NHS Supply Chain HDS privacy information

Legal Information

Privacy Notice for Home Delivery Service Patients

DHL Supply Chain Limited operates the NHS Supply Chain Continence Home Delivery Service on behalf of the NHS Business Services Authority and has been given your personal data by your local healthcare provider (typically your local NHS trust) in order to provide you with this Home Delivery Service.

DHL Supply Chain Limited is committed to protecting the privacy and security of your personal information and the purpose of this notice is to make you aware of how we collect and use personal information about you during and after your relationship with us.

It is important that the personal information we hold about you is accurate and current. Therefore, please keep us informed if your personal information changes (such as address, contact details, etc.).

We will comply with data protection law which says that the personal information we hold must be:

  1. Used lawfully, fairly and in a transparent way;
  2. Collected only for valid purposes and not used in any way that is incompatible with those purposes;
  3. Relevant to the purposes we have told you about and limited only to those purposes;
  4. Accurate and kept up to date;
  5. Kept only as long as necessary for the purposes we have told you about;
  6. Kept securely.

The kind of information we hold about you

We collect information about you when your local healthcare provider (typically your local NHS trust) uses NHS Supply Chain to provide a continence home delivery service to you. We only collect information about you that is necessary in order to facilitate the provision of the service, which is typically the following information:

  • Personal contact details such as your title, name, date of birth, gender, addresses, telephone numbers;
  • Next of kin and emergency contact information;
  • NHS number;
  • Information about your use of our information and communications systems;
  • Your personal identification number (PIN) that allows you to use our telephone self service;
  • Any information provided in relation to your delivery;
  • Your electronic signature, when you confirm a delivery with our driver.

We also collect, store and use the following 'special categories' of more sensitive personal information:

  • Information about your race or ethnicity;
  • Information about your health, including your prescribed continence products.

We typically collect the information:

  • From another supplier of continence home delivery services used by your healthcare provider when that healthcare provider switches service provision from the supplier to the NHS Supply Chain Continence Home Delivery Service;
  • Directly from the healthcare provider
  • From a care home; and/or
  • From a nurse or clinical advisor.

How we will use information about you

We will only use your personal information when the law allows us to, for example, to allow us to provide the Home Delivery Service to you and to enable us to comply with legal obligations.

We will use your information:

• To organise and deliver your prescribed continence products to your residence;

• To provide a satisfactory service to you including:

  • Allowing you to activate a scheduled delivery by telephone self-service;
  • Helping us progress and respond to queries and feedback;
  • Keep you updated on changes to the home delivery service you receive;
  • Provide product samples to you on behalf of your healthcare assessor;

• To provide reports to your local healthcare provider as to how the delivery service we are providing is performing. This can include use of your gender and date of birth as they may need to report on product types and age of patients in their locality.

We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose. Some of the above grounds for processing will overlap and there may be several grounds which justify our use of your personal information.

We may also process information where we need to protect your interests (or someone else's interest) or where it is required in the public interest or for an official purpose.

Please note that we may process your personal information without your knowledge or consent, in compliance with the above rules, where this is required or permitted by law. We will not share your information for marketing purposes or with any other third party other than to provide the service contracted by your healthcare provider.

How we use particularly sensitive personal information

'Special categories' of particularly sensitive personal information require higher levels of protection. We may process special categories of personal information in the following circumstances:

  1. In limited circumstances, with your explicit written consent;
  2. Where we need to carry out our legal obligations (including to provide the home delivery service to you);
  3. In relation to legal claims;
  4. Where it is needed to protect your interests (or someone else's interests) and you are not capable of giving your consent, or where you have already made the information public.

We will use your sensitive personal information in the following ways:

  • We will use information about your ethnic origin to provide your healthcare provider with demographic data of users of the service in their locality
  • We use information about your health in order to provide you with the continence products.

Automated decision-making

We do not envisage that any decisions will be taken about you using automated means, however we will notify you in writing if this position changes.

Data sharing

We may have to share your data with third parties where it is required by law or where it is necessary to provide you and your healthcare provider with the home delivery service. However, we will not disclose your personal data unless we are satisfied that they are legally entitled to view the data. Where we do disclose your personal data, we require third parties to respect the security of your data and to treat it in accordance with the law.

Data security and retention

We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed.

We have put in place procedures to deal with any suspected data security breach and will notify you and any applicable regulator of a suspected breach where we are legally required to do so.

We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, accounting, or reporting requirements.

Once we are no longer contracted to provide the home delivery service to you we will retain and securely destroy your personal information in accordance with applicable laws.

Your rights in connection with personal information

Under certain circumstances, by law you have the right to:

  • Request access to your personal information (commonly known as a 'data subject access request'). This enables you to receive a copy of the personal information we hold about you and to check that we are lawfully processing it.
  • Request correction of the personal information that we hold about you.
  • Request the erasure of your personal information. This enables you to ask us to delete or remove personal information where there is no good reason for us continuing to process it.
  • Request the restriction of processing of your personal information. This enables you to ask us to suspend the processing of personal information about you, for example if you want us to establish its accuracy or the reason for processing it.
  • Request the transfer of your personal information to another party.

If you want to review, verify, correct or request erasure of your personal information, object to the processing of your personal data, or request that we transfer a copy of your personal information to another party, please contact Our Chief Information Officer (CIO) in writing (contact details below).

You will not have to pay a fee to access your personal information (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is clearly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

Chief Information Officer and Information Commissioner

We have appointed a Chief Information Officer (CIO) to oversee compliance with this privacy notice. If you have any questions about this privacy notice or how we handle your personal information, please contact Our Chief Information Officer (CIO).

You have the right to make a complaint at any time to the Information Commissioner's Office (ICO), the UK supervisory authority for data protection issues.

Changes to this privacy notice

This privacy notice may be updated at any time. If we do update it we will inform you of any changes when we make any substantial updates.

Company Details for Data Protection issues

Name and address of Group company:
FAO Company Secretary DHL Supply Chain Limited, Solstice House, 251 Midsummer Boulevard Milton Keynes, MK9 1EQ

Chief Information Officer To whom initial issues should be addressed
Chief Information Officer (CIO) UK & Ireland, Solstice House, 251 Midsummer Boulevard, Milton Keynes, MK9 1EQ

Competent supervisory authorities:
Information Commissioner Office, tel: 0303 123 1113 or https://www.gov.uk/data-protection/make-a-complaint

Delivering value to the NHS