Privacy and keeping you safe

Who we are

Indigo Gender Service (Indigo) is a partnership between gtd healthcare, a-not-for-profit organisation with an established presence in primary care and urgent care services in the north-west, and LGBT Foundation, a national charity delivering services, advice and information for lesbian, gay, bisexual and trans (LGBT) communities. We have been commissioned by the NHS to deliver a two-year pilot for a new way of delivering trans healthcare.

Indigo is based in primary care and led by experienced GPs. We provide most of the services offered by Gender Identity Clinics (GICs), but in a non-specialised primary care setting. This means our clinical team is based in GP practices across Greater Manchester, and we also have additional services such as voice coaching and therapeutic services delivered in settings around Greater Manchester.

We offer trans and non-binary people different ways to access support services, including assessment and diagnosis for gender incongruence. This includes holistic assessments of a patient's needs and offering referrals and signposting to other services. As a result, to provide services, Indigo needs to collect, store and use personal data every day, such as medical records, personnel records and computerised information. This data is used by many people in the course of their work.

Indigo works with other health and social care providers to deliver a more joined up way of meeting the needs of the people who access our services. This means that, where appropriate, we may provide other people looking after you with information about the care you have received whilst using our services or ask for information about the care they provide, for example your own GP.

The main benefits are:

Professionals involved in your care can see information about any care or treatment we have provided. This will support their decision making and improve the care you receive.
This relates to both manual and electronic information – all access is strictly authorised and only takes place where a professional has a legitimate relationship to you and the delivery of your care. All access is recorded, so we know only people who should have access to information are accessing it.
You don’t have to keep telling different professionals your story each time you have an appointment.

Where there is a justifiable basis to do so, your information may also be shared with other organisations, such as the police.

We take our duty to protect your personal information and confidentiality very seriously and we are committed to taking all reasonable measures to ensure the confidentiality and security of personal data for which we are responsible, whether computerised or on paper.

Under the EU General Data Protection Regulations (GDPR), Indigo utilises and processes your information on the following bases:

Article 6 (1)

(c) Legal obligation: the processing is necessary to comply with the law, e.g. directions under the Health and Social Care Act 2012 or disclosures under public health legislation.

(e) Public task: the processing is necessary to perform a task in the public interest or for our official functions as a provider of healthcare services.

Some of the information Indigo gathers and retains is considered personal and sensitive, which under GDPR is classed as special category data. In addition to health-related information, this may include information about an individual’s race, ethnic origin, religion, sexual orientation. This is processed under:

Article 9 (2)

(b): processing is necessary for the purpose of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law.

(h): processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

(j): processing is necessary for archiving purposes in the public interest, scientific or historical research or statistical purposes.

Where a request for personal confidential data from an insurance company, solicitor or employer is received, this will be processed under the lawful basis and lawful condition of explicit consent under both Articles 6(1)(a) and Article 9(1)(a) where, the individual has given clear consent for us to process their personal data for a specific purpose.

For further information on the lawful basis on processing, please visit the Information Commissioner’s Office (ICO) website.

The team of professionals caring for you will keep records about your treatment, and the care and services provided to you, both on paper and electronically, including the recording of telephone contacts with the service. The amount and variety of information we have about you will be dependent upon which of our services you have used.

Information held may include:

personal details such as name, address, date-of-birth, ethnicity and religion, NHS number, next of kin and contact details (telephone/email);
contact we have had with you e.g. GP, voice and communication therapists, psychological support;
notes and reports by health and social care professionals about your health;
details and records about your treatment and care;
results of blood tests, and any other tests;
relevant information about people who care for you and know you well;
basic details about associated people e.g. partners, carer and relatives.

Information is used for the following purposes:

to provide you with care/treatment and care plans, both now and in the future, ensuring that appropriate information is available to all those who treat you medically and care for you professionally;
to ensure your care is safe and effective;
to support you in managing your own care and work with health and social care professionals to ensure there is no decision made about you without your involvement;
where you have consented, to involve your relatives/representatives in your care;
where you have consented, to contact you directly;
to train and educate staff e.g. clinical placements; identifiable information may be used for this purpose;
to assess and improve the quality and type of care you receive;
to support the investigation and management of complaints, incidents or legal claims.

Everyone working within Indigo has a legal duty to keep information about you confidential. Similarly, anyone who receives information from us has a legal duty to keep it confidential.

We will only ever share your information if it is in the best interest for your care. In some cases we work with other organisations to provide onward care for our patients; where appropriate, we may share information with them. Also, we will share information with the following specific main partner organisations:

local GP practices;
Nottingham Centre for Transgender Health and where required other GICs;
hospitals that are involved in your care;
community healthcare providers, e.g. district nurses, health visitors, etc.

