Privacy policy

We process personal information about you so that we can continue to provide an enhanced level of service to the public for health services. High standards in handling personal information are of the upmost importance to us, because they help us to maintain confidence from our customers, suppliers, partners and the wider UK public.

When we handle your information, we undertake to:

• make sure you know why we need it
• only ask for what we need, and collect the minimal amount required
• protect your information and ensure no one has access to it who should not
• let you know if we are going to share it with other organisations
• make sure we do not keep your information for longer than necessary
• ensure you have the right to request any incorrect information be rectified
• not make your personal information available for commercial use without your consent
• value the personal information entrusted to us and make sure that we abide by the law when it comes to handling your personal information
• ensure we consider security at the outset of any new project where we are planning to hold or use personal information in new ways, and to continue to review existing systems to ensure they are compliant with new laws
• provide training to staff in how to handle personal information, maintain proper oversight of our information assets and respond appropriately if information is not used or protected properly

We also process information to include administration of health and social care services, management and administration of land, property and residential property and undertake research.

We operate a CCTV system on our premises for the prevention of crime and the safety and security of our staff and premises.

Paragraph 7 of Chapter 2 to the Data Protection Act 2018 provides that, as an organisation mandated by the UK government, the Trust may process personal data as necessary for the effective performance of a task carried out in the public interest.

For special category data, such as health, we will likely be processing your data for health and social care purposes. In some circumstances other legal bases may apply such as public health, employment, legal claims, courts archiving and in rare circumstances consent.

We will always identify the lawful basis on which your personal information is processed as defined by Article 6 and 9 of the UK GDPR.

In our use of health and care information, we satisfy the common law duty of confidentiality because:

• you have provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses)
• we have support from the Secretary of State for Health and Care following an application to the Confidentiality Advisory Group who are satisfied that it is not possible or practical to seek consent
• we have a legal requirement to collect, share and use the data

For specific individual cases, we have assessed that the public interest to share the data overrides the public interest served by protecting the duty of confidentiality. For example sharing information with the police to support the detection or prevention of serious crime. This will always be considered on a case-by-case basis, with careful assessment of whether it is appropriate to share the particular information, balanced against the public interest in maintaining a confidential health service

Depending on the information, we may collect data direct from you, and/or third parties such as family, carers, friends, professionals involved in your health and social care or employment, business partners, subcontractors.

We may also collect information through online tracking technologies, as detailed further down in this policy.

We process information about our:

• customers
• employees
• suppliers and providers
• advisers, consultants, and other professional experts
• complaints and enquiries
• students on placements
• academics
• members and supporters of unions
• NHS staff
• members of the public for CCTV purposes
• research applicants
• researchers
• patients and carers
• governors

The Trust is committed to securing your personal information from unauthorised access, use or disclosure. A combination of physical and electronic controls will help protect your personal information, creating a secure environment that allows for the provision of best quality care and preventing misuse of that data.

Is information transferred outside the UK?

Our data is hosted within the UK or within European Economic Area's who operate under the GDPR.

As a data controller of your personal data, we may, where necessary, and in line with data protection legislation, need to share this (and our data processors may also share information) with other organisations.

Please note the data shared will be dependent on the type of service used within the Trust. The below provides examples of types of organisations where we may, if necessary, share your data.

Types of organisations where we may, if necessary, share.

Type of organisation	Reason for sharing
Employment and recruitment agencies	To obtain an employment reference for recruitment purposes.
Current and past employers	To verify your employment history for recruitment purposes.
Suppliers and service providers	To support the services we provide to the public.
Internal audit and other auditors as required	To support regular audit activities and maintain scrutiny over public authority decision-making and activities.
Health and care organisations	To support your health and wellbeing and better inform care for you.
Other statutory law enforcement agencies	To assist in any legal or fraudulent activity.
Survey and research organisations	To share your information for research purposes where you have consented to be part of a study.
Government regulators	To support organisational audit and investigations such as the Information Commission.
The police	To assist with police enquiries in line with relevant legislation.
Home Office	To support payments and charging for overseas NHS treatment.

Devon and Cornwall care record

Health and social care services in Devon and Cornwall have developed a system to share patient data efficiently and quickly and, ultimately, improve the care you receive.

This shared system is called the Devon and Cornwall Care Record.

It's important that anyone treating you has access to your shared record, so they have all the information they need to care for you. This applies to your routine appointments and in urgent situations such as going to the emergency department, calling 111 or going to an out-of-hours appointment.

It's also quicker for staff to access a shared record than to try to contact other staff by phone or email.

Only authorised health and care staff can access the Devon and Cornwall care record and the information they see is carefully checked so that it relates to their job. Also, systems do not share all your data; just data that services have agreed is necessary to include.

Data protection-related complaints are managed through a dedicated process and must be submitted to the Information Governance Team.

This complaints process operates within the framework of UK data protection legislation. This includes UK GDPR, Data Protection Act 2018, and the Data (Use and Access) Act 2025, which amends aspects of existing data protection law while maintaining individuals' rights and protections.

