When we collect and process personal data about people we are required to provide them with information about that processing. This privacy notice below informs you of the type of personal data that we hold, how that information is used, who we may share that information with, and how we keep it secure and confidential.
(Last updated 1 May 2026)
Identity of the data controller:
Sheffield Health Partnership University NHS Foundation Trust
Centre Court
Atlas Way
Sheffield
S4 7QQ
Website: www.sheffieldpartnership.nhs.uk
Our ICO registration number is: Z7828644
The implementation of data protection is overseen by our data protection officer.
You can contact them via this email DPO@sheffieldpartnership.nhs.uk or you can write to them at this address:
The data protection officer
Sheffield Health Partnership University NHS Foundation Trust
Wardsend Road North
Sheffield
S6 1LX
The use of personal information about service users within the Trust is overseen by the Caldicott guardian who can be contacted at caldicott@sheffieldpartnership.nhs.uk
We process personal information about our staff, service users, volunteers, carers and other people for a variety of purposes:
The main reason we process personal data is because it is necessary:
We process information which is defined in law as ‘special category’ data – this includes health records amongst other items. This is necessary:
We also process some personal information because it is necessary:
We process some personal information because it is necessary:
Sometimes we may process information on the basis of consent from the data subject but this is not the basis for the majority of our processing.
Where consent is used as the basis for processing this will be made clear to the data subject along with their rights regarding consent.
We collect different types of personal information:
Some of our wards and some other premises operate surveillance camera (CCTV) systems in order to protect the safety of our service users, staff and visitors, to help review incidents when they happen, and to deter or investigate crime. Where these systems exist, notices provide further details about their operation.
The Trust may make limited and controlled use of systems which involve artificial intelligence.
We will never rely solely on AI systems to make decisions on the care or treatment of service users, or to make diagnoses.
Some services may use AI systems to support administrative tasks, including summarising consultations with service users to make the process of documentation more efficient. Where this happens, summaries will be reviewed and approved by the clinician involved before they are added to service user records. The summaries will be retained as part of the care record and the original recordings will be deleted. Service users will be asked to consent to the use of AI in this way and if they do not agree, alternative processes not involving AI will be used.
Personal information about identifiable service users will not be used in training AI systems.
We share information with other health and social care organisations such as hospitals, GPs, care homes and social services to facilitate the provision of care.
We will also share personal information with partner organisations where this is necessary for safeguarding our service users or other people.
We may share information with carers of service users where the service user has agreed to this.
If we detain someone under the Mental Health Act, we are required to notify their nearest relative.
We may share information with the police or courts where we are legally obliged to do so or in order to help prevent or investigate serious crimes. We also share information with the police and partner organisations as part of the Multi-Agency Public Protection Arrangements (MAPPA) to manage sexual and violent offenders, and MARAC meetings which consider cases of high-risk of domestic abuse.
We provide datasets to purchasers/commissioners of our services and to NHS England.
Regulators have the ability to view information we collect as part of the process of ensuring we provide good services, and external auditors may have access to personal information about service users and/or staff as part of audits we commission from them.
We use systems provided by commercial suppliers to process information about our service users and staff and the suppliers are required by contract to maintain the confidentiality and security of our data.
We take part in the annual Community Mental Health Survey so that users of our services can give us feedback and we can compare our performance against other NHS Trusts. The survey questionnaires are distributed to a sample of service users and their answers analysed by an independent survey company on our behalf. Service users can let us know if they don’t want to be included in these surveys.
As an NHS Foundation Trust, we contract an external supplier to administer membership elections on our behalf.
As an NHS organisation we use person-identifiable information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that our research serves the interests of society as a whole. We do this by following the UK Policy Framework for Health and Social Care Research.
You may be asked if you want to take part in research projects undertaken by the Trust. If you agree to take part in a research study we will use your data in the ways needed to conduct and analyse the study. Once you have agreed to participate in a research study we will be processing your information under the basis of a “Public task” so your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained.
In certain circumstances, where it is not practical to get consent from individual patients, we may be granted legal approval to process personal information for research purposes without consent - any such requests are subject to processes imposed by the Health Research Authority and have strict requirements to protect patient confidentiality imposed upon them.
To safeguard your rights, we will use the minimum person-identifiable information possible.
You can find out more about patient information and health and care research on the Health Research Authority website.
This Trust is a mandatory participant in the Cabinet Office’s National Fraud Initiative data-matching exercise, run every two years.
The use of data by the Cabinet Office in a data matching exercise is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under the Data Protection Act 2018. All Trust staff and suppliers’ data may be submitted to the National Fraud Initiative on a regular basis.
You can read further information about the national fraud initiative on the GOV.UK website.
We do not routinely transfer personal information to other countries.
Where we are requested to send individual service user records abroad we will do so with their consent and via a secure method.
We adhere to the retention periods set out in the NHS Records Management Code of Practice, available here.
We will develop systems to allow us to archive records which have passed their recommended minimum retention period but we will not destroy records which may be relevant to ongoing inquiries
Data subjects have a right to know when their personal information is being processed. We let you know about the processing we do via this notice and via our staff when they collect information from you. You can also contact our Data Protection Officer.
You can ask us to confirm whether we process information about you and for an explanation of the processing. You can also ask for access to the information we hold about you – we won’t charge for this and we have to provide the information within a specified time period (unless the information is covered by an exemption or the request is manifestly unfounded or excessive). If you have a keyworker you can ask them for details of how to access your information or you can contact our Access to Records Team. You can find details on how to access your records on our website here.
If you think any of the information we hold about you is inaccurate you can ask us to change it – if we agree then we will correct the information but we will usually keep a copy of the previous version in case we need to refer back to see the information as it was at the time any decisions were made. If we disagree about the information being incorrect then you can add a note to your records to say what you disagree with.
