Privacy Notices

The Data Protection Act 2018 and UK General Data Protection Regulation (GDPR) gives individuals rights about how their personal data is used by organisations. One of the rights is the right to be informed, which means we have to give you information about the way in which we use, share and store your personal information.

The information below relates to the patients and services users.

Other bespoke privacy notices can be found at the bottom of this page.

Who we are and what do we do

The Coventry and Warwickshire Partnership NHS Trust (the Trust) is part of the NHS and provides the following services across Coventry and Warwickshire, Solihull, Hereford and Worcestershire:-

  • Inpatient mental health services
  • Community mental health services
  • Inpatient learning disability services
  • Community learning disability services
  • Inpatient and Community eating disorder services
  • Respite and residential care services
  • Community physical health services e.g. district nursing etc.

The Trust is registered with the Information Commissioner’s Office as a data controller. The Trust’s registration number is: Z9641870.

Trust’s Contact Details

Coventry and Warwickshire Partnership NHS Trust Wayside House

Wilsons Lane



Tel: 024 7636 2100

Data Protection Officer

Data Protection Officer: Hayley Gidman

Tel: 01782 916875


What information we collect about you

The Trust will collect personal and sensitive information about you. This information is necessary in order to provide direct health care to you.

Personal information will include:-

  • Your name
  • Your address and post code
  • Your telephone number
  • Your NHS number
  • Your marital status
  • Your employment status
  • Your preferred contact details e.g. relatives, friends and carers contact details
  • Your opinions and decisions about your contact with our services.

Sensitive or special categories of data will include:-

  • Your racial or ethnic origin
  • Your religious or other beliefs (if appropriate)
  • Your sexual orientation
  • Your specific health data
  • Records of your contacts with our services
  • Diagnosis and/or the problems that you are experiencing with your health
  • Personal appearance and behaviour (relevant to your clinical presentation)
  • Results of test results, such as X rays/Laboratory results or other investigations or assessments
  • Any previous information about care and treatment that you have received
  • Relevant information from other health and/or social care organisations
  • Domestic and social circumstances directly relevant to your care and treatment
  • Professional opinions on your current health status and future health care needs
  • Information about risks that may affect you or where you may pose a risk to others.

We may also collect and store information about previous convictions where this is relevant to the care and treatment we are providing to you and/or where this is relevant to the health and safety of our staff and other patients.

How we collect information about you

Most of the information held about you in the Trust has either come directly from you or is as a result of the interaction between you and the health professionals and administrative staff with whom you have contact. We may also receive information about you from:-

  • GP
  • Other NHS Trusts such as Hospitals
  • Dentists
  • Opticians
  • Podiatrists
  • Local Authorities
  • Police
  • Relatives, carers and friends.

How we use the information about you

The Trust collects information from you in order to be able to provide you with direct health and social care and treatment. The Trust collects information from you to be able to:-

  • Confirm your identity
  • Contact you by post, email and telephone
  • Assess your health/social care needs
  • Deliver appropriate health/social care to you as our patient
  • Prevent harm or injury to you or another person
  • Ensure that up-to-date and relevant information is available to all staff caring and treating you
  • Ensure that the care and treatment that your receive is safe and effective
  • Review care and treatment to ensure that it is of the highest standard
  • Ensure that we meet our legal obligations to provide health care in certain circumstances
  • Review your care and treatment in the event of an untoward incident
  • Manage and investigate complaints made by you about your care and treatment
  • Respond to legal or other claims about your care and treatment
  • Meet various legal requirements including to provide information on notifiable diseases
  • Provide information to other NHS organisations as required by law or other directions
  • Ensure payments are made for Out of area care or other specific care packages
  • Prevent and detect fraud or crime
  • Provide statistical analysis of the use of services and so that we can plan future services.

National Data Opt-Out

The Trust is compliant with the National Data Opt-out policy.

How the NHS and care services use your information

The Trust is one of many organisations working in the health and care system to improve care for patients and public.

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

  • Improving the quality and standards of care provided
  • Research into the development of new treatments
  • Preventing illness and diseases
  • Monitoring safety
  • Planning services

This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit On this web page you will:

  • See what is meant by confidential patient information
  • Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
  • Find out more about the benefits of sharing data
  • Understand more about who uses the data
  • Find out how your data is protected
  • Be able to access the system to view, set or change your opt-out setting
  • Find the contact telephone number if you want to know any more or to set/change your opt-out by phone
  • See the situations where the opt-out will not apply.