All complaints will be acknowledged within 1 month of receipt. There is no statutory timeframe for issuing a full response to a data protection complaint. Response times will vary depending on the complexity and circumstances of the case. The Information Governance Team will provide updates where appropriate and ensure that all complaints are handled as efficiently as possible.

If, after receiving the Trust's response, you remain dissatisfied with the outcome, you have the right to raise your concerns with the Information Commission.

Outside specific exemptions under specific legislation related to personal data your information shall be retained for no longer than the purposes for which it is being processed.

We comply with the Records Management Code of Practice.

The Patient Portal uses a NHS login to provide secure access to patient information and services. The NHS login is a secure authentication service provided by NHS England that allows you to prove who you are and access a range of NHS digital services using a single set of login credentials.

When you sign in to the Patient Portal using a NHS login, NHS England is responsible for managing your NHS login account and any information used to verify your identity. The Trust does not control the information you provide to NHS England when creating or managing your NHS login account.

The Trust remains responsible for the health and care information made available through the Patient Portal. NHS login is used only to verify your identity and provide secure access to the service. It does not change how the Trust uses your health and care information.

For further information about NHS Login, read NHS England's privacy notice.

Under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and amendments introduced by the Data (Use and Access) Act, you have a number of rights in relation to your personal information. The availability of some rights depends on the lawful basis relied upon for processing and the purpose for which your information is used. As an NHS Trust, we primarily process personal information to provide health and care services, protect public health, safeguard individuals, meet legal and regulatory obligations, maintain accurate health records, and carry out tasks in the public interest. Because of these obligations, some information rights may be limited or may not apply in all circumstances.

The Data (Use and Access) Act does not remove your information rights. However, it clarifies how organisations should respond to information rights requests and confirms that requests must be handled in a reasonable and proportionate manner. This means organisations are only required to take steps that are reasonable and proportionate in the circumstances and are not required to conduct unlimited searches, create new information, answer general questions, or provide information that they do not hold.

Right to be informed

You have the right to be informed about how we collect, use, share, store and protect your personal information. We meet this obligation through our privacy notices and other information provided at the point your information is collected.

Right of access

You have the right to request confirmation of whether we process your personal information and, where we do, to receive a copy of that information. This is commonly known as a Subject Access Request (SAR).

The right of access applies to personal information held by the Trust. It does not require the Trust to:

• create information that does not already exist
• answer questions or provide explanations
• provide opinions about why events occurred or decisions were made
• obtain information from third parties on your behalf
• reconstruct records that no longer exist

The Trust will undertake reasonable and proportionate searches to locate your personal information. We are not required to undertake unlimited or disproportionate searches across all systems and records where doing so would be unreasonable in the circumstances.

Right to rectification

You have the right to ask us to correct personal information that you believe is inaccurate and to complete information that you believe is incomplete.

Where information represents a professional opinion, clinical judgement, or an accurate record of events at the time it was created, it may not be appropriate to alter the original record. In such circumstances, we may add a note or statement reflecting your concerns where appropriate.

Right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

This right is not absolute. NHS organisations are required to retain many records to comply with legal, regulatory, clinical, safeguarding, audit, public health and records management requirements. As a result, requests to erase health and care records will often be refused where the Trust has a lawful basis or continuing obligation to retain the information.

Right to restrict processing

You have the right to ask us to restrict the use of your personal information in certain circumstances, for example while the accuracy of information is being reviewed. Where processing is restricted, we may continue to store the information and may continue to process it where permitted or required by law.

Right to object

You have the right to object to the processing of your personal information in certain circumstances. However, where information is processed for the provision of health or social care, the performance of a public task, compliance with a legal obligation, safeguarding purposes, public health functions, or the establishment, exercise or defence of legal claims, the Trust may be entitled or required to continue processing the information despite an objection. Each request will be considered on its individual circumstances.

Right to data portability

You have the right, in certain circumstances, to receive personal information that you have provided to us in a structured, commonly used and machine-readable format, or to request that it is transferred directly to another organisation. This right generally only applies where processing is based on your consent or is necessary for a contract with you and is carried out by automated means. As most NHS Trust processing is undertaken under statutory powers, public task functions, legal obligations, or health and social care provisions, this right will rarely apply to clinical records.

Rights relating to automated decision-making

You have rights in relation to decisions made solely by automated means, including profiling. The Trust does not routinely make decisions about individuals based solely on automated processing without meaningful human involvement. If this changes, further information will be provided in the relevant privacy notice.

Exercising your rights

We will respond without undue delay and, in most cases, within 1 calendar month of receiving your request. Where a request is particularly complex, or where multiple requests have been made, we may extend this period by up to a further 2 months and will inform you if an extension is required.

Under the UK GDPR, the Data Protection Act 2018 and amendments introduced by the Data (Use and Access) Act, the Trust is required to respond to requests in a reasonable and proportionate manner. We will make reasonable and proportionate efforts to locate, review and provide relevant personal information but are not required to undertake disproportionate searches or activities that go beyond our legal obligations.

