1. Introduction
Bevan Community Benefit Society (CBS), trading as Sort – Brainhealth (“we”, “us”, “our”), is committed to protecting your privacy and handling your personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and all relevant laws and guidance.
This Privacy Policy explains what personal data we collect, how we use it, the legal bases for processing, and your rights.
2. What Data We Collect
We collect and process personal data necessary to provide our services, including:
- Name, contact details, date of birth, and identification information
- Health and medical information, including details of your appointments, diagnosis, and treatment
- Information you provide in forms, questionnaires, or during consultations
3. How We Use Your Data
We use your personal data to:
- Deliver healthcare and related services
- Manage appointments, billing, and communications
- Share relevant information with your NHS GP (with your consent or if required by law)
- Comply with legal and regulatory obligations
- Improve our services and ensure quality of care
4. Legal Basis for Processing
Our processing of your personal data is based on the following lawful bases under the UK GDPR:
Article 6(1)(b): Processing is necessary for the performance of a contract (i.e., delivering services to you as a patient).
Article 6(1)(c): Processing is necessary for compliance with a legal obligation (e.g., statutory obligations to keep care records under CQC regulations).
Article 6(1)(f): Processing is necessary for our legitimate interests (e.g., providing the service, operating our business, dealing with legal claims, and regulatory compliance).
For special category data (such as health information), we rely on:
Article 9(2)(h): Processing is necessary for the provision of health or social care, under the responsibility of a regulated health professional, with appropriate safeguards in place (Article 9(3)). This is further supported by Paragraph 2 of Schedule 1 of the Data Protection Act 2018, which covers health or social care purposes.
Article 9(2)(f): Processing is necessary for the establishment, exercise, or defence of legal claims.
Consent: While UK GDPR allows for consent as a lawful basis (Article 6(1)(a) and Article 9(2)(a)), we generally do not rely on consent for most processing, as there are clear alternative provisions. Consent is only sought where you have a genuine choice, and you may withdraw your consent at any time.
5. Sharing Your Information
We may share your information with:
- Your NHS GP, to ensure safe, joined-up care (only with your explicit consent, unless required by law – e.g., safeguarding, serious risk)
- Other healthcare providers involved in your care
- Regulatory bodies, where required by law
- Third-party service providers who support our operations (subject to strict confidentiality and data protection agreements)
Sharing Information with Your NHS GP:
To help ensure safe, joined-up care, we wish to share relevant information from your appointments with your NHS GP, including details about your health, diagnosis, and treatment. You will be asked for your preference at sign-up:
- [ ] Yes, I agree to you sharing relevant information with my NHS GP
- [ ] No, I do not agree to you sharing relevant information with my NHS GP
You can change your choice at any time by contacting us. Access to our services is not conditional on your consent to share information with your NHS GP.
6. Your Rights
You have the right to:
- Access your personal data
- Request correction of inaccurate data
- Request erasure of your data (subject to legal requirements)
- Restrict or object to processing in certain circumstances
- Withdraw consent where processing is based on consent
- Lodge a complaint with the Information Commissioner’s Office (ICO)
7. Data Security and Retention
We implement appropriate technical and organisational measures to protect your data. Your information is retained only as long as necessary for the purposes described above or as required by law.
8. Contact Us
If you have any questions about this Privacy Policy, how we handle your personal data, or wish to exercise your rights under data protection law, please contact us using the details below:
Bevan Community Benefit Society (CBS) trading as Sort – Brainhealth
Bevan House, 14 Piccadilly, Bradford, BD1 3LS
Email: brainhealth@wearebevan.org
Data Protection Officer (DPO):
Daljeet Sharry-Khan (Bradford)
Email: Daljeet.Sharry-Khan@nhs.net
Aaron Linden (Leeds)
Email: Leedsccg.dpo@nhs.net
Information Commissioner’s Office (ICO):
Bevan Community Benefit Society is registered with the Information Commissioner’s Office (ICO).
You can contact the ICO for advice or to make a complaint at:
Website: www.ico.org.uk
Telephone: 0303 123 1113