You can also find out more about how patient information is used at: (which covers health and care research); and (which covers how and why patient information is used, the safeguards and how decisions are made)

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

The lawful basis for us using your information

The lawful basis for using your information is a ‘public task’. It is necessary for the Trust to use your information in order to provide you with direct health care.

  • Patient ‘personal data’ is processed under Article 6 (1) (e) which states that “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.
  • Patient ‘sensitive data’ is processed under Article 9 (2) (h) which states that “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or member State Law”.

This lawful basis means that the individual’s rights to ‘erasure’ and ‘portability’ do not apply.

Who we share your information with

Sharing for Direct Care

As a patient of the Trust, your data will be shared within the health care team providing you direct health care; that could be doctors, nurses and other allied health professionals providing you with care and treatment. Authorised non health professionals will also have access to information about you as appropriate in order to manage your health records, write to invite you to appointments and generally manage your contacts with the Trust. All staff are bound by a contractual duty of confidentiality and are also subject to data protection legislation. Information will also be shared with your General Practitioner (GP) to ensure that there is one continuous record of all health care that you have received from any NHS provide or other health provider.

The Trust will also share relevant information with other NHS Trusts such as a Hospital Trust where you are being referred for specialist or hospital based treatment.

Integrated Care Record

The Trust works with other health and social care organisations to share information that will form part of your Integrated Care Record. The Integrated Care Record allows health and care professionals involved in your care to view your records to help them understand your needs and make the best decisions with you, and for you. Information we hold about you will be available, to read only, to other health and care professionals in Coventry and Warwickshire, Birmingham and Solihull, and Herefordshire and Worcestershire when they are involved in your health or social care.

For more information on how your data is used on the Integrated Care Record and how to exercise your rights please see the full Privacy Notice or copy and paste this link

Section 75 Partnership Agreement

As a result of Section 75 of the National Health Services Act 2006, in some of our services we work in formal partnership working arrangements with other registered professionals, such as social workers. These are mainly within are community mental health teams where we have specialist registered social workers who are employed as part of the Community Teams. This is from the appropriate local authorities, such as Coventry City Council and Warwickshire County Council.

Thus if you are a patient of a community mental health team your health records will have entries and information recorded within them by the whole care team including the registered social workers. These joint records will be managed in line with the current requirements as to security, confidentiality and how long we keep these records.

Information shared with you consent

Where the Trust receives a request for information about you including information from your health records, if this is not connected with your direct health/social care, the Trust would ask for your explicit i.e. written consent. For example if a Solicitor or other external organisation such as an Insurance company asked for copies of your health records, the Trust would only provide this information about you when you have consented in writing and told us what you are happy to share.

Information Shared in your ‘best interests’

If you lack the capacity to act on your own behalf, the Trust will, on a case by case basis, review what is in your best interests and may share relevant information with your appointed representatives, such as:-

  • A person with Powers of Attorney
  • A Court appointed Deputy
  • Family members who you have agreed can be involved in your care
  • Court of Protection
  • Independent Mental Capacity Advocates (IMCAs)

Information shared to protect ‘vital interests’

There may be circumstances where we need to share information to protect you or another person or persons from serious harm. When this is the case, if we can tell you what we are going to share and why, we will do so. However, if to inform you would put you or another person in more danger we would share specific information to protect you or someone else. This would be on the legal basis of sharing to protect a person or persons “vital interests”. The reasons for sharing this information would be recorded.

Information shared in regard to Safeguarding

The Trust may also share information about you or information that you have shared with us in order to protect or safeguard you or another individual.

The Trust has a legal responsibility under the Children’s Act 1989 and the 2004 Act to share such information that is required by the appropriate local authority who are conducting investigations in regard to the safeguarding of a child or children.

The Trust also has a duty to cooperate and to share relevant information in regard to a vulnerable adult as a result of the changes within the Care Act 2014. This Act gives the Local Authority in each area a duty to put procedures in place to safeguard vulnerable adults who have care and support needs. Other organisations identified by this law, including health Trusts such as Coventry and Warwickshire Partnership NHS Trust have a duty to assist the Local Authority and to provide relevant and specific information to assist in the protection of a vulnerable adult.

Information shared with the Police in relation to a serious crime/fraud

There may be occasions when we receive a request from the Police for information about a suspect. We would only share limited information after considering the circumstances of the particular request. This would include consideration of the seriousness of the crime and whether withholding the information would be likely to serious prejudice the police’s ability to, prevent, detect, apprehend and prosecute that suspect in relation to the specific crime.