You will not normally be charged for exercising your information rights. However iIn some circumstances, the Trust may refuse a request or charge a reasonable fee. This may apply where a request is manifestly unfounded or excessive, including where requests are repetitive, overlap substantially with previous requests, are intended to cause disruption, or would require disproportionate resources to fulfil. Where a fee is charged, it will be limited to the administrative costs of locating, retrieving, reviewing, redacting, copying and providing the information, or otherwise dealing with the request.

If we decide to refuse a request, apply an exemption, or charge a fee, we will explain our decision and advise you of your right to complain to the Information Commission and to seek a judicial remedy.

To request copies of your records , email our Subject Access Request Team.

For all other requests, email our Information Governance Team.

AI tools can be helpful, but they can also introduce errors or create overly complex requests. When using AI to help draft an information request, have in mind what you are seeking to achieve by making a request for information from us.

Read the making a freedom of information request guidance and the Information Commission guide to making a subject access request. We are seeing an increase in requests and secondary correspondence that appear to have been drafted by generative AI. These can require additional clarification because of inaccuracies or unnecessary complexity. This creates delays for both requesters and additional work for our teams, increasing the burden on public bodies, such as the NHS and cost to the taxpayer.

Before you submit a request or follow up correspondence, check the following.

Only ask for the information you need

AI tools sometimes generate broad or excessive wording that goes beyond the information you actually want or need.

Specify a period of time

For example, 'the last 12 months' or '2023 to 2025'.

Your request is clear, concise and focused

Short, time focused and clear requests are easier for us to process and usually lead to quicker, more accurate responses. Further communication to obtain clarity around specific areas of the request will require a pause in processing.

Check for factual inaccuracies

AI can misrepresent legislation, misstate what organisations do. Consider reviewing the text of your request carefully and do not assume AI is right. If it has referred to something you do not understand, check what it is and that it's relevant before including.

Tone is appropriate

AI-generated content can sometimes sound abrupt or otherwise inappropriate. Your request is read by a human being who is doing their best. Consider checking the tone before sending.

The Trust provides information to NHS England through the NHS Federated Data Platform where required under national NHS reporting and data collection arrangements.

The Trust is working to find ways to develop better treatments for care. The information we hold on you can be used to help our researchers understand more about causes of illnesses and how best to treat them.

We follow strict rules to make sure your personal data is always kept secure and confidential. Where possible, we take out any information that could identify you, such as your name, address and postcode. If we cannot practically take out such information, it is our legal responsibility to ask for your explicit consent or to identify an appropriate legal basis to process your data.

The Health Research Authority governs health research. Their patient data and research leaflet can be found on their website.

For more details about the research projects that the Trust is involved in, visit our research webpage.

Our organisation is compliant with the national data opt-out policy.

Whenever you use a health or care service or using any of our services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

• improving the quality and standards of care provided
• research into the development of new treatments
• preventing illness and diseases
• monitoring safety
• planning services

Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information is not needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt-out your confidential patient information will still be used to support your individual care.

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Useful links

• Register your choice to opt-out
• How and why patient information is used, the safeguards and how decisions are made

For all services, we'd like to keep in touch with you to inform you of the valuable work and services we provide. You are always in full control of the messages you receive.

If you are a patient, we will ask you to provide us with additional contact information like your email address and mobile phone number. We do this so that we can provide you with timely communications relating to your appointments, and your treatment. We may contact you about eligible research or evaluation we need your support with. You can always opt out if you wish.

If you want us to change the way we contact you, contact our information governance team.

The Trust is the data controller for the personal data we hold and process about you. If you can any concerns about the processing of your information, or wish to raise a complaint about how we process your information you can contact our Data Protection Officer, Gina Matthews.

• Email our Data Protection Officer.
• Write to Cornwall Partnership NHS Foundation Trust, Information Governance team, Suite 6, Carew House, Beacon Technology Park, Dunmere Road, Bodmin, PL31 2QN.

For independent advice about data protection, privacy and data sharing issues, or to raise a complaint about how the Trust has processed your data, you can contact the independent Information Commission.

• Write to: Information Commission, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
• Call 0303 123 1113.
• Visit the Information Commission website

When you visit our website, we may store or access information on your device using cookies and similar technologies.

These technologies help us:

• ensure the website functions correctly
• maintain the security and performance of the website
• remember preferences you have chosen
• understand how visitors use our website so that we can improve our services

Some information collected through cookies and similar technologies may constitute personal data. Where this is the case, we will process that information in accordance with applicable data protection legislation, including the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and the Privacy and Electronic Communications Regulations.

For more information about the cookies and similar technologies used on this website, including how to manage your preferences, read our cookie policy.

The Trust may use digital systems and technologies that incorporate elements of AI.

AI may be used to support clinical, operational and administrative functions. These systems are designed to enhance service delivery, improve decision-making, and optimise resource use.

Where AI is used, it is subject to rigorous governance, oversight, and risk assessment. This is to ensure compliance with data protection legislation. As well as to safeguard individuals' rights and freedoms.

Any personal data processed by the systems is handled lawfully, fairly, and transparently.

We will update this page, at least annually or, where we have received feedback, national guidance or made changes in how our services use your information. We therefore encourage you to periodically review this web page in case of any changes.

The date of last review was October 2026.