Skip to main content

Privacy Notice

tablet with padlock

This privacy notice tells you what to expect when your information is processed on the Promptly Health Platform. You can contact the department at:

  • The Hub, Unit 2, Gwaun Elai, Ynysmaerdy, Llantrisant, Rhondda Cynon Taf, CF72 8XL
  • E-mail: ctm.vbhc@wales.nhs.uk
Why are we able to process your information?

We are legally able to process your personal information under Article 6 of the General Data Protection Regulation (GDPR) as the processing is necessary for us to perform our official functions as an NHS body. There will be occasions when we will rely on other lawful bases such as when the processing is required for us to comply with the law.
We are legally able to process special category information under Article 9 of the GDPR as the processing is necessary for the purposes of the management of health or social care systems and services or is necessary for the purposes of carrying out obligations in the field of employment and social security and social protection law.

For what purpose we are processing it?

The information processed on this platform relates to the collection and use of Digital Health Assessments or which Patient Reported Outcome Measures (PROMS) is one kind of digital health assessment.
The Digital Health Assessment will ask you questions regarding your daily living, current symptoms and how it affects your quality of life. The information collected in this assessment will be reviewed by your specialist clinician in order to understand what is affecting you the most and enable them to make informed decisions regarding your treatment.
The information you provide will be used to help your clinician understand in more detail how you are feeling, to help in planning your treatment and to see how you are responding to that treatment.
Anonymous information (where you cannot be identified) may be used at a future date to help the Health Board improve the quality of the local services we are providing to you and to support research such as a university researching the effectiveness of a treatment.
You may be asked to complete a Digital Health Assessment on various occasions. This enables your care team to gain a detailed and current picture of your response to treatment.

How long will we store it for?

We will not store personal information for longer than is required. Personal information will be anonymised when it is no longer required in an identifiable format.
Your PROMs information will stay on the Promptly Health platform for as long as the Health Board instructs Promptly Health to hold it. Where a clinical decision is made from your Digital Health Assessment  information, the assessment will be copied to your patient record, which is stored in line with NHS retention guidelines.

Who will we share your information with?

There may be occasions where we will share your information with others. This will only be done where there is a lawful basis to do so and in line with the purposes listed above.
Where required, we may share your information with:

  • Other departments within the Health Board;
  • With other NHS or partner organisations; and
  • With the police, public bodies, regulatory bodies, legal professionals and the Information Commissioners Office.
How can I contact the Data Protection Officer?

The contact details for the Data Protection Officer are outlined below:
Data Protection Officer
Cwm Taf Morgannwg University Health Board, Ynysmeurig House, Navigation Park, Abercynon, CF45 4SN
Tel: 01443 744800 and ask for the Data Protection Officer
E-mail: informationgovernancedepartment@wales.nhs

What are your rights in relation to your personal data?

Under data protection law, you have rights we need to make you aware of. The rights available to you depend on our reason for processing your information.

  • Your right of access - You have the right to ask us for copies of your personal information. This right always applies. There are some exemptions, which means you may not always receive all the information we process.
  • Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. This right always applies.
  • Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances. 
  • Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
  • Your right to object to processing - You have the right to object to processing only where is it processed as part of our public tasks, or is in our legitimate interests.
  • Your right to data portability - This only applies to information you have given us. You have the right to ask that we transfer the information you gave us from one organisation to another, or give it to you. The right only applies if we are processing information based on your consent or under contract, or in talks about entering into a contract and the processing is automated.

You are not required to pay any charge for exercising your rights. We have one month to respond to you.
You also have the right to lodge a complaint with a supervisory authority if you are unhappy about how your data is processed.
In the UK, the supervisory authority is the Information Commissioner’s Office whose contact details are provided below:

Information Commissioner’s Office - Wales
2nd Floor, Churchill House, Churchill Way, Cardiff, CF10 2HH
Tel: 0330 414 6421
Online / Live Chat: Data protection and Personal Information Complaints Tool
Helpline: 0303 123 1113
Further guidance on how to exercise your rights is available on the ICO Website.