Data protection legislation gives data subjects a limited right to have their personal information deleted where there is no compelling reason for the processing to continue. This is sometimes known as the ‘right to be forgotten’. For the majority of the personal information we process we will need to keep it for the minimum retention period specified in national guidance so that we have the information we need to treat our service users, to manage and plan our services and to be paid for the work we do and in case something goes wrong or a complaint is made and records are needed for an investigation or legal proceedings, so we cannot delete the information. If you want to know more, please contact our Data Protection Officer.
In certain circumstances you may have a right to restrict the processing of your personal data – it would then still be held but not further processed. This would apply where you had contested the accuracy of the data or objected to the processing and were awaiting our response, or we no longer needed the data but you required us to keep it for legal purposes.
Where you provide your information to a data controller with consent or for the performance of a contract with you and if the data is processed automatically then you can ask for your data to be downloaded in a form that allows you to transfer it to another provider. This is not how we process the information we hold so the right to data portability does not apply but you still have the right to make a subject access request for your data, as above.
You can object to processing of your information for direct marketing or profiling. We may contact you to tell you relevant information about our services or to ask for your opinions - this is not marketing but you can tell us your preferences about how and when we contact you. You can object to having your identifiable information used for research – if we ask you whether you would like to be involved in research projects we will tell you what would be involved and will respect your decision. This is different from the decision whether to allow data about you to be used as part of national datasets – see the national Data Opt-Out website to find out more about this here.
You have the right not to be subject to decisions based on automated processing which have a significant effect on you. We may use assessment tools which score people according to certain criteria but we don’t use them as the sole way of making decisions about our service users and there will always be an element of human decision making.
We may use data to profile service user populations so we can plan services and offer appropriate interventions to improve their health and wellbeing. Where we do that then we will be open about the logic we use, we will use reliable processes and make sure the processing is secure.
If we process information on the basis of consent from the data subject then they can withdraw their consent if they choose. We do not rely on the consent of data subjects for the majority of the processing we do – we process information in order to provide health and social care services and to run our Trust as described elsewhere in this notice.
If you wish to withdraw your consent for any processing which you think is undertaken on the basis of that consent then please contact our Data Protection Officer in the first instance by emailing DPO@sheffieldpartnership.nhs.uk
If you have a complaint about how your personal information has been processed then you can raise it informally with the appropriate service or formally using our complaints procedure, details available on our website here.
You can also contact our Data Protection Officer, as detailed above.
You have the right to complain to the Office of the Information Commissioner which oversees the operation of Data Protection legislation. The ICO website is here or you can write to:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
We receive information when other services such as GPs or social workers make referrals to our services. This will include the identity of the person being referred and their contact details plus relevant information about the reason for their referral.
We collect information from our service users and from other people involved in their care. This may include families and carers as well as professionals.
We also receive results of medical tests from other health organisations.
We use national systems in order to find NHS numbers so that we can uniquely identify our service users, to find their registered GPs and check that other details about them are accurate and up to date. Some systems we use are linked to national systems in order to keep service user details up to date.
We need to collect information about our service users in order to provide them with safe and effective care. This includes keeping records of the treatment we provide. We cannot provide our services without keeping records.
We also need to record the work we do in order to meet the contractual requirements of the bodies that purchase our services and to comply with national reporting requirements.
We process information about our staff for general employment purposes and in order to make sure they are qualified to do their jobs, to make sure we pay them and respect their rights and to ensure the safety of the people they provide services to. When we advertise jobs we process information about the people who apply, including their qualifications, work history and references supplied.
During the COVID-19 pandemic, the health and social care system faced significant pressures.
The Secretary of State required the NHS, GPs and local authorities to share confidential patient information in order to support health and social care services and to protect public health. Information was also vital in researching, monitoring, tracking and managing the outbreak. This legal requirement was time limited and came to an end on 30 June 2022.
The onset of the pandemic hastened the adoption of telephone and video-conferencing for consultations. If you participate in consultations via these methods, your personal/confidential patient information will be safeguarded in the same way it would be with any other consultation.
We have also been required to share personal/confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak. Further information about how health and care data has been used and shared by other NHS and social care organisations in a variety of ways to support the Covid-19 response is here.
Electronic Prescribing and Medicines Administration (ePMA) data
In December 2020 NHS England established a daily collection of medicines prescribed and administered to patients, sourced from ePMA systems in hospital NHS trusts in England. The collection stopped in August 2023 but the information collected remains accessible for research and analysis.
Asymptomatic staff testing results
During the pandemic, staff were tested for COVID-19, and any positive tests were reported to Public Health England. These arrangements have now ceased.
Vaccinations
Where we provide flu vaccinations to our staff or service users, this is recorded on a national system which transfers information to GP records and the NHS App.
Patient records are created when people use health and care services but this information may also be used for purposes beyond the provision of individual care, for instance to help with:
This can only take place when there is a clear legal basis to use this information.
Most of the time, information used for research and planning is anonymised so that individual patients cannot be identified but sometimes, identifiable data is needed.
You have a choice about whether you want your confidential patient information to be used for purposes beyond your direct care. If you are happy with this use of information you do not need to do anything but if you want to opt out of these additional uses, you can register your choice with the national data opt-out. If you do choose to opt out of these other uses, your decision will not affect your individual care.
To find out more or register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters
On this page you will:
You can also find out more about how patient information is used at: www.hra.nhs.uk/information-about-patients (which covers health and care research); and understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made)
You can change your mind about your choice at any time.
Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.
Sheffield Health Partnership University NHS Foundation Trust has processes in place to comply with the national data opt-out policy.
We may amend this privacy notice at any time so you may wish to check back from time to time.