The information collected by this clinic
Whenever you attend a sexual health or HIV clinic, your health practitioner will record information about your sexual history, sexual health concerns and any treatments you receive.
This is standard medical practice that allows the health practitioner to give you the best individual care at that time and for any future visits.
The information recorded about the services you receive from the sexual health clinic will not be shared with others caring for you outside the dedicated sexual health service unless you give your explicit consent. For example, the information would not be shared with your GP or hospital consultant. Explicit consent is a very clear and specific statement or indication of your wishes. It can be given in writing, for example by signing a declaration, or verbally.
You can choose to register at sexual health clinics under an alias. However, this is not encouraged - you can be assured that your sexual health record will not be connected to your other NHS records. We encourage you to use your real name, because you are more likely to remember it as the name you registered with us if you seek care at later date, this helps us keep track of your medical history for safest care.
Protecting others
If you are diagnosed with HIV or another STI, you may be asked to inform other people who are at risk. For example, people who you have recently had sex with, so they can get tested and treated as needed. If you do not wish to inform other people yourself, those caring for you may offer to do this on your behalf with your consent. For example those caring for you may be able to notify a person that they have recently been in contact with someone who has tested positive for an STI and that they should get tested. This may help to preserve your anonymity. However, if you do not consent to any affected people being informed, the care team, where they hold contact details for those affected, may need to inform them without your consent. Any decision to inform a person without your consent is not taken lightly. The care team looking after you must be convinced that other people, for example a partner or someone you have recently had sex with, are at risk of serious harm before informing them. It is best practice for the care team to notify you of any information they have shared, unless there is a valid reason not to for example if it would impact a criminal investigation.
Other uses of information beyond your individual care
Research and planning: Information relating to HIV and STIs is important for research and planning, for example to research new treatments. Whenever possible, data used for research and planning is anonymised so that you cannot be identified. You cannot opt out of anonymous information being used for research.
If identifiable information is required, then you will usually be asked for your explicit consent. If it is not possible to seek your consent, special approvals are required, and these are managed by the Health Research Authority. You can read more about special approvals and the safeguards in place on the Understanding Patient Data website by scrolling down to the ‘What organisations are involved?’ section and looking under the ‘Health Research Authority’ tab. Even if a research programme has received special approval, you can still opt out of your identifiable data being used: either by opting out of an individual piece of research when you are informed about it or by opting out of your information being used for research and planning via the NHS website.
UK Health Security Agency: HIV and STI data, which does not include information that could be used to identify you, is shared securely with the UK Health Security Agency (UKHSA). This helps experts understand trends, for example numbers of people being tested for HIV and other STIs, and whether the number of new diagnoses is increasing or decreasing. The UKHSA also aims to detect possible outbreaks of disease and epidemics as rapidly as possible.
Infectious diseases: It is the law that all medical staff in England, including those working in dedicated sexual health services, must inform the UKHSA if you have one of the infectious diseases listed here. The diagnoses that a dedicated sexual health service would report to the UKHSA include hepatitis A, hepatitis B, hepatitis C, dysentery and mpox. The report from medical staff to the UKHSA may include information which identifies you but only relevant clinical information for health protection purposes, for example your name, address, when you started to have symptoms and the date of diagnosis. Staff will normally inform you if they need to submit a report.
Information required by law: There are times when a healthcare organisation must share information because they are required to do so by law, for example where there is a court order. Where information is required by law you cannot object to the information sharing.
The information collected by UKHSA
The UK Health Security Agency (UKHSA) is responsible for protecting the nation from infectious diseases and other threats to public health.
UKHSA’s responsibilities include collecting information on sexually transmitted infections (STIs) and human immunodeficiency virus (HIV) from all sexual health and HIV clinics and laboratories.
UKHSA collects information from this clinic.
The information collected is in a de-personalised form, which means it does not include any information that could be used to identify you. For example, your name and contact details are not shared with UKHSA.
This is to protect your confidentiality.
The information about STIs and HIV that UKHSA collects from this clinic is used to help improve the nation’s sexual health and wellbeing, to understand more about people’s access to sexual health and HIV services, and to monitor any outbreaks of STIs and HIV.
You can find out more about UKHSA’s sexual health information collections on GOV.UK.
What is the legal basis for processing your data?
Under the UK GDPR we cannot process / use your personal data without a legal basis. We must identify the appropriate legal basis depending on how we are using your data.
The UK GDPR details 6 legal bases (Article 6) for processing personal data:
A - Consent
B - Contract
C - Legal obligation
D - Vital interests
E - Public task
F - Legitimate interests
Where special category data is processed we must also applied a legal condition from Article 9, special category data in the Trust’s case is Health data:
A - Explicit consent
B - Employment, social security and social protection (if authorised by law)
C - Vital interests
D - Not-for-profit bodies
E - Made public by the data subject
F - Legal claims or judicial acts
G - Reasons of substantial public interest (with a basis in law)
H - Health or social care (with a basis in law)
I - Public health (with a basis in law)
J - Archiving, research and statistics (with a basis in law)
For the majority of our processing we rely on explicit consent to process your personal data at the sexual health clinic, this means we apply the following legal basis:
Article 6 (A) and Article 9 (A).
We do not need a legal basis where we have anonymised your personal data.
More information on legal bases can be found here on the ICO’s website.
How long do we keep your personal data for?
Whenever we collect or process your data, we will only keep it for as long as is necessary for the purpose it was collected. In the NHS, all providers and commissioners apply retention schedules in accordance with the Records Management Code of Practice (refer to Link section below). This code is based on current legal requirements and professional best practice and sets the required standard of practice in the management of records for those who work within or contract to NHS organisations in England.
For healthcare purposes, and particularly mental health and children and young people's health records, these records need to be kept for long periods of time and remain available to access. Consequently, it is unlikely that a record or information contained in the record will be erased or deleted if such a request is made.
Following the retention period, the record will be fully reviewed and confidentially destroyed if it is deemed appropriate.
Destruction
Destruction of data will only happen following a “review” of the information at the end of its retention period. Where data has been identified for disposal we have the following responsibilities:
- To ensure that information held in manual form (regardless of whether originally or printed from the IT systems) is destroyed using a cross cut shredder or subcontracted to a reputable confidential waste company (as identified in the table below) that complies with European Standard EN15713.
- To ensure that electronic storage media used to hold or process information are destroyed or overwritten to current national cyber security standards.
- To ensure that any arrangement made to sub-contract secure disposal services from another provider, complies with the NHS Standard Contract and with assurance that the sub-contractor's organisational and technical security measures comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.