Privacy Policy

Our Data Protection Officer is the Head of Risk and Assurance, Helen Jones, who is responsible for monitoring our compliance with data protection requirements. You can contact them with queries or concerns relating to the use of your personal data at YAS.DPO@nhs.net.

When you contact us as a patient to seek care, we collect personal information that is used directly for your care, and also to manage the services we provide, to clinically audit our services, investigate complaints, or to be used as evidence as part of an investigation into care. We may also record information about you if you contact us for any other reason, such as to apply for a job with us or work for us, or if you have made a complaint.

We also receive personal information about you indirectly from others, in the following scenarios:

• from other health and care organisations involved in your care so that we can provide you with care;
• from family members or carers to support your care.

Personal information

Personal information is any information that can be used to identify a living person. For example, an individual's name, email address, telephone number, or NHS number.

Below are some examples of personal information that we currently collect and use:

• personal identifiers and contacts (for example, name, address, phone number);
• photographic identity (photo ID) (for example, photographs of staff for ID badges or our website);

More sensitive information

We process the following more sensitive data (including special category data):

• data concerning physical or mental health;
• data revealing racial or ethnic origin;
• data concerning a person’s sex life;
• data concerning a person’s sexual orientation;
• genetic data;
• biometric data;
• data revealing political opinions [unlikely to apply];
• data revealing religious or philosophical beliefs;
• data revealing trade union membership [unlikely to apply];
• data relating to criminal or suspected criminal offences

We may share your information for health purposes and for your benefit with other organisations such as other NHS Trusts, General Practitioners, and other partner organisations who could be providing specialist services on our behalf.

YAS is signed up to the Leeds Care Record and the Yorkshire and Humber Care Record, virtual systems designed to give health and social care professionals access to the most up to date information about you.

You may be receiving care from other service providers as well as the NHS. If we have your permission, we may also share information about you so that you receive the best possible care with:

• Social Care Services;
• Education Services;
• Local Authorities;
• Voluntary and private sector providers working with the NHS.

Unless the sharing is specifically related to the direct provision of healthcare, we will not share your information with anyone without your explicit consent. However, there are some exceptions.

In some circumstances we are legally obliged to share information. This includes:

• when required by NHS England to develop national IT and data services;
• when registering births and deaths;
• when reporting some infectious diseases;
• when a court orders us to do so;
• where a public inquiry requires the information.

We will also share information if the public good outweighs your right to confidentiality. This could include:

• where a serious crime has been committed;
• where there are serious risks to the public or staff;
• to protect children or vulnerable adults.

The other instances when we may use your data are below:

• Support future improvements in health and social care nationally;
• Help teach health and social care professionals;
• Aid health research and developments*;
• Monitor and audit the care we provide to ensure it is of the highest standard;
• Investigate complaints, untoward incidents or legal processes;
• Prepare reports on NHS and social care performance;
• To ask you to complete a patient survey regarding your care; this is optional.

*If you do not want your personal information to be shared and used for research and planning, then you should contact the online service at www.nhs.uk/your-nhs-data-matters or call 0300 303 5678. For further information please see the national data opt out section below.

We participate in the Cabinet Office’s National Fraud Initiative: a data matching exercise to assist in the prevention and detection of fraud. We are required to provide particular sets of data to the Minister for the Cabinet Office for matching for each exercise.  We are legally obliged to provide this information and do not require your consent. For further information, please see our Privacy Notice – NFI.

The Trust will not transfer your personal data outside the UK unless there are arrangements in place to ensure an adequate level of protection for the rights and freedoms of data subjects.

Personal information

Under the UK General Data Protection Regulation (UK GDPR), the lawful bases’ we rely on for using personal information is:

(a) We have your consent - this must be freely given, specific, informed and unambiguous.

(b) We have a contractual obligation - between a person and a service.

(c) We have a legal obligation - the law requires us to do this. See this list for the most likely laws that apply when using and sharing information in health and care.

(e) We need it to perform a public task - a public body, such as an NHS organisation or Care Quality Commission (CQC) registered social care organisation, is required to undertake particular activities by law. See this list for the most likely laws that apply when using and sharing information in health and care.

(f) We have a legitimate interest (such as the health and safety of our staff).

Other - From time to time we may contact you and ask you to tell us about your experience of our service. We do this as part of our commitment to providing a service that is responsive to the needs of the patients and their families and carers. We may send you a paper survey in the post or call you on the telephone and ask if you would be willing to answer some questions. You can choose whether or not you want to take part in these surveys, and if you decide that you do not want to then this will not affect your care in any way.

More sensitive data

Under UK GDPR, the lawful bases’ we rely on for using information that is more sensitive (special category) is:

(b) We need it for employment, social security and social protection reasons (if authorised by law). See this list for the most likely laws that apply when using and sharing information in health and care.

(f) We need for a legal claim or the courts require it.

(g) There is a substantial public interest (with a basis in law). See this list for the most likely laws that apply when using and sharing information in health and care.

(h) To provide and manage health or social care (with a basis in law). See this list for the most likely laws that apply when using and sharing information in health and care.

(i) To manage public health (with a basis in law). See this list for the most likely laws that apply when using and sharing information in health and care.

(j) For Archiving, research and statistics (with a basis in law). See this list for the most likely laws that apply when using and sharing information in health and care.

Consent is rarely required for special category data in health and care.

Common law duty of confidentiality

In our use of health and care information, we satisfy the common law duty of confidentiality because:

• you have provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses);
• we have support from the Secretary of State for Health and Care following an application to the Confidentiality Advisory Group (CAG) who are satisfied that it isn’t possible or practical to seek consent;
• we have a legal requirement to collect, share and use the data;
• for specific individual cases, we have assessed that the public interest to share the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime). This will always be considered on a case-by-case basis, with careful assessment of whether it is appropriate to share the particular information, balanced against the public interest in maintaining a confidential health service.

Your information is securely stored for the time periods specified in the Trust’s Records Management Policy and the Records Management Code of Practice. We will then securely dispose of or archive your information as recommended by the Records Management Code and detailed in the Trust’s Records Management Policy.

Under Data Protection law you have rights including:

Your right of access - You have the right to ask us for copies of your personal information (known as a subject access request).

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at yas.subjectaccessrequests@nhs.net if you wish to make a request or make a written request to:

Legal Services Department
Yorkshire Ambulance Service NHS Trust
Headquarters
Springhill 2
Brindley Way
Wakefield 41 Business Park
Wakefield
WF2 0XQ

Profiling

The Trust occasionally uses psychometric tests to evaluate employment candidate’s psychological attributes, including personality traits, skills, motivations, and behaviours. These tests are designed to determine whether a candidate is a good fit for a specific role, and the Trust.

The information collected about you when you use health and care services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

• improving the quality and standards of care provided;
• research into the development of new treatments;
• preventing illness and diseases;
• monitoring safety;
• planning services.

This may only take place when there is a clear lawful basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential health and care information is only used like this when allowed by law.

Whenever possible data used for research and planning is anonymised, so that you cannot be identified and your confidential information is not accessed.

You have a choice about whether you want your confidential information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters.

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

How do I complain?

If you have any concerns about our use of your personal information, you can make a complaint to us at yas.dpo@nhs.net

Following this, if you are still unhappy with how we have used your data, you can then complain to the ICO.

The ICO’s address is:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Date of last review

January 2025. Next review due January 2026.