Privacy Notice
Background
Humber Teaching NHS Foundation Trust are the ‘host organisation’ of the Interweave software, which is used to power some NHS functions, such as shared care records and certain aspects of the NHS App.
Humber Teaching NHS Foundation Trust process your data on behalf of the organisations that choose to provide or consume data via the shared care records. The organisation which holds your health records is the Data Controller of your personal data. The list of Data Controllers contributing data to any of Interweave’s products can be found here.
More information on how your data is used can be found below.
Security of Information
Confidentiality affects everyone. We as Humber Teaching NHS Foundation Trust have a legal basis to gather, store and process large amounts of information on a daily basis. This includes medical records, personal records and computerised information for the purposes of preventive or occupational medicine; medical diagnosis; or if the process is necessary for the performance of a task carried out in the public interest. This information is used by many people throughout the course of their daily work.
Our duty to protect information and confidentiality is taken very seriously. We are committed to taking all reasonable measures to ensure the confidentiality and the security of all information for which we are responsible, whether computerised or on paper. This includes regular staff training on the legal obligations they have to maintain confidentiality and security of information at all times.
We have appointed a Senior Information Risk Owner who is accountable for the management of all information assets and any associated risks and incidents, and a Caldicott Guardian who is responsible for the management of patient information and patient confidentiality.
The Humber Teaching NHS Foundation Trust takes staff training extremely seriously. This is to ensure that nobody will access or use your information without a relevant reason, and to stop accidental loss, damage and destruction of any of your medical, personal and electronic records.
Why Do We Collect Information About You?
To make sure you get the best care doctors, nurses and the team of health and care staff caring for you keep records about your health and any care or treatment you may receive from the NHS and Social Care. These records help to make sure that you receive the best possible care.. They may include:
- Basic details about you such as name, address, date of birth, next of kin, etc.
- Contact we have had with you such as appointments or clinic visits,
- Notes and reports about your health, treatment and care,
- Results of x-rays, scans and laboratory tests,
- Relevant information from people who care for you and know you well such as health professionals and relatives.
Always check that your details are correct when you visit us and please tell us of any changes as soon as possible.
How Your Personal Information is Used
Your records are used to manage and deliver the care you receive to make sure that:
- The doctors, nurses and other healthcare members of staff involved in your care have correct and up to date information, to look at your health and decide on the right care for you,
- Health and care staff have the information they need to be able to look at and improve the quality and type of care you receive,
- Your concerns and worries can be properly investigated if a complaint is raised,
- The right information is available if you see another doctor, or are referred to a specialist or another part of the NHS and Social Care.
Who Do We Share Personal Information With?
Everyone working within the NHS and Social Care (within your local authority) has a legal duty to keep information confidential. Similarly, anyone who receives information from us has a legal duty concerning your confidentiality. The partner organisations with which we share information are:
- Other NHS Trusts and hospitals that are involved in your care,
- ICBs (Integrated Care Boards),
- General Practitioners (GPs),
- Ambulance Services,
- Adults’ and children’s social care services.
You may be receiving care from other sectors as well as the NHS. Therefore we may need to share information to other agencies about you, so we can all work together for your benefit, for the purpose of direct care. These agencies include:
- Social Care Services,
- Education Services,
- Local Authorities,
- Voluntary, community and private sector providers working with the NHS,
- General Medical Council.
