Privacy

Care Information Scotland (CIS) Privacy Policy

This policy is available in other languages.

Care Information Scotland (careinfoscotland.scot) is owned and operated by NHS 24 on behalf of NHS Scotland and the Scottish Government.

NHS 24 are committed to ensuring privacy is protected and that users can be assured that any data will only be used in accordance with the privacy requirements outlined in this policy.

This policy outlines:

• what data we collect about you when you access this website or the Care Information Scotland helpline
• how we collect this data
• how we store this data securely
• who we share it with
• how you can access it

Data protection and security

For the purposes of the data protection legislation, NHS 24 are data controllers for personal data collected, stored and shared by Care Information Scotland.  Our registration number is Z8707451.

Read our Data Protection Notice

Compliance

This policy is compliant with the relevant data protection legislation and we’re committed to compliance procedures that demonstrate this.

Data collection

The types of data we collect will depend on how you access and use this website or the Care Information Scotland helpline.

Care Information Scotland deals with personal and special category (sensitive) data as classified under the relevant data protection legislation such as the UK General Data Protection Regulations (UK GDPR) and the Data Protection Act 2018.

Processing your information

NHS 24 processes your information under a legal basis defined in the data protection legislation. NHS 24 considers there are several legal bases such as:

• the use of your personal data is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in us
• processing is necessary in order to protect the vital interests of the data subject or of another natural person

When we use more sensitive ‘special category’ types of personal information which includes health information then our legal basis is usually that the use is necessary for the provision of health or social care or treatment or the management of health or social care systems and services, amongst others. Where it is deemed appropriate NHS 24 will share all relevant information with the appropriate organisations.

Storing and sharing your data

Any data we collect is stored securely in accordance with NHS Scotland standards.

This data will be kept no longer than is necessary and reasonable to do so. After this period, the data will be deleted.

Webchat

To help our team respond to your webchat request, we’ll ask you to provide your name.

After your session you will also have the option to give feedback on your experience.

The webchat function is hosted in the US.

These transcripts:

• are deleted in line with the retention period as detailed in the NHS 24 Records retention schedule
• only contain the minimum amount of personal information that you have given us to allow us to provide the associated service

Find out more about how we manage the data collected by cookies

Audio recording of calls

All calls will be recorded.

Call monitoring

Occasionally, calls may be monitored for the purpose of development and training of Care Information Scotland Advisors. The call may be reviewed as a means to give feedback on the call and support the advisor. We do this to make sure all CIS calls are safe, appropriate and in the interests of callers.

What information is collected?

Care Information Scotland is through NHS 24’s funding from the Scottish Government and as part of our work we collect some information during calls and webchats. We will not collect any personal information that identifies who you are but we may record some information we come to know through the course of the conversation (such as your age, gender, sexuality, beliefs, ethnicity etc).

What is the information used for?

We use this information to learn about whether we reach all groups in Scotland, or whether some groups are excluded; something we work very hard to avoid. We will record something about what your call was about so that we know the types of things people want to talk to us about.

We also use the information to help plan our service in future. This includes being able to train our staff and being open to people about the type of calls and webchats we get.

Loss and misuse of data

We take appropriate technical and organisational precautions to prevent the loss, misuse or alteration of your personal data.

Data security

As Care Information Scotland is delivered through NHS Scotland, we adhere to all data security standards and protocols that apply to the NHS in Scotland.

In addition, all systems that operate as part of Care Information Scotland have had a detailed system security policy assessment in line with nationally recommended standards. The outcomes of this assessment were accredited by the Scottish Government eHealth team.

Read our Data Protection Notice

Disclosure checks

At NHS 24, all health professionals who handle personal data undergo Disclosure Scotland checks prior to employment.

Sharing your data

Any data we collect will only be shared for the purpose of:

• investigating and responding to enquiries
• monitoring the performance of the service

Questions

Any further privacy or data protection enquiries should be directed to:

The Data Protection Officer

Aurora House

3 Aurora Avenue

Clydebank

G81 1BF