;
Right of rectification: to have inaccurate or incomplete information corrected;
Right to erasure (‘right to be forgotten’): to ask, in certain circumstances, for information to be erased;
Right of portability: to ask that information be transferred to another organisation, where applicable;
Right to restrict processing: to ask us to limit the way we use your information;
Right to object: to challenge certain types of processing, such as direct marketing;
Rights related to automated decision-making, including profiling: to request a review of automated processing, where this applies.
Right of access: to request a copy of the information we hold about you;

You will not have to pay a fee to exercise these rights. We aim to respond within one month; where a request is complex, we will tell you and may extend this by a further two months. Where you have given consent for a particular purpose, you have the right to withdraw it at any time.

1.9 Subject Access Requests

A Subject Access Request (SAR) allows you to request and receive a copy of the personal data we hold about you. To make a request, please email us at contact@hshealthgroup.co.uk. We handle SARs in line with Section 1.8 above; how we action a SAR for a specific service, including where your record is held on your GP practice’s own system, is set out in Part 2.

1.10 CCTV

Some of our premises use CCTV for the security of our patients, staff and visitors. Images are retained for 28 days and access is restricted to authorised staff. You can request access to CCTV footage, or ask us to restrict its processing, by emailing contact@hshealthgroup.co.uk. Blocking processing is not always possible, for example where we are subject to an official investigation.

1.11 Security

The protection of your privacy and confidentiality is given the highest priority, with all personal information collected, held and used in strict compliance with the laws listed in Section 1.7. Information is held in secure electronic records on UK-based systems, with encryption and access restricted to those who need it. Your privacy is protected by:

Managing who has access to what information (user access controls and role-based access);
Adhering to strict contractual conditions with our system suppliers;
Ensuring appropriate data sharing and processing agreements are in place with the practices and organisations we work alongside;
Audit logging of record access, as described in Section 1.7.

1.12 Complaints

If you have any concerns about how your data has been handled, please contact our Data Protection Officer (see Section 1.1) in the first instance.

You also have the right to raise a concern with the Information Commissioner’s Office (ICO): 0303 123 1113 or www.ico.org.uk, or, for NHS-commissioned services, with your local Integrated Care Board’s Patient Advice and Liaison Service (PALS).

1.13 Updates to This Notice

We may update this notice from time to time to reflect changes in our services, legislation, or contractual requirements. The current version is always available on our website at hshealthgroup.co.uk/privacy-policy, and, for NHS-commissioned services, a copy is provided to your referring practice or ICB as part of our service agreement.

Part 2 - Our Services

This part of the notice explains, service by service, how HS Health Group Ltd handles your information. Please refer to the section(s) below that relate to the service(s) you receive from us.

2.1 NHS AQP Musculoskeletal (MSK) Physiotherapy Service

Commissioned by NHS Integrated Care Board (ICB).

We only hold information relevant to your physiotherapy care and treatment, including your name, age, address and contact details; relevant medical history; details of your referral and presenting condition; and notes, assessments and outcomes from your episode of care.

Depending on how you are referred to our service, your physiotherapy notes are recorded either within your GP practice’s own clinical record, or on HS Health Group’s own clinical system for the duration of your care, with your GP practice kept informed of your treatment and outcome. In both cases, access is limited to those directly involved in your physiotherapy care.

As with all providers holding an NHS AQP contract, we are required to submit a limited monthly data return to the ICB for contract monitoring, activity reporting and payment purposes. This is restricted to your NHS number, age, and the condition for which you were referred, and is not used for any other purpose.

We process your personal data under Article 6(1)(e) and Article 9(2)(h) UK GDPR, as set out in Section 1.5.

Sharing your record

Your GP practice: your GP practice will retain access to, or be sent a discharge report, so that your wider care remains joined up.
NHS ICB: we submit the monthly data return described above, in common with other AQP contracted providers, for contract monitoring and payment purposes.
Other circumstances (e.g. safeguarding referrals, complaint investigations, Subject Access Requests): where your notes are held within your GP practice’s own system, we work with the practice to arrange release of the relevant information. Where your notes are held on our own system, we release only the physiotherapy notes held from your referral to our service, as we are the data controller for that record.

We do not share your data with any other third party without your explicit consent, except where required by law or in exceptional circumstances such as a genuine risk to life.

