The Data Protection legislation requires us to process your personal data fairly and lawfully.

We take our duty to protect your personal information and confidentiality very seriously, and we are committed to taking all reasonable measures to ensure the confidentiality and security of personal data for which we are responsible.

You can find more detail below or by reading our Privacy Notice leaflet.

Read our Privacy Notice for Employees.

Read our Supplementary Privacy Notice on COVID-19 for Patients/Service Users

This policy sets out how The Cheshire and Wirral Partnership NHS Foundation Trust (CWP) processes and stores personal information relating to our patients and users of our websites.


The information held in your health record is important for your care. It is a record of your relationship with those caring for you. This relationship is based on mutual trust and confidence and we continue to do everything possible to protect that trust. Staff will ask for information about you and this policy will explain what information is collected and the reasons why it is needed.

Contacting us


If you would like to know more about information we hold, or wish to make a complaint about the use of your information, you can contact:

Alternatively, you can contact the Information Commissioner’s Office at the following address:

Information Commissioner’s Office
Wycliffe House
Water Lane

Telephone number: 0303 123 1113

Health and social care professionals working with you (such as doctors, nurses, support workers, psychologists, occupational therapists, social workers and other staff involved in your care) keep records about you, your health, and any care and treatment you are offered or receive. This may include: 

  • Name, address, date of birth, phone number, and email address (where you have provided it to enable us to communicate with you)
  • Your next of kin and contact details
  • Notes and reports about your physical or mental health and any treatment, care or support you need and receive
  • Results of your tests and diagnosis, including medical imaging
  • Relevant information from other professionals, relatives, or those who care for you or know you well
  • Any contacts you have with us such as home visits or outpatient appointments
  • Information on medicines, side effects and allergies
  • Patient experience feedback and treatment outcome information you provide.

Most of your records are electronic and are held on a computer system and secure IT network. New models of service delivery are being implemented, with closer working with GPs and other healthcare and social care providers. To assist this, other electronic patient record systems to share your information will be used. At the relevant point you will be given the opportunity to say no and to opt-out of having your information held on these systems. Should you choose to opt-in, please note that at any point afterwards you can change your mind and opt-out by informing your GP and/or relevant health professional involved in your care.

To ensure safe and secure services the Trust operates closed circuit television systems in some areas of the Trust. 

Data protection law recognises the difference between personal data and that of a more sensitive nature such as racial or ethnic origin, political opinions, religious beliefs, trade union activities, physical or mental health, sexual life, or details of criminal offences. 

GDPR adds a special data category of genetic data and biometric data that is processed to uniquely identify an individual. 

As a healthcare organisation, CWP will therefore collect sensitive data as defined above. For example:

  • When submitting a referral request
  • When submitting your story to be considered as case study 

However we do not solely collect healthcare information. Other information will include religious information, for example to make us aware of dietary requirements or limits to treatment, or philosophical beliefs, for example for patients who are vegan and therefore have requirements regarding particular medicines. 

Every day we are working to ensure that our staff provide inclusive services to all patients, which meet their needs and are delivered with kindness, dignity and respect, irrespective of any equality characteristic such as gender, race, religion or disability status. We also want to ensure that all our staff are treated similarly with kindness, dignity and respect. Staff and patient surveys are a key mechanism in helping us achieve this as we carefully consider their experiences and feedback to help shape our policies and culture. An equality monitoring form is also sent with all complaint acknowledgements to advise the Trust on this important area. As such, we gather, analyse, report and monitor our workforce and patients equality data by protected characteristics.

It is important that the details you provided are accurate and you let us know of any changes, for example, if you change your address or GP. Information collected about you to deliver your health care is also used to assist with:

  • Making sure your care is of a high standard
  • Using statistical information to look after the health and wellbeing of the general public and planning services to meet the needs of the population
  • Assessing your condition against a set of risk criteria to ensure you are receiving the best possible care
  • Preparing statistics on our performance for the Department of Health and other regulatory bodies
  • Helping train staff and support research
  • Supporting the funding of your care
  • Reporting and investigation of complaints, claims and untoward incidents
  • Reporting events to the appropriate authorities when we are required to do so by law
  • Contacting you to improve services e.g. to take part in surveys or consultations about our services

Our staff are trained to handle your information correctly and protect your privacy. We aim to maintain high standards, adopt best practice for our record keeping and regularly check and report on how we are doing. Your information is never collected for direct marketing purposes, and is not sold to any third parties. Your information is not routinely processed overseas, and if it is, we undertake to inform you. Care may be provided by a care team which may include people from other organisations such as health, social care, education, or other care organisations. Local hospitals, GPs and Social Services in some areas are able to view a summary electronic record.

This Trust shares summary information with health and social care professionals in some areas e.g. Cheshire Care Record, Physical Health and GPs. Access to these systems are very tightly controlled and monitored. Further information for the Cheshire Care Record may be found on the Cheshire Care Record website.

Locally across Cheshire and Merseyside, data is being shared securely with a data processor called System C for the purposes of protecting public health, providing healthcare services to the public, planning health care services and monitoring and managing Covid 19 outbreaks. No data that identifies a person will be used for purposes other than direct care.

If you have previously opted out of data sharing your data will not be used. The overarching purpose for data sharing is to support a set of Population Health analytics for population level planning and improvement of outcomes and also the targeting of direct care to vulnerable populations in need.

