Privacy policy

When you contact us or sign up for support, we may collect:

• Your name and title
• Your date of birth
• Your address and postcode
• Your telephone number and email address
• Information about your health relevant to the service, such as whether you use tobacco
• Your preferences for how and when we contact you
• Records of correspondence between us
• Your IP address, browser details and how you use this site

If a health professional refers you, we also collect their name, organisation, job title and contact details so we can confirm the referral.

We use your information to provide the service you have asked for: to contact you about your referral, to arrange and deliver appointments, and to keep a record of the support given. We also use anonymised information to understand how the service is used and to report to the organisations that commission it.

Our lawful basis for processing your personal data is the performance of a task carried out in the public interest (UK GDPR Article 6(1)(e)). For health information, our basis is the provision of health or social care (Article 9(2)(h)).

We only send you marketing information if you have opted in, and you can withdraw that at any time. We never sell your information or share it with third parties for marketing.

Where we rely on your consent — for example to contact you about your referral — we ask for it clearly, we ask you to opt in rather than opt out, and you can withdraw it at any time by contacting us.

We share information with the NHS and with the organisations that commission this service where that is necessary for your care or for the service to be accounted for. We may also share information where the law requires it. Our systems and suppliers are chosen to meet data protection requirements, and information is held securely.

We keep your records for as long as is necessary for your care and to meet our legal and NHS record-keeping obligations, after which they are securely destroyed. Our Record, Retention and Destruction Policy sets out the periods that apply.

We comply with the National Data Opt-Out. You can choose whether your confidential patient information is used for research and planning.

Find out more at nhs.uk/your-nhs-data-matters.

To book your appointment we ask for:

• Your name and date of birth
• Your email address and mobile number
• Your job role and workplace postcode, and your home address if the clinic asks for it
• Your answers to any questions the clinic asks before your appointment
• The appointment you choose, and the agreements you tick

Before you book, we ask you to tick two boxes: to agree that we can contact you about your appointment, and to agree that your details can be shared with the health check team and recorded on the service's secure internal system. We cannot book an appointment without both, because we would have no way to arrange or deliver it.

You can cancel your appointment at any time using the link in your confirmation email. To ask about your information or withdraw your agreement, email yourhealth.dudley@nhs.net.

Your booking is sent by secure email to the Your Health Dudley NHS mailbox. The admin team adds it to the service's secure internal system, which is used to arrange and deliver your health check and to contact you if anything changes. It is then kept and destroyed in line with our Record, Retention and Destruction Policy, as described under How long we keep it.

We also send you a confirmation email. Our email delivery provider handles these emails only to send them.

The website does not keep your personal details. It keeps only what it needs to manage the appointment: the time, the clinic, a booking reference, and a coded value that stops the same person booking the same clinic twice. That coded value is made from your details in one direction only, and cannot be turned back into them.

Your employer arranges the clinic, but we do not share your name, your contact details or your answers with them. Their contact may be told that an appointment has been booked, moved or cancelled, with only the booking reference, date, time and clinic.

If a breach affects personal information, we report it to the people affected and to the Information Commissioner within 72 hours of becoming aware of it, where the law requires.

If you are unhappy with how we have handled your information, please contact us at yourhealth.dudley@nhs.net so we can put it right. You also have the right to complain to the Information Commissioner's Office.

ico.org.uk

For any question about this notice or about your information, email yourhealth.dudley@nhs.net. For a copy of a Data Protection Impact Assessment, email admin@ablhealth.co.uk.

If we make a significant change to this notice we will say so clearly on this page.