Thrive by Design Privacy Policy

Thrive by Design is a co-design, digital inclusion and innovation team hosted by Leeds and York Partnership NHS Foundation Trust. Our mission is to ensure that everyone benefits from digitally-enabled health and care. We work with like-minded partners from across sectors, systems and places to achieve impact and influence. Thrive by Design is a department within Leeds and York Partnership NHS Foundation Trust (LYPFT) and as such LYPFT is the Data Controller organisation as a legal entity.

Our contact details 

Name: Thrive by Design 

Address: Leeds and York Partnership NHS Foundation Trust Headquarters, St Mary’s House, Main House, St Mary’s Road, Leeds, LS7 3JX

E-mail: thrivebydesign.lypft@nhs.net

Our Data Protection Officer 

Name: Carl Starbuck 

Address: Leeds and York Partnership NHS Foundation Trust, 1st Floor, North Wing, St Marys House,
St Martins View, Leeds LS7 3LA

Email: Carl.Starbuck@nhs.net

The types of personal information we collect 

We currently collect and process the following information:

  • Personal identifiers, contacts and characteristics (for example, name and contact details)

  • Information relating to your job role and place of work (for example, job title, organisation name, or the region you work within) 

  • Online identifiers (for example, social media account handles)

  • Special categories of data (for example, race, ethnic origin, health data or sexual orientation) please note that special category data is only collected and stored in relation to, and for the life cycle of a relevant project, such as our work around health inequalities or for equality and diversity monitoring or where we are legally obliged to do so 

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

  • You have an interest in the work we undertake and complete one of our surveys for which there are follow up communications and outputs, or we need to evaluate data on respondents  

  • You have an interest in our work and sign-up to attend a workshop, learning programme or event that we are hosting which we will need to communicate with you about, and other future, relevant or related activity 

  • You have an interest in the work we do and sign-up to our communications for us to be able to communicate relevant information with you 

  • You take part in research work that we are undertaking and provide us with the information that we request which you consent to us then processing in relation to that work 

  • You register your interest in a workshop, learning programme or event that we are planning to facilitate where we need to ensure that we recruit a diverse group of participants 

  • You are taking part in activities with us and we need to collect special category data in order to comply with equality and diversity monitoring

We may also receive personal information indirectly, for example, from the following sources in the following scenarios:

  • National healthcare bodies who have commissioned us to deliver a project or piece of work and where we would need specific data in order to deliver it 

  • Local healthcare providers who have commissioned us to deliver a project or piece of work and where we would need specific data in order to deliver it 

  • Partner organisations who we are working with collaboratively and where they might need to share data they control with us in order for us to jointly deliver the piece of work or project 

We use the information that you have given us in order to:

  • Communicate with you

  • Inform the delivery of our projects and services 

  • Support the delivery of local healthcare initiatives 

  • Keep accurate records of our stakeholders 

  • Complete equality and diversity monitoring 

We may share this information with: 

  • National healthcare bodies 

  • Local healthcare providers 

  • Partner organisations 

  • Organisations commissioned to deliver part of a project or specific piece of work relating to a project 

In all instances it would be made clear if the data being collected would be shared with an organisation other than our own, who that organisation would be, how it would be used and how long they would have access to it for. 

Under the Data Protection Act and the UK General Data Protection Regulation (UK-GDPR) Article 6(1), the lawful bases we rely on for processing personal data are: 

6(1) a - Your consent you are able to withdraw your consent at any time. You can do this by contacting thrivebydesign.lypft@nhs.net for the attention of Alison Braithwaite 

6(1) b - You have a contractual obligation you have entered into a contract with us

6(1) c - Legal obligation for example, equality and diversity monitoring 

6(1) e - We need it to perform a public task this would apply if commissioned by a public body e.g. NHS England and Improvement 

