• Safe & Effective
  • Kind & Caring
  • Exceeding Expectation
Respiratory Centre Privacy Notice

Data Controller: Respiratory Centre

We use a number of locally built and 3rd party equipment/treatment specific patient databases to collect patient demographics and measurements recorded during lung function diagnostics, sleep and ventilation clinics, home oxygen assessments and for the review of treatment and compliance with sleep therapy . Namely Continuous Positive Airway Pressure devices or CPAP and Non-Invasive Ventilators (NIV).

Depending upon which clinic or diagnostic test you are attending will determine the data we may collect from you.

We will collect data such as your name, height and weight, date of birth, address, telephone numbers, GP details, next of kin, medical history, your current medication, smoking history, occupational history, alcohol intake, your collar size, driving status, family medical history. We may also ask you about your social circumstances and record this in your patient record.

We may also ask you to complete questionnaires as part of your clinic visit, the results of which will be recorded within our patient databases or in your patient record. For example we may ask you to complete an Epworth sleepiness questionnaire which gives us an idea of how sleepy you feel during the day. The results of which will be kept on your patient file within our databases.

We may also ask you about your current medication such as inhalers and other medications such as sleeping tablets, antidepressants, painkillers, steroids and other drugs known to have an impact on either respiratory function or your sleep.

Patient data is also collected for research purposes and audit but is anonymised. You will be asked to consent to your participation in any research and audit.

Return to top

Type of processing:

Direct Care and Administrative Purposes
The legal basis which allows us to process the personal data listed above for the purpose of providing you with care is covered under GDPR Article 6(1)(e) '...for the performance of a task carried out in the public interest or in the exercise of official authority...’ and Article 9 9(2)(h) ‘...medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems…' for your special category personal data.

Research Purposes
The department may also conduct research which could involve your personal data. Should this be the case, we will rely upon GDPR Article 6(1)(f) '...legitimate interests…except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject...'

Return to top

  • Data collected from patients undergoing an oxygen therapy assessment who are to be prescribed home oxygen therapy will have some of their data shared with the regional home oxygen provider. This includes the sharing of an oxygen prescription or home oxygen order form (HOOF)
  • This is a company called Baywater Healthcare. Data is shared using a secure application called Oxyshop
  • We will ask patients to complete and sign a consent form allowing the sharing of this data with the oxygen provider
  • During oxygen assessments we may also request a home safety visit by the West Midlands fire service again we will ask for your consent to organise this for you. Your details will be forwarded onto the fire service so that they can arrange a home visit
  • The lung cancer nurse specialist team will share your information (patient demographics, medical problems and history as well as your current medication with social services, district nursing teams and palliative care providers
  • Information is also shared with West Midlands Asbestos Support if you are diagnosed with a condition called Mesothelioma. We will obtain written consent from you to do this. We will also complete medical forms on your behalf such as DS1500

Return to top

  • Verbally from direct questioning/clinical history taking as well as from measurements recorded such as height and weight
  • Completion of questionnaires during clinic visits for example an Epworth sleepiness score
  • Data is also collected from patient devices such as CPAP but this does not include patient identifiable information, the treatment data is linked to the patient within our secure database. The treatment data is obtained via an SD data card download from the medical device (i.e. CPAP, NIV)
  • Referral letters are received from your GP and other healthcare professionals. This will include your information as well as your medical history and the reason for the referral
  • Referrals are received via email using NHS.net, this is a secure encrypted email system
  • Referrals into this service are also obtained from internal sources within the hospital from doctors, consultants and other healthcare professionals. This referral is sent to us electronically using a system called clinical web portal and the lung function referral administration system.
  • From research and development if you are to be entered onto a research trial
  • Verbally over the telephone from doctors and other healthcare professionals
  • Via faxed referrals typically from your GP or community matrons, GP practice nurses

Return to top

Below is a list of the rights you have in relation to your data and when they apply. To make an application for any of the below rights please contact the Health Records Access Team rwh-tr.healthrecordsaccess@nhs.net in the first instance. All rights should be considered within 30 calendar days from date of receipt, but may be extended if complex. What rights do I have in relation to my information?


The Right of Access
You have the right to request a copy of any information held by the Trust as well as any supplementary information. See How do I request my information? for details on how to request your information.


The Right to Erasure
The right to erasure is also known as the ‘right to be forgotten’ introduces a right for you to have personal data erased. Generally this right is not available with health care data. Where this right is available for specific processing you will be notified.

restrict processing

The Right to Restrict Processing
The right to restriction allows you to request the restriction or suppression your personal data. This right is closely linked with the right to rectify and the right to object and will only apply if:

  • you contest the accuracy of your personal data and the accuracy is being verified by the trust
  • the data has been unlawfully processed (i.e. in breach of the lawfulness requirement of the first principle of the GDPR) and you oppose erasure and requests restriction instead
  • the personal data is no longer needed but we need to keep it in order to establish, exercise or defend a legal claim


The Right to Object
The right to object to processing means that data should cease to be processed. This right applies only where data is obtained with your consent. In most cases we rely on our legal basis to process your data and not consent and therefore for care purposes this right may not apply. If your data is used for any other reason this right may apply, but would have to be assessed on an individual basis.

If you believe your information may be inaccurate or incomplete you can make a request to have your information reviewed.

Return to top

You have a right to see or have copies of any information held by the Trust that relates to you free of charge. We have the right to charge an administration fee in situations where repeated requests are received for the same information or the request is excessive. You will be required to prove your identity when making requests.

Subject Access Requests under GDPR rules (post 25 May 2018) will be processed within 30 days. However, once our teams have established the volume of records requested there may be a requirement to extend this up to a further 2 months. We will contact you within 30 days should this be the case.

To request access to health records please complete a Subject Access Request form and forward on to:

Health Records Access Team 
Health Records Library
Location B19
New Cross Hospital
Wednesfield Road
WV10 0QP

Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 Extension 5544

Return to top

All our records are destroyed in accordance with the NHS Retention Schedule, which sets out the appropriate length of time each type of NHS records is retained. We do not keep your records for longer than necessary.

All records are destroyed confidentially once their retention period has been met, and the Trust has made the decision that the records are no longer required. For more information please see the Record Management Code for Practice for Health and Social Care 2016, retention schedules.

How long is my information kept for?

  1. Adult health records standard retention period: 8 years
  2. Clinical trial and research data retention period: up to 30 years

Return to top

If you have any questions about your care or a complaint, please speak to the health professional with your care in the first instance. If this is not resolved to your satisfaction you can contact the Patient Advice and Liaison Service (PALS). If you have any concerns about how your information is being processed or any of the rights as detailed above, please contact the Trust in the first instance through:

Health Records Access Team 
Health Records Library
Location B19
New Cross Hospital
Wednesfield Road
WV10 0QP

Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 Extension 5544

You also have a right to complain directly to the Information Commissioner’s Office if you feel the Trust has not responded effectively to any of the above.

Information Commissioners Office
Wycliffe House
Water Lane

Telephone: 0303 123 1113
Website:  https://ico.org.uk/

Return to top

A Teaching Trust of the University of Birmingham