You may receive care from other people as well as the NHS. We may need to share some information about you with them so we can all work together for your benefit if they have a genuine need for it or we have your permission. Therefore, we may also share your information, subject to strict agreement about how it will be used, with:

social care services;
education services;
local authorities;
voluntary and private sector providers working with the NHS.

We will not disclose any information that identifies you to anyone outside of those providing your care without your express permission unless there are exceptional circumstances, such as:

when there is serious risk of harm to yourself or others;
the duty to share your information outweighs the obligation of confidentiality;
there is a permission granted under div 251 of the NHS Act 2006(1);
a court issues an order to release your information;
where there is another statutory or legal basis for disclosure.

Each health and care organisation in Greater Manchester (GM) collects information about you and keeps records about the care and services they have provided. The GM Care Record pulls together key information about you from different health and social care records and displays it in one combined record. This enables health and social care staff to find key information about your care in one place, which helps them to make the most informed decisions and provide the best care to you as a patient or service user. It is also essential that health and social care staff have access to the most up-to-date information including alerts that may be helpful for staff involved in your care. Further information is available as follows:

healthinnovationmanchester.com/wp-content/uploads/2020/05/Public-explanation-infographic.pdf

healthinnovationmanchester.com/the-gm-care-record-privacy

We need to be able to move electronic information from system to system, extracting data, processing and modifying it for the next system. Occasionally, tests will need to be made on the data, sometimes with our system suppliers, to check that it has been transferred correctly. This will only be done under carefully controlled conditions.

All information that we process on individuals is managed in line with the Records Management Code of Practice for Health and Social Care 2016; GP records are currently retained for 10 years after the death of the patient. No records that we hold related to individuals are processed outside of the United Kingdom.

You have the right of access to your own records and you may authorise by consent, a third party to seek access on your behalf, for example a solicitor. A person appointed by a court to manage your affairs may also make an application on your behalf.

We are committed to ensuring that everyone who is being cared for by Indigo has access to their clinical information and we will work with you to agree the best way of sharing your information. If you require more detailed records you should apply directly to our head office, please see the 'Contact' section below for details. Indigo will aim to provide the information to you within one month of your request; where this is not possible, we will provide you with an explanation for any delay, omissions or refusals.

Access may be denied or limited where a healthcare professional deems giving you the information may cause serious harm to you or others, or would disclose details of third parties to which you are not entitled, and they have not consented to the disclosure.

Indigo has obligations under GDPR to keep information we have generated about you accurate and up-to-date. If you consider that any part of the information held in your record is inaccurate, you can apply in writing to have this amended providing evidence as to the correct details. If we agree that the information is incorrect, the alteration will be made. If we are not satisfied that the information is incorrect, a note will be made of the information you consider is inaccurate. You will be given a copy of either the correction or the note.

If we hold information about you that originated from another organisation that you consider to be inaccurate, you should contact that organisation directly. You will be advised of the process to be followed by that organisation.

Under GDPR individuals have a general right to object to the processing of their data in certain circumstances. However, where the data processed by Indigo is carried out under a lawful basis, this right does not apply. Where data has been processed based upon your consent, this consent can be withdrawn at any time, e.g. sharing of your records with your solicitor to which you had previously provided consent but subsequently withdraw consent.

A Data Protection Impact Assessment (DPIA) is a process to help organisations to identify and minimise the data protection risks. Indigo has DPIAs for any processing that is likely to result in a high risk to the data security and protections rights of individuals.

Aside from describing the nature, scope, context and purposes of the processing, these also detail whether the information being collected:

complies with privacy-related legal and regulatory compliance requirements;
the risks and effects of collecting, maintaining and sharing of personal and sensitive information;
the security and processes in place for handling information to alleviate any potential privacy risks.

DPIAs are available to members of the public upon request via the contact details below.

If you have any queries or complaints in relation to any of the information provided within this privacy notice, please contact:

Data Protection Officer, Indigo Gender Service, New Century House, Progress Way, Off Windmill Lane, Denton, M34 2GP

Tel: 0161 337 3465

Email: g td.dataprotection@nhs.net

The Information Commissioner is the regulator for privacy and information rights legislation. For further information, please visit the Information Commissioner's Office website.

Contact details

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

SK9 5AF

Tel: 0303 123 1113

Website: https://ico.org.uk/global/contact-us/

Alternative formats

If you need help to understand the information outlined above or require it in another format (for example Braille), or in another language, please speak to a member of staff who is currently providing your care.

Safeguarding information

Accessibility tools

Who we are

Lawful basis for processing

Article 6 (1)

Article 9 (2)

What we record

How is the information used?

Who do we share information with?

The Greater Manchester (GM) Care Record

Managing the information

Accessing your information

Keeping information up-to-date

Right to object

Data Protection Impact Assessments

Contact

Further information

Alternative formats