Norfolk Primary Care Limited Privacy Policy

Privacy Notice – Norfolk Primary Care and Your Employee Information

Norfolk Primary Care takes your privacy very seriously.

We are registered with the Information Commissioner as a Data Controller and our registration number can be found by searching at https://ico.org.uk/ESDWebPages/Search.

If you have any questions or wish to make a request in relation to your information, please contact the Data Protection Officer at: [email protected].

Norfolk Primary Care is required to collect, use, store and share information about you, for the purposes of maintaining and administering the employment relationship we have with you.

Some of your personal information is transferred outside of the UK to EU Member States. This is permitted under GDPR under Article 49 (1) (d), because the transfer is necessary for the performance of your employment contract. We ensure that we have the necessary safeguards in place to protect your personal data when transferred.

How Does Norfolk Primary Care Collect my Information?

We will collect information about you, either directly – when you make an application for a job with us to, or indirectly – through references, occupational health referrals and during the course of your employment with us.

The information we collect will be stored on computer and electronic systems. The information includes Personal Data;

basic details about you, such as address, date of birth, and next of kin

as well as Sensitive Personal Data, where it is relevant to your employment;

notes and reports about your health and any disabilities
information about your home life such as marital status
Information about criminal records checks – generally, we will only retain the reference number

Norfolk Primary Care are permitted to collect, store, use and share this information, where necessary, under the General Data Protection Regulations Article 6 (1) (b) “for the purposes of a contract” and Article 9 (2) (b) “employment purposes” or their equivalent provisions under domestic legislation.

Norfolk Primary Care will also collect information about you through observed routes such as monitoring of use of equipment, CCTV and telephone recording. These uses are generally in line with our ‘legitimate interests’ as an organisation and the use of information collected in this way will be in conjunction with support from our DPO to ensure that employee rights are properly observed.

How Does Norfolk Primary Care Use my Information?

Norfolk Primary Care will use your information for your employment in the following ways;

To support the process of recruiting and onboarding you as a member of staff
To pay you and to keep payroll records
Administration of Expenses and Leave
To deliver and maintain records on your training and professional development
To support secondments or promotions
To manage your performance
To support specific corporate activities like obtaining insurance quotes or being audited
To monitor and support clinicians on home visits, enhancing staff safety, enabling rapid emergency response

To undertake some of these activities, your information will be shared internally across our teams. We will work to ensure that only the right people have your information and that they are only given the information they need.

Who Does Norfolk Primary Care Share My Information With?

Norfolk Primary Care works hard to ensure that only the right people have your information and that they are only given the information they need.

Norfolk Primary Care Uses other companies to help us deliver some of our services such as;

Confidential Waste Provider: Shred It

Email System: Office 365 @ norfolkprimarycare.com

HR Provider: Pip Foulsham HR Consultancy

Payroll Provider: Civica

Pension Provider: NHS Pensions and NEST

Digital & Data: Fivetran & Snowflake

Occupational Health Provider NNUH

DBS: UCheck

Remote Working Safety App: Staysafe

Personal data will never be made available to organisations not involved in your employment or contracted directly by us without letting you know and giving you a chance to object (aside from in the examples listed in the section below).

We have contracts in place with these organisations that prevent them from using it in any other way that how we tell them to. These contracts also require them to maintain good standards of security to ensure your confidentiality.

When we receive reference requests from prospective new employers for you, we will share information about your employment with us. This may include:

Dates employed
Any time off for sickness in the two years before the request and the reasons for the absence (this is required for certain positions in accordance with NHS guidelines)
Job Functions
Salary
Whether you are eligible to work in the U.K.
Any compliments / concerns over your employment
Comments on conduct within the workplace

Will Norfolk Primary Care Share without Asking Me?

Sometimes we will be required by law to share your information and will not always be able to discuss this with you directly.

Examples might be;

Sharing with the police or tax authorities for the detection or prevention of crime
Where it is in the wider public interest – to keep the public safe for example
To safeguard children or vulnerable adults
Because the court has told us we must share.
We may also share your information in the event of a medical emergency, including mental health emergencies. Sharing will be in line with the NPC Information Sharing Protocol.

COVID-19 Testing and Disclosures

At the start of the COVID-19 Pandemic, the Secretary of state issue a notice to compel health and care organisations to collect and share confidential information to support the response to this national health emergency.

You can find out more about the notice here.

This means we are required to collect information about staff infection status and vaccination information for example. We may be required to share this with NHS England or Public Health England and will aim to make you aware of this when it is necessary.

We will store this data safely on our local systems and, if we are required to share it, we will do so using secure routes only.

What are my Information Rights?

Data protection law provides you with a number of rights that Norfolk Primary Care is committed to supporting you with;

Right to Access

You have the right to obtain:

confirmation that your information is being used, stored or shared by Norfolk Primary Care
a copy of information held about you
If you only require a particular part of your record, tell us and this can reduce the time it takes to provide it
We will respond to your request within one month of receipt or will tell you when it might take longer.
We are required to validate your identity including the identity of someone making a request on your behalf

Right to Object or Withdraw Consent

We collect, use, store and share your information because we are permitted to by law; in order to deliver your support your employment, but you do have a right to object to us doing this.

When we collect, use, store or share your information based on your consent, you have a right to withdraw that consent at any time.

Our Data Protection Officer will be happy to speak with you about any concerns you have.

Right to Correction

If information about you is incorrect, you are entitled to request that we correct it.

There may be occasions, where we are required by law to maintain the original information – our Data Protection Officer will talk to you about this and you may request that the information is not used during this time

We will respond to your request within one month of receipt or will tell you when it might take longer.

Right to Portability

You can ask us to send your information to another organisation on your behalf if you wish.

Complaints

You also have the right to make complaints and request investigations into the way your information is used. Please contact our Data Protection Officer or visit the link below for more information.

For more detailed information on your rights visit https://ico.org.uk/for-the-public/.

Does Norfolk Primary Care Use Profiling or Automated Decision Making?

No Norfolk Primary Care does not undertake automatic profiling or automated decision making in relation to your employment information.

Our Data Protection Officer will be happy to speak to you about this if you have concerns or objections.

How Does Norfolk Primary Care Protect My Information?

Norfolk Primary Care are committed to ensuring the security and confidentiality of your information. There are a number of ways we do this;

Staff receive regular training about protecting and using personal data
Policies are in place for staff to follow and are regularly reviewed
We check that only the minimum amount of data is shared or accessed
We use controlled access to systems, this helps to ensure that the right people are accessing data – people with a ‘need to know’
We use encrypted emails and storage which would make it difficult for someone to ‘intercept’ your information
We report and manage incidents to make sure we learn from them and improve
We put in place contracts that require providers and suppliers to protect your data as well
If you are registered at the practice, there is a risk that members of the team could see your health information. Whilst we take steps to reduce this risk, we cannot make guarantees. If you have particular concerns about colleagues seeing your records, you may wish to consider registering at a different practice.

How Long Does Norfolk Primary Care Store My Information?

Norfolk Primary Care will review your personnel record 6 years after you have left service. At this stage some items will be destroyed / summarised and then we will retain for according to the schedule below.

Record	Action at 6-year review	Next review and delete
Written particulars of employment and Contracts	Retain documents as part of summary	Aged 100
Job History – consolidated record of whole career and location details (paper or electronic)	Retain documents as part of summary	Aged 100
Current address details	Delete / Destroy	NA
Record of location of overseas service	Retain documents as part of summary	Aged 100
Variation of hours – calculation formula for individual	Delete / Destroy	NA
Promotion, temporary promotion and/or substitution documentation	Make summary note and delete / destroy associated documents	NA
Working Time Directive opt out forms	Delete / Destroy	NA
Record of previous service dates	Make summary note and delete / destroy associated documents	NA
Previous service supporting papers	Make summary note and delete / destroy associated documents	NA
Qualifications/references	Delete / Destroy	NA
Transfer documents (OGD E18)	Make summary note and delete / destroy associated documents	NA
Annual/Assessment reports or summary of performance marks where an open reporting system operates	Delete / Destroy	NA
Annual/Assessment reports for the last five years of service or summary of performance marks where an open reporting system operates	Retain documents as part of summary	Aged 100
Training history	Delete / Destroy	NA
Travel and subsistence – claims and authorisation	Delete / Destroy	NA
Annual leave records (dependent on departmental practice)	Delete / Destroy	NA
Job applications – internal	Delete / Destroy	NA
Recruitment, appointment and/or promotion board selection papers	Delete / Destroy	NA
Building society references	Delete / Destroy	NA
Health Declaration	Retain documents as part of summary	Aged 100
Health referrals, including: Medical reports from doctors and consultants	Retain documents as part of summary	Aged 100
Papers relating to any injury on duty	Retain documents as part of summary	Aged 100
Medical reports of those exposed to a substance hazardous to health	Retain documents as part of summary	Aged 100
Medical/Self Certificates – unrelated to industrial injury	Delete / Destroy	NA
Welfare papers	as long as it has been 6 years since last action – Delete / Destroy	NA
Security personnel files	Retain documents as part of summary	Aged 100
Bank details – current	Delete / Destroy	NA
Death Benefit Nomination and Revocation Forms	Retain documents as part of summary	Aged 100
Death certificates (original)	Send back to Provider	NA
Death Certificates (copy)	Retain documents as part of summary	Aged 100
Decree Absolutes (original)	Send back to Provider	NA
Decree Absolutes (copy)	Retain documents as part of summary	Aged 100
Housing advance	as long as it has been repaid – Delete / destroy	NA
Marriage certificate and documentation relating to civil registration (original)	Send back to Provider	NA
Marriage certificate and documentation relating to civil registration (copy)	Retain documents as part of summary	Aged 100
Unpaid leave periods (such as maternity leave)	Retain documents as part of summary	Aged 100
Statutory maternity pay documents	Delete / Destroy	NA
Other maternity pay documentation	Delete / Destroy	NA
Overpayment documentation	as long as it has been repaid – Delete / destroy	NA
Personal payroll history, including record of pay	Retain documents as part of summary	Aged 100
Pensions estimates and awards	Retain documents as part of summary	Aged 100
Pension Information	Retain documents as part of summary	Aged 100
Resignation, termination and/or retirement letters	Retain documents as part of summary	Aged 100
Pension and Pay
Added years (pension and pay)	Retain documents as part of summary	Aged 100
Additional Voluntary Contributions (AVC)	Retain documents as part of summary	Aged 100
Payroll input forms	Delete / Destroy	NA
Bonus nominations	Delete / Destroy	NA
Complete sick absence record showing dates and causes of sick leave	Retain documents as part of summary	Aged 72
Statutory Sick Pay (SSP) forms	Retain documents as part of summary	Aged 100
Papers relating to disciplinary action which has resulted in any changes to terms and conditions of service, salary, performance pay or allowances	Retain documents as part of summary	Aged 72
Authorisation for deputising, substitution allowance and/or overtime/travel time claim	Delete / Destroy	NA
Advances for: Season tickets Car parking Bicycles Christmas/holidays Housing	As long as it has been repaid – Delete / destroy	NA