Privacy Notice: Medicines Management (Medman) App
The Medicines Management (Medman) App is used by authorised staff at Yorkshire Ambulance Service NHS Trust (YAS) to support the safe management and accountability of medicines, including controlled drugs and prescription-only medicine (POM) pouches.
The App supports medicines stock management, pouch filling and checking, vehicle pouch checks, expiry checks, medicine recalls, controlled drug transactions and stock reconciliation. It records the staff involved in these activities to support patient safety, traceability, audit and governance.
Yorkshire Ambulance Service NHS Trust is the data controller for personal information processed through the App. This notice should be read alongside the Trust’s Privacy Policy.
We process personal information to provide the App and support the safe management of medicines as part of the Trust’s healthcare services. This includes:
- Authenticating users and providing access appropriate to their responsibilities.
- Recording who carries out, witnesses or confirms medicines transactions.
- Maintaining an audit trail of medicines issued, collected, used, returned or disposed of.
- Supporting pouch checks, stock reconciliation and the investigation of discrepancies or unaccounted medicines.
- Supporting expiry monitoring, medicine recalls and medicines safety investigations.
- Maintaining the security and operation of the App.
The lawful basis for processing information for these purposes is the performance of a task in the public interest under Article 6(1)(e) of the UK General Data Protection Regulation (UK GDPR).
The App processes information identifying staff who access the system or participate in medicines management activities. This includes:
- Staff names, user identifiers and login information.
- Access permissions.
- Records of actions taken, including the date and time.
- The identity of staff carrying out or witnessing a transaction.
- Witness confirmations and reasons recorded where a witness is unavailable.
These records support security, traceability, governance and accountability.
Where records contain information about a patient’s health or treatment, the additional condition is Article 9(2)(h), covering the provision of healthcare and the management of healthcare systems and services, together with the relevant requirements of the Data Protection Act 2018.
The App records medicines and transaction information such as:
- Medicine names, quantities, batch numbers and expiry dates.
- Pouch identifiers, contents, Red Tag status and medicine alerts.
- Relevant vehicles, stations, safes and recorded storage locations.
- Medicines issued, collected, administered, returned or disposed of.
- Stock checks, discrepancies and explanations entered by users.
- Actions associated with medicine recalls.
Medicines and stock information becomes personal information where it is linked to an identifiable member of staff or patient.
Where a medicines transaction relates to treatment provided to a patient, the record may include an incident reference and details of the medicine used, including the quantity and date and time.
An incident reference may allow authorised staff to link a transaction to the relevant patient care record. Such information is handled as confidential information.
The App uses the device’s camera to scan QR codes or barcodes to identify relevant pouches, vehicles, safes or medicines and to support witness confirmation.
Camera access supports these medicines management activities. It is not required for taking clinical photographs of patients. Any images that are captured, are processed on device to extract Barcode and QR data only, the raw image is never stored or shared.
The App can retain records locally on the device while awaiting synchronisation with Trust systems. This supports medicines management activities when a network connection is unavailable.
Information held on the device remains subject to the Trust’s information security and device management requirements.
Sharing your information
Information is available to authorised staff who need it for medicines management, patient safety, audit, governance, investigation or technical support.
Where necessary and lawful, relevant information may also be shared with healthcare providers involved in a patient’s care, regulatory bodies or other organisations responsible for investigating medicines safety concerns or meeting statutory requirements.
Any sharing must be limited to the information required for the relevant purpose and follow the Trust’s confidentiality and data protection requirements.
Further information is available in the Trust’s Privacy Notice – Staff and, where records relate to patient care, the Privacy Notice – Emergency Ambulance Service (999).
Security of your information
The Trust applies technical and organisational measures to protect personal information against loss, damage, unauthorised access or inappropriate use.
Access to Medman is restricted to authorised users. Records of user actions support the identification and review of medicines transactions and the investigation of concerns.
Staff must use the App and Trust devices in accordance with the Trust’s information governance, confidentiality and information security policies.
Records are retained in accordance with the Trust’s Records Management Policy and applicable retention schedules, taking account of the Records Management Code of Practice for Health and Social Care and relevant medicines legislation.
Retention periods depend on the type of record, including controlled drug records, medicines transaction records and staff audit logs. Records may be retained for longer where required for an investigation or legal proceedings.
