Weight Management Programme - Privacy Notice

Including exercise daily in your routine can make a difference to your health. Regular exercise can lower your blood pressure, boost your immune system, help you to maintain a healthy weight and keep you feeling happier and healthier.

NHS Digital has been directed by the Department for Health and Social Care, under section 254 of the Health and Social Care Act 2012 to establish and operate a system for the collection and analysis of the Community Services Data Set (CSDS) - a secondary uses data set, which re-uses clinical and operational data for purposes other than direct patient care.

We are commissioned by Kent County Council Public Health to deliver adult weight management programmes in the Borough of Dartford. You will have consented to your GP making a referral to us.

Processing activity - we will process personal information relating to the delivery of the weight management programme through the CSDS and our weight management programme service.

Information requirements - our processing activities may include:

• demographic information, including your name, date of birth, National Insurance number, sex, address, religion and sexual orientation
• health information, including your height and weight and information about your physical and mental health and wellbeing
• information about changes in your weight and mental health and wellbeing collected at regular points as you progress through the service

We also collect ‘special category data’ (personal information which is more sensitive and is treated with extra care and protection) such as information about your racial or ethnic origin and information concerning your health.

Lawful bases[1] - our lawful bases for processing your personal information are:

• UK GDPR  Article 6(1)(c) - processing necessary to comply with a legal obligation to which we are subject – Section 251B Health and Social Care Act 2012 (as amended)
• UK GDPR  Article 9(2)(g), supplemented by the Data Protection Act 2018, section 10(3) & Schedule 1, Part 2, paras 6(1) and (2)(a) – processing of ‘special category data’ (personal information which is more sensitive and is treated with extra care and protection) such as information about your racial or ethnic origin and information concerning your health

We have a Data Protection Policy that sets out how this information will be handled.

Data sharing - we may receive from and share your personal information with:

• Kent County Council Public Health
• NHS

The sharing of information facilitates a joined-up approach with partner agencies, to ensure support of the delivery of the CSDS and our weight management programme service.

We may rely on a number of exemptions, which allow us to share information without needing to comply with all the rights and obligations under the Data Protection Act 2018. Please refer to the Kent & Medway Information Agreement for further details on our sharing arrangements.

Retention period – we will only hold your personal information for as long as necessary. Personal data shall be retained for 2 years in accordance with the retention period(s) referred to in the Information Asset Register (Community Services) unless exceptional circumstances require longer retention e.g. a pending court case. All information will be held securely and disposed of confidentially.

Anonymisation- your personal information may be converted ('anonymised') into statistical or aggregated data in such a way that ensures that you cannot be identified from it. Aggregated data cannot, by definition, be linked back to you as an individual and may be used to conduct research and analysis, including the preparation of statistics for use in our reports.

Right to object – where processing your personal information is required for the performance of a public interest task (see our lawful bases above), you have the right to object on ‘grounds relating to your particular situation’. We will have to demonstrate why it is appropriate for us to continue to use your personal data.

Changes to this Privacy Notice – we review this Privacy Notice regularly and will place updates on our website.

Please refer to our Corporate Privacy Notice for further details of how we process your personal information and for details on your additional rights.