Skip to main content

Patient Data

An image of Swansea Bay UHB logos.

Privacy Notice

Information for patients and service users about how Swansea Bay University Health Board uses personal information

For privacy information specifically for children in Welsh and English, please follow the links below: 

To watch Swansea Bay UHB's Children's Privacy Notice in Welsh, please follow this link to YouTube.

To watch Swansea Bay UHB's Children's Privacy Notice in English, please follow this link to YouTube.

Swansea Bay University Health Board aims to be open and transparent about the way we collect and use your personal information. This privacy notice will inform you about how personal information is used by us. The Health Board uses a layered approach to providing privacy information and you may be provided with additional, more detailed, privacy information when you engage with specific services.

Contact details of the Health Board

Our Headquarters is based at:

Swansea Bay Headquarters

1 Talbot Gateway,

Baglan Energy Park,

Baglan,

Port Talbot,

SA12 7BR

If you have any concerns about the way your personal information has been handled by the Health Board you can contact the Data Protection Officer at the above address, or by e-mail as outlined below:

Email: sbu.dataprotectionofficer@wales.nhs.uk      

If you wish to make a request in respect of your health record (see below your rights in relation to your personal information) you can contact the Access to Health Records Team by email as outlined below:

Email: accesstorecords@wales.nhs.uk

As a public authority, we must comply with all relevant legislation relating to information handling. The Information Commissioner's Office (ICO) is the supervisory authority in the United Kingdom established to ensure that information rights are upheld. Further information about how your information is used can be found by following this link to the Information Commissioner's Office website.

Why do we collect and process personal information?

Obtaining, recording, holding and dealing with personal information is known as 'processing'. In order for Swansea Bay University Health Board to perform its official functions as an NHS body we must process personal and special category information about you. We are legally able to do this under section 1(e) of Article 6, and sections 2(h) and 2(i) of Article 9 of the UK General Data Protection Regulation (UK-GDPR).

There will be occasions when we will rely on other lawful reasons. For example, where we are required to process information in order to comply with the law, or where you have provided us with consent to do so. We will always ensure that we have a lawful reason to process your information in line with data protection legislation.

Your Health Record

As an NHS organisation, the main reason we collect and process your personal information is for the provision of heath care services. These may include, but are not limited to:

  • Providing a medical diagnosis;
  • Providing health or social care services and treatment;
  • Providing health and well-being advice and support;
  • To support the management of health or social care services and systems;
  • For public health purposes.

Your personal information will be collected from a number of sources. For example, you may provide information directly to us, it may be provided by members of your family, or included within referrals received from your GP or other organisations.

Your personal information will be recorded within your health record, supplementary records, and within electronic Health Board systems and applications. We will use the information we hold to contact you about appointments and health-related communications. This may include by letter, telephone and text message. We will occasionally record telephone calls for the purposes of training and service provision. Please ensure that you keep us informed of any changes to your contact details to ensure our records remain accurate and up to date.

As a Welsh resident, should you ever receive treatment by an NHS care provider in England, the information they hold about you will be shared back into NHS Wales in order to update your Health Record locally. That information will be used by the Health Board to record and validate what care was provided to you.

How long will we keep personal information?

We will not keep personal information for longer than is required. Personal information will be anonymised when it is no longer needed in an identifiable format. We will store personal information in line with current NHS Wales retention guidelines.

Sharing your personal information

There are some situations that will require us to share the personal information we hold about you with other individuals and/or organisations. We will routinely share your personal information between departments within the Health Board to ensure we provide the best care possible to you.

There are occasions when your personal information might be shared with other health and social care providers, especially where your care is delivered by a Multi-disciplinary Team (MDT). Examples of this include within Mental Health or Community-based services where we partner with independent providers or Local Authority Social Services.

We may share your personal information with your nominated Health Insurance Company if there is a requirement for you to pay for elements of your health care.

We will share your personal information when we have a legal obligation to do so. This will include with the Police, Local Authorities, Government Departments, other Public or Regulatory Bodies, Legal Professionals, and the Information Commissioner’s Office.

Students and Trainees

It is really important that the Welsh NHS is able to train new medical, nursing and other healthcare professionals in order to ensure there are adequate staff to provide vital services, and for strategic planning going forward. Within Swansea Bay University Health Board, medical, nursing and other healthcare students will have access to patient information as this forms an integral part of their training placements / supervised duties. There may also be instances where certain healthcare apprentices or vocational trainees will have access to patient information as part of their placements.

Health & Care Research and Service Evaluation

All NHS organisations are expected to participate and support health and care research. We use personal information to conduct health and care research in order to improve healthcare and our services. The type of personal information we collect will be specific to the nature and requirements of the research projects we are undertaking and will be anonymised where this is necessary. However, we will ensure that the information we use is relevant to the objectives of these research projects. We aim to conduct Health & Care research and Service Evaluation to the highest standards of research integrity. Our research is underpinned by policies and procedures that ensure we comply with regulations and legislation that govern the conduct of research; this includes information protection legislation.

Closed Circuit Television (CCTV) and Surveillance systems

CCTV and other surveillance systems (such as Body-worn Video) can be used to monitor a wide variety of locations, and aid in the deterrence of crime and other incidents. CCTV has become part of modern life and is an expected feature in public buildings and areas. The primary purpose of CCTV at Swansea Bay University Health Board is to protect patients, visitors, staff and Health Board property, by providing a visible deterrent and secure environment. Health Board premises are classified as public areas. As such patients, staff and members of the public can expect to be the subject of CCTV surveillance whilst on our premises, but also rightly expect such surveillance to be both necessary and proportionate, with appropriate safeguards in place. Visible signage will always be displayed where CCTV surveillance is routinely undertaken.

Your rights in relation to your personal information

Under information protection legislation, you have rights in relation to your personal information that we need to make you aware of. Which of these rights are available to you will depend on what our legal reason for processing your information is:

  • Your right of access;
  • Your right to rectification;
  • Your right to erasure;
  • Your right to restriction of processing;
  • Your right to object to processing;
  • Your right to information portability.

You are not required to pay any charge for exercising your rights. We usually have one month in which to respond to you.

You also have the right to lodge a complaint with the Information Commissioner’s Office. However, we ask that you raise any data protections concerns with the Data Protection Officer (details above) in the first instance who will try to facilitate a resolution. If you remain dissatisfied, the ICO can be contacted using the details provided below:

Information Commissioner’s Office – Wales

2nd Floor, Churchill House

Churchill Way

Cardiff

CF10 2HH

Tel: 0330 414 6421

Email: wales@ico.org.uk

Online, live-chat: You can live-chat by following this link to the Personal information - concerns page on the Information Commissioner's Office website.

Helpline: 0303 123 1113

Rydym yn croesawu gohebiaeth a galwadau ffôn yn y Gymraeg neu'r Saesneg. Atebir gohebiaeth Gymraeg yn y Gymraeg, ac ni fydd hyn yn arwain at oedi. Mae’r dudalen hon ar gael yn Gymraeg drwy bwyso’r botwm ar y dde ar frig y dudalen.

We welcome correspondence and telephone calls in Welsh or English. Welsh language correspondence will be replied to in Welsh, and this will not lead to a delay. This page is available in Welsh by clicking ‘Cymraeg’ at the top right of this page.