If we need to use your personal information for any reason beyond those stated above, we will discuss this with you. You have the right to ask us not to use your information in this way. However, there are exceptions to this which are listed below:

The public interest is thought to be of greater importance, e.g;

  • If a serious crime has been committed

  • If there are risks to the public or our staff

  • To protect vulnerable children or adults

  • We have a legal duty, for example registering births, reporting some infectious diseases, wounding by firearms and Court Orders.

  • We need to use the information for medical research. We have to ask permission from the Confidentiality Advisory Group (appointed by the NHS Health Research Authority)

Health records are stored on computers and in paper files and we have a legal duty to keep these confidential, accurate and secure at all times in line with Data Protection laws.

The legal basis for the processing of data for these purposes is that the NHS is an official authority with a public duty to care for its patients, as guided by the Department of Health and Data Protection law which says it is appropriate to do so for health and social care treatment of patients, and the management of health or social care systems or services.

Information is held for specified periods of time as set out in the Records Management Code of Practice for Health and Social Care.

Data Protection law gives individuals rights in respect of the personal information that we hold about you. These are:

  1. To be informed why, where and how we use your information.

  2. To ask for access to your information.

  3. To ask for your information to be corrected if inaccurate or incomplete.

  4. To ask for your information to be deleted or removed where there is no need for us to continue processing it.

  5. To ask us to restrict the use of your information.

  6. To ask us to copy or transfer your information from one IT system to another in a safe and secure way, without impacting the quality of the information.

  7. To object to how your information is used.

  8. To challenge any decisions made without human intervention (automated decision making).

We aim to work with you on any request, complaint or question you have about your personal information. However, if you believe we have not adequately resolved a matter, you have the right, at any time, to complain to the Information Commissioner’s Officer (ICO).

As an independent UK authority, the ICO upholds information rights in the public interest, promotes openness by public bodies and data privacy for individuals. You can visit the ICO website for details.

Accessing your health records

To request copies of your personal information, please contact the subject access request team:

You have had the right to receive copies of letters about you. However, letters may be withheld if it is thought it may be detrimental for you to receive a copy. If the Trust holds your email address, communication may be emailed unless you wish to opt out of receiving emails. The Trust cannot guarantee the security of emails.

Freedom of Information Act 2000 (FOI)

The FOI Act allows the public to request general information which the Trust holds such as policies or minutes of meetings. To make a request, email or write to the Trust.

When you visit our website, you may provide us with personal information such as:

  • Your name
  • Your contact details
  • Your date of birth
  • Your gender
  • Your credit/debit card details
  • Your job title
  • Your employment history
  • Information on your usage of our website

Here are some examples of when you can provide us with personal information on this website:

  • When contacting us with an enquiry either via webform or email link
  • When signing up to a newsletter
  • When purchasing an event ticket
  • When giving feedback
  • When filling out a form
  • When you apply for a job with us

Cookies are small text files that are placed on your computer by websites that you visit. They are widely used in order to make websites work, or work more efficiently, as well as to provide information to the owners of the site.

You have the choice to reject these cookies by clicking "Deny" on the pop up. This will disable any cookies, such as google analytics. However, some features on the site may not work as expected. For example, if you hide the Accessibility toolbar, this will not be remembered and it will continue to pop up on each page. In addition, the Google Translate toolbar at the top of the page will not be displayed.

Cookies are used minimally on this website for site usage analytics. In order to help us to improve the content, format and structure of this website we record and analyse how visitors use the website. For this purpose, we use Google Analytics.

Google Analytics is a web analytics service provided by Google, Inc. ("Google"). Google Analytics uses "cookies", which are text files placed on your computer, to help the website analyze how users use the site. The information generated by the cookie about your use of the website (including your IP address) will be transmitted to and stored by Google on servers in the United States. Google will use this information for the purpose of evaluating your use of the website, compiling reports on website activity for website operators and providing other services relating to website activity and internet usage. Google may also transfer this information to third parties where required to do so by law, or where such third parties process the information on Google's behalf. Google will not associate your IP address with any other data held by Google. You may refuse the use of cookies by selecting the appropriate settings on your browser, however please note that if you do this you may not be able to use the full functionality of this website. By using this website, you consent to the processing of data about you by Google in the manner and for the purposes set out above.

We do not make any attempt to find out the identities of those visiting our website. We will not associate any data gathered from this site with any personally identifying information from any source. If we do want to collect personally identifiable information through our website, we will be up front about this and we will make it clear when we collect personal information and will explain what we intend to do with it.

For more information on enabling and disabling cookies please visit About Cookies.

Cookie Name Purpose
Google Analytics _ga

These cookies are used to collect information about how visitors use our site. We use the information to compile reports and to help us improve the site. The cookies collect information in an anonymous form, including the number of visitors to the site, where visitors have come to the site from and the pages they visited.

Click here for an overview of privacy at Google

concrete5 CONCRETE5 This cookie is used by the website's CMS (Content Management System) to track if the user is a public guest or is logged in to an account on the website. This cookie is not used for any other purpose.
Cookie notice cookieconsent_status Keep track of whether or not you have clicked "Got it!" on the notice about cookies on this website, so that it doesn't keep appearing when you load a page.
Google Translate googtrans Keep track of which language has been selected from the Google Translate tool.
Colour contrast contrast-mode Keep track of which language has been selected from the Google Translate tool.
Text size saveFontSize Keep track of the text size that has been set from the Accessibility Tools.
Accessibility bar accessibility-controls Keep track of whether the accessibility bar is opened or closed.