Information shared because of other legal bases

The Health and Social Care Act 2012 set up a new NHS organisation called NHS Digital. NHS Digital is also known as the Health and Social Care Information Centre.

One of the specific legal responsibilities of NHS Digital is to be the safe haven of health and care information. NHS Digital collects data and information about people using health and care services in England and in some cases Wales, Scotland and Northern Ireland. This information is needed to run the health service.

The Secretary of State for Health and Social Care, and NHS England, can tell NHS Digital to collect and process information on specific topics, or set up information systems to collect information. This means they can see, for example, whether policies are working or which treatments are most effective. These orders are called 'directions'.

The Care Quality Commission (CQC), National Institute for Health and Care Excellence (NICE) and NHS Improvement (NHSI) can also tell NHS Digital to collect information. These are called 'mandatory requests'.

Other health and care organisations and local authorities can also ask NHS Digital to collect information for them, if they are legally allowed to view this information.

When NHS Digital is told or asked to collect certain information nationally, this means that Coventry and Warwickshire Partnership NHS Trust has a legal duty to share the required information or data sets with NHS Digital.

NHS Digital publishes 'data provision notices', telling the Trust what data we need to provide to NHS Digital.

Some of the information provided to NHS Digital is identifiable patient information. One of NHS Digital’s roles is to convert such data into nonidentifiable data or anonymised data for use within the local Health Service Commissioning bodies such as the Clinical Commissioning Groups. Where identifiable data is not required this will be anonymised.

How long we keep your information

Information will be kept in accordance with the National Records Management Code of Practice.

The usual retention periods for health records are as follows:-

  • Physical health records - 8 years after the last treatment date.
  • Mental Health records – 20 years after the last treatment date/contact with the service.
  • After a patient’s death, most records are kept for a further 8 years in case of any ongoing issue such as an outstanding complaint or legal action.

NB: Some records are kept for longer if they have historical or research use.

How we protect your Information

The Trust has processes in place to ensure that information is handled in a secure manner at all times. This includes safe haven procedures, encryption software and authorised only access to clinical systems.

Information Security and Confidentiality is included within the Trust’s annual statutory and mandatory training.

Your individual rights

Data Protection Law gives individuals rights in regard to the use of their personal
information. Individuals Rights are:-

The right to be informed: you have the right to know what information we
hold about you and how we use your information.

The right to access information about you: you have the right to have
access to information held by the Trust about you. You may also request a
copy of any information about you. Click here to find out more.

The right to rectification: if you think that something is factually incorrect in
your records you can ask your health professional to update your records. 

If you disagree with a health professional’s opinion or are not happy with what has been written about you please write to the Trust via the PALS Team so that your issues can be investigated and steps taken to have a statement placed in your records.

PALS contact details

Patient Advice and Liaison Service (PALS) Wayside House, Wilsons Lane, Coventry, CV6 6NY

Telephone: 0800 212 445 (Freephone) / 024 7653 6804


The right to erasure (right to be forgotten): this right does not apply to information held for the provision of direct health care.

The right to restrict Processing: If you think that there is something factually incorrect with the information we hold about you, you can ask that further sharing of this information is restricted until it is corrected. You can do this by speaking to your health professional.

The right to data portability: this right is limited to information that is held in a machine readable format. This right does not apply to your health records. This right does apply to telephone/video recordings, including CCTV footage, where it exists.

The right to object: you have the right to formally write to the Trust to object to the processing of your data. The Trust must review your objection and respond to you to let you know the outcome of our review. In the case of data being processed for direct care purposes it is unlikely that we can stop or otherwise erase such information as we are processing this based on our legal requirement as a public body undertaking a public function, which is the provision of health and social care.

The right not to be subject to automated processing including profiling: the Trust does not currently use your personal and/or sensitive (special categories) data to make decisions about you without the intervention of a person, be that a health professional or other authorised member of staff.

Further Information

If you require further information, please contact the Trusts Information Governance Team or Data Protection Officer:-

Information Governance Team Wayside House, Wilsons Lane, Coventry, CV6 6NY

Tel: 024 76362100

Making a Complaint / Raising Issues

If you are not satisfied with how your information has been processed you can contact our Patient Advise and Liaison Service (PALS).

Patient Advice and Liaison Service

Coventry and Warwickshire Partnership NHS Trust Wayside House, Wilsons Lane, Coventry, CV6 6NY

Tel: 0800 212 445 (Freephone) / 024 7653 6804


Alternatively, you can contact the Information Commissioners Office:

Information Commissioner's Office Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Tel: 0303 123 1113


Live Chat: