Preventx Limited is the data processor for the Sexual Health London e-service
The City of London Corporation is the data controller for the Sexual Health London e-service.These means that they instruct Preventx and its partners on what data is processed and how this will be done.This role is undertaken in accordance with the General Data Protection Regularly (GDPR) and the Data Protection Act 2018.
For all requests regarding the control of your data, please contact the City of London Corporation's Information Officer
information.officer@cityoflondon.gov.uk
City Corporation’s Data Protection Officer
PO Box 270
Guildhall
London
EC2P 2EJ
The City of London Corporation provides information regarding data privacy and security via its Privacy Notice:
To deliver Local Authority services that are required by law.
Providing services for the prevention, diagnosis and treatment of illness in line with the Health and Social Care Act (2012).
The provision of healthcare or treatment and the management of health or social care systems and services.
Personal data: name, address, date of birth, contact information e.g. telephone number.
Special category data: ethnicity, gender identity, responses to medical and safeguarding screening questions, medical testing history, details of attendance with health providers that may have provided treatment.
We use other organisations to either store personal information or use it to help deliver our services to you:
Both the processor and controller have an agreement in in place to make sure that the organisations that your data is shared with comply with data protection law.
Sometimes there is a legal duty to provide personal information to other organisations.
There may also be occasions that your personal information is shared, when we (Preventx or its partners) consider/believe that there is a good reason to do so, which is more important than protecting your privacy. This doesn’t happen often, but in these circumstances your information may be shared:
For all these reasons, the risk must be serious before we can override your right to privacy.
If in providing this service Preventx and/or its partners we are worried about your physical safety or feel they need to take action to protect you from being harmed in other ways, they will discuss this with you and, if possible, get your permission to tell others about your situation before doing so.
Preventx and/or its partners may still share your information if they believe the risk to others is serious enough to do so.
If this is the case, Preventx (and/or its partners) will make sure that a record of what information is shared and the reasons for doing so. We will let you know what we have done and why, if we think it is safe to do so.
Your data that is provided is stored on secure servers in the UK and there is no transfer of data to any third (party) countries or international organisations.
Preventx and its partners will only hold your personal information for as long as it is necessary to fulfil our legal duties or business purposes.
In line with national clinical guidelines, your record will be retained for 10 years after the last recorded entry, e.g. your last data entry was 1 January 2018, your personal information will be deleted on 1 January 2028.
If you are aged 16 or 17 years old, your record will be retained for 10 years after your 18th birthday. For example if your last data entry is 1 January 2018 and your 18th birthday is 1 February 2018 then your data will be deleted on 1 February 2028. After that point, your personal identifying information (e.g. name, house number, street name, telephone number and email) will be removed to provide an anonymised data set for statistical and research purposes only.
Your data will not be deleted after 10 years if continue to use the service. This is based on national guidance, which NHS sexual health clinics follow.
The law gives you a number of rights in relation to what personal information is used by the City Corporation, and how it is used. These rights are listed below, and full details can be found in the City Corporation’s Data Subject Rights Policy.
You can ask us to:
The right to withdraw consent and the right to erasure do not apply due to the nature of the services being provided and the basis in law for processing this data. The City of London Corporation as the controller of your data will consider requests to remove personal identifying information from your record to ensure that the data we do retain is anonymised.
For independent advice about data protection, privacy and data sharing issues, you can contact the Information Commissioner’s Office (ICO) at:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Tel: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.
Alternatively, visit Information Commissioners Office or email casework@ico.org.uk.
The personal data Preventx and its partners hold is provided by you in the first instance. If you subsequently attend a clinic to access treatment following a diagnosis, that clinic will inform SHL of that attendance so that we can be sure you have not been lost to care and protect public health. No further details will be shared with us by the treating clinic unless you have provided them with your consent to do so e.g. the treatment provided, or further tests that they undertake. If you communicate with the clinical team at SHL they will record the advice and support, they have provided.
Preventx and its partners use automated decision-making to confirm eligibility for the service e.g. to make sure that your borough is participating in the service. There is also automated decision made on your age because this service is only for people aged 16 years and over. Automated decision making, based on national clinical guidelines is also used, to determine whether the e-service is clinically appropriate for your individual circumstance and to determine which type of test kit is most suitable for you.
If the automated decision-making process determines that you are unsuitable for the e-service, including the chlamydia treatment pathway, you will be provided with information about accessing care from a physical clinic.
Currently, no profiling is undertaken, and we have no plans to do so. Profiling would only ever be used to help us fulfil our duties under the Equality Act 2010 in advancing equality of opportunity between people who share a protected characteristic and people who do not share it
Your sample will be tested in Preventx's specialist laboratory and in accordance with the laboratories quality system. Standard testing carried out via the SHL.UK service is accredited to international standards, and more information can be read in the Preventx Laboratory Services document.
In some cases, we may use non-accredited tests to supplement your screening, however, this would only ever be in agreement with doctors or clinicians (for example, specific sample and test combinations may be recommended but may fall outside of accreditation scope).
Please note that some test samples may be retained by the laboratory after testing. These samples may be used for internal studies, public health initiatives (such as surveillance work with UK Health Security Agency (UKHSA) or verification purposes (such as performing equipment validation). Samples used for these purposes will be pseudonomysed. This will always exclude personal data such as your name, date of birth, contact details, address or postcode.