Privacy Policy

The data controller for the processing of your personal information is The Tavistock & Portman NHS Foundation Trust (Trust). This privacy policy outlines how we collect, use, and disclose personal information when users (Users) visit and access the NCL Waiting Room website (Waiting Room). The Waiting Room is a facility designed by the Trust and this policy only applies to Users’ specific use of the Waiting Room. If you are a patient of the Trust then the Trust’s privacy policy will govern the processing of your data.  

Please note:

1. The Trust is registered with the ICO with registration number Z1595854.
2. The policy is not contractual but complies with the UK General Data Protection Regulation (GDPR).
3. The Trust does not sell or use personal data for commercial purposes.
4. The Trust will not transfer personal data outside the European Economic Area.
5. If you have any questions about this privacy policy or how we use your personal information, please contact by email ig@tavi-port.nhs.uk or waitingroom@tavi-port.nhs.uk or by post The Tavistock Centre; 120 Belsize Lane; London; NW3 5BA.

The Waiting Room

The Waiting Room is primarily an online resource that provides information and resources for people who require mental health and wellbeing support.

There are two services:

1. Newsletter;
2. Support plan (Support Plan) where a User can access resources in as structured manner and input the User’s journey.

Those who just browse the Waiting Room the only personal data processed by the Trust is the browser type and IP address – those Users will otherwise access the Waiting Room anonymously (Browsers).

Users will use one or both of the two services and will accordingly require the Trust to process User’s personal data. 

Summary of the Trust’s Data Processing

For Users the personal data the Trust collects is personal information the User chooses to share. This will range from name, email address and phone numbers, when a User fills out a form or signs up for the newsletter, to data the User inputs and shares on a Support Plan. The latter is likely to be special category data and by inputting the data in question the Trust will process this data on the basis that the User has given consent.

All personal data can only be processed if the data controller (i.e. the Trust) has a lawful basis for so doing. For Users who register to receive the newsletter, the Trust will communicate with those Users on the basis that it is in the Trust’s legitimate interest.

1. the User has voluntarily registered and can opt out; and
2. the provision of these services is consistent with the Trust’s purpose and funding.

For Browsers and Users, the Trust uses personal data to personalise and improve their experience. The lawful basis for processing is the Trust’s legitimate interest.

The nature of the personal data on the Waiting Room may raise safeguarding issues and the User understands that the Trust may have no choice to refer any such data to other authorities and agencies. This statutory duty overrides any duty of confidence owed to Users.

Your Rights

You have the following rights with respect to your personal information:

• The right to access and obtain a copy of your personal information
• The right to rectify any inaccuracies in your personal information
• The right to erasure of your personal information (in certain circumstances)
• The right to restrict processing of your personal information (in certain circumstances)
• The right to object to the processing of your personal information
• The right to data portability (in certain circumstances)
• The right to withdraw your consent (if we are processing your personal information based on your consent)

In order to exercise any of these rights, please use the contact details at the start of this policy. The data subject will have to share satisfactory proof of identification and address. The Trust will only release personal data if it is satisfied that the recipient is the User and will lawfully reject the exercise of the rights.

The Trust’s personal data records in relation to NCL Waiting Room are held electronically and securely on the NCL Waiting Room database hosted using Amazon Web Services (AWS) and the Trust secure server. The Trust only holds personal data for as long as necessary to fulfil the purposes outlined in this privacy policy, unless a longer retention period is required or permitted by law.

In the case of a registered user requesting to end their account on NCL Waiting Room, or in the case of NCL Waiting Room closing the account of a registered user due to breach of the End User Licence Agreement, their personal data will be retained for up to one year after the account is closed before it is securely deleted. In the case of an account becoming dormant, personal data associated with that account will be retained for up to two years after the account becomes dormant before it is securely deleted.

All data that is pulled for the purposes of improving our website is anonymised. Your personal identifiable data, such as your name or email address, are only accessible to the NCL Waiting Room team using secure access measures and will not be shared with others. NCL Waiting Room team members are subject to a duty of confidentiality and must complete regular information security and data protection training.   

Cookies

Our website uses cookies to enhance your experience and gather information about website usage. You can choose to have your computer warn you each time a cookie is being sent or you can choose to turn off all cookies. If you choose to turn off cookies, some features of our website may not function properly. Further information is provided in our Cookie Policy.

Changes To The Privacy Policy And Your Duty To Inform Us Of Changes

This privacy policy is kept under regular review.

It is important that the personal data we hold is accurate and current. It is the obligation of Users to keep us informed if personal data changes, for example a post code or email address.

Complaints

All Users have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK regulator for data protection issues. The Trust would appreciate the chance to deal with any concerns before the ICO is approached.

Our security controls protect your confidentiality. If you become aware of data protection breach or potential breach, please tell us about it by emailing dpo@tavi-port.nhs.uk or to telephone our Data Protection Officer on 020 8938 2022. Please include as much information as you know about the circumstances of the incident and the personal data involved.