 6(1) f - We have a legitimate interest our legitimate interests are described above and throughout, for example, we may want to get in touch with you to update you on the progress or development of work areas you have previously been involved in or to highlight new opportunities that match your interests. We will only use your data in ways you would reasonably expect and limit the impact on your privacy 

Under the Data Protection Act and UK General Data Protection Regulation (UK-GDPR) Article 9(2), the lawful bases we rely on for processing special category personal data are:

9(2) a – Your explicit consent you are able to withdraw your consent at any time. You can do this by contacting thrivebydesign.lypft@nhs.net for the attention of Alison Braithwaite

9(2) b - Employment, social security and social protection (if authorised by law) this basis is applicable for our own employees and anyone we might employ on a temporary basis to contribute to a project where we want to include living experience into the co-design process and compensate them financially for their time, for example a peer consultant. 

9(2) g - Reasons of substantial public interest (with a basis in law) the only reasons of substantial public interest we would rely on as set out in paragraphs 6 to 28 of Schedule 1 of the DPA 2018 are:
8. Equality of opportunity or treatment
9. Racial and ethnic diversity at senior levels
16. Support for individuals with a particular disability or medical condition
18. Safeguarding of children and individuals at risk

9(2) h - Health or social care (with a basis in law) mainly Data Protection Act 2018 schedule 1 special categories of personal data and criminal convictions etc. data part 1 conditions relating to employment, health and research etc. health and social care purposes 2(1) and 2(2) (d) the provision of health care or treatment, (e) the provision of social care, or (f) the management of health care systems or services or social care systems or services.

How we store your personal information 

Your information is stored on our Google Drive (GDrive) which is only accessible to our core team. Data processing on the G-Drive takes place within the European Economic Area (EEA). We also store information on an LYPFT S-Drive that only our core team have access to which is processed in the UK. Any special category data collected as part of a specific project or piece of work will only be available to that specific project group team members.   

We keep special category data collected as part of a specific project or piece of work for the lifecycle of that project or work and in line with the NHS Records Management Code of Practice (2021). We will then dispose of your information by permanently deleting it from our server and by destroying any paper records in confidential waste.

Personal but not special category data collected may be kept for a period of up to 24 months in order for us to communicate with you about outcomes of the activity you have been involved with or to make you aware of future activity that may be relevant to you or the organisation you work for. You will have the option to update your preferences and opt out of our database in all communications we share.

Your Data Protection Rights

Under data protection law, you have rights including:

  • Your right to be informed - This privacy policy and subsequent privacy notices aim to do this 

  • Your right of access - You have the right to ask us for copies of your personal information. 

  • Your right to rectification - You have the right to ask us to rectify personal information which is factually inaccurate. You also have the right to ask us to complete information you think is incomplete. 

  • Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances, e.g. if you withdraw your consent. 

  • Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances. 

  • Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances, e.g. if you withdraw your consent.

  • Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at thrivebydesign.lypft@nhs.net or write to us at Leeds and York Partnership NHS Foundation Trust Headquarters, St Mary’s House, Main House, St Mary’s Road, Leeds, LS7 3JX both for the attention of Alison Brathwaite if you wish to exercise these rights. 

How to complain

In the first instance if you have any concerns about our use of your personal information, you can make a complaint to us at thrivebydesign.lypft@nhs.net or write to us at Leeds and York Partnership NHS Foundation Trust Headquarters, St Mary’s House, Main House, St Mary’s Road, Leeds, LS7 3JX both for the attention of Alison Braithwaite.

If you are unsatisfied with your response, you can also complain to our host Trust’s Data Protection Officer, please contact Carl Starbuck at Leeds and York Partnership NHS Foundation Trust:

Name: Carl Starbuck 

Address: Leeds and York Partnership NHS Foundation Trust, 1st Floor, North Wing, St Marys House, St Martins View, Leeds LS7 3LA

Email: Carl.Starbuck@nhs.net

Finally, you can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Helpline number: 0303 123 1113

ICO website: https://www.ico.org.uk

Last review date: 30 September 2022