Retention

Medical records (adults): a minimum of 8 years following the end of your episode of care;

Medical records (children and young people): retained until the patient’s 25th birthday. As our AQP MSK service accepts referrals from age 5 upwards, this longer retention period applies to our younger patients.

This applies whether your physiotherapy notes are held within your GP practice’s system or on HS Health Group’s own system. When records are no longer required, they are securely destroyed in a manner that complies with confidentiality law and NHS guidance.

We do not use automated decision-making or profiling in the delivery of this service. All clinical decisions about your assessment and treatment are made by a qualified physiotherapist.

2.2 NHS First Contact Physiotherapy (FCP) Services

Where our clinicians work within GP practices under the NHS Additional Roles Reimbursement Scheme, for example as First Contact Physiotherapists, your consultation is normally recorded directly within your host GP practice’s own clinical record system, in the same way as a consultation with any other member of practice staff.

Your GP practice remains the controller for that record; our staff access and add to it under the same access controls, audit logging and confidentiality obligations described in Part 1, in order to provide your direct care. We process this data under Article 6(1)(e) and Article 9(2)(h) UK GDPR, in the same way as other NHS-commissioned services. Retention of these records follows your GP practice’s retention schedule, in line with the NHS Records Management Code of Practice referred to in Section 1.7.

2.3 Private GP Services

As a private patient of our Private GP service, HS Health Group Ltd is the controller for your consultation notes, examination findings, and any investigations or referrals we arrange for you.

We process your personal data under Article 6(1)(b) UK GDPR (performance of our contract with you for the consultation or service you have booked) and Article 9(2)(h) UK GDPR, as set out in Section 1.5.

With your consent, we will write to your registered NHS GP with a summary of your consultation, so that your wider NHS record remains up to date; we will only do this with your agreement, or where necessary for your immediate safety.

We retain your private medical record for a minimum of 8 years following your last consultation with us, in line with the retention principles in the NHS Records Management Code of Practice, which we apply as best practice to our private records.

2.4 Private ENT, Aesthetics, Phlebotomy, Vitamin B12 Injections and Hepatitis B Vaccination

This section applies to our other private clinical services, including private ENT consultations, phlebotomy, aesthetic treatments, vitamin B12 injections and Hepatitis B vaccination.

We only hold information relevant to the treatment you have chosen, such as your relevant medical history, consent for the specific procedure, details of the treatment provided, and, for laboratory tests, your results.

We process your personal data under Article 6(1)(b) UK GDPR (performance of our contract with you) or Article 6(1)(a) explicit consent, together with Article 9(2)(h) or Article 9(2)(a) UK GDPR for special category data, as set out in Section 1.5.

Laboratory tests (phlebotomy): your sample is processed by a contracted laboratory under a data processing agreement; results are returned to you and, with your consent, to your GP or referring clinician.

Aesthetic treatments: we may take clinical photographs as part of your treatment record; these are held as part of your confidential clinical record and are never used for marketing or publicity without your separate, specific, written consent, which you may withdraw at any time.

Vitamin B12 injections and Hepatitis B vaccination: where these are provided for occupational health purposes, we will only share confirmation of the treatment given with your employer, occupational health provider or another third party with your explicit consent.

We retain records for these services for a minimum of 8 years following your last treatment with us, in line with the retention principles set out in Section 2.5, unless a shorter period is appropriate and lawful for the specific treatment.

2.5 Paying for Private Treatment and Insurance Claims

If you pay for your own treatment, we hold the billing information necessary to process your payment and maintain our financial records, which we retain for a minimum of 6 years in line with HMRC requirements. This includes your name, contact details, invoices, and records of payments made.

For your security, we do not store your full credit/debit card details or bank account numbers in our systems. All card payments are processed securely through an encrypted payment provider.

If your treatment is funded by a private medical insurer, we will share the clinical and billing information your insurer requires to authorise and pay your claim. We will only share what is necessary for this purpose, and your insurer is separately responsible, as a controller, for how it uses your information for claims handling.

2.6 Communication Preferences

We will contact you about your care using your preferred method, telephone, SMS, email or post, as recorded in your notes. Please let us, or your GP practice where relevant, know if your contact preferences change.