In the course of our work, we may enlist sub-processors to carry out tasks on our behalf. The sub-processors used by Interweave are:
| Sub-Processor | Purpose of processing |
| Synanetics Ltd | Synanetics are contracted to carry out development work and provide support for the Interweave Portal function. From time to time, Synanetics may process patient demographic data in the course of their work for the purposes of troubleshooting. |
| CGI IT UK Ltd | CGI are contracted to carry out development work and provide support for the Interweave Exchange and Connect functions. From time to time, CGI may process patient demographic data in the course of their work for the purposes of troubleshooting. |
| Aire Logic Ltd | Airelogic are contracted to carry out development work and provide support for Interweave’s technical infrastructure. From time to time, CGI may process patient demographic data in the course of their work for the purposes of troubleshooting. |
| Google Cloud Platform | Interweave uses Google Cloud Platform to store our Patient Index, which includes the name, date of birth and NHS Number of each patient that has been registered via an Interweave product. |
| Deloitte LLP | Interweave uses Deloitte LLP as our Google Cloud Platform re-seller. They provide some administrative support to our Google Cloud environment however do not routinely process patient data. |
| Atlassian Jira | Atlassian Jira is the platform used for our Service Desk functionality. |
| The Rotherham Trust | The Rotherham Trust are sub-contracted to provide staff to provide the first-line support on our Service Desk. |
We will not provide your information to any other third parties without your permission unless there are exceptional circumstances such as the health and safety of you and others is at risk, or if the law requires us to pass on information.
Shared Care Records
Interweave provide the technology to enable some Shared Care Records across the country to operate effectively. A Shared Care Record is a shared system that allows Healthcare staff within a local region’s health and social care community to appropriately access the most up-to-date and correct information about patients involved in their care, to deliver the best possible care.
Shared Care Records will use records about you in ways that respect your rights and promote your health and wellbeing.
If you would like any further information, or would like to discuss this further, please contact your relevant Shared Care Record using the details provided below:
| Shared Care Record partnership using Interweave technology | Contact details |
| Yorkshire and Humber Care Record | hnf-tr.yhcr@nhs.net |
| Notts Care Record | nnicb-nn.digital.notts@nhs.net |
| Leicester, Leicestershire and Rutland Care Record | lpt.llrcarerecord@nhs.net |
| Dorset Care Record | dorsetcarerecord@dorsetcouncil.gov.uk |
The National Record Locator
Interweave is a ‘supplier provider’ of the National Record Locator (NRL). This means that the Shared Care Records using Interweave’s technology will also share their data with the NRL.
The NRL is a service that is managed by NHS England. The service is intended to facilitate national sharing of your information and reduce the need for organisations to create duplicate copies of information across systems and organisations, by enabling access to up-to-date information directly from the source.
It can be used to store and publish ‘pointers‘ to patient data held in health systems across England, to look up where relevant patient data is held and to retrieve data. All data which is provided to Interweave as listed in “Why do we collect information about you?” will be onward-shared to the NRL to enable national sharing to other organisations who have signed up to the NRL. The types of organisations do not differ to the organisations listed in “Who do we share personal information with?” however NHSE provide a list of organisations signed up to the NRL in their Controller Catalogue.
Wayfinder Services
Another service which is available to some organisations who use Interweave’s technology is the Wayfinder Service, which gives patients under certain organisations the ability to view, reschedule and cancel any appointments that they have via the NHS App. Further information on how your data is used via the NHS App can be found below:
NHS App
Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS England. NHS England is the controller for any personal information you provided to NHS England to get an NHS login account and verify your identity, and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS England (as the “controller”) when verifying your identity.
Please see NHS login’s Privacy Notice and Terms and Conditions.
Your Rights
Access
The Data Protection legislation gives you a right to access the information we hold about you in our records.
Interweave’s technology takes a ‘snapshot’ of your Electronic Health Record and displays it to a clinician in real-time. This information is not stored by Interweave. If you do wish to see the information that we hold about you, please email Interweave on: hnf-tr.interweave@nhs.net. We will provide your information within one calendar month from your request, though please note we may need to verify your identity.
To access your full medical records, please contact the data controller (the organisation who hold your data).
Objection
You have the right to object to how and with whom we share the information that is within your records that could identify you. This will be noted within your records so that all staff involved with your care and treatment are aware of your decision. By choosing this option, it may mean that the delivery of your care or treatment more difficult. You can also change your mind at any time about your decision.
If your consent is relevant, you are required to provide this in writing. This is essential as you may change your preference regarding consent further down the line. You as an individual also have the right to withdraw your consent at any time.
You have the right to opt-out of having your data shared via the shared care record (including the NRL). An opt-out can be applied locally (via the organisations that hold your data) or centrally (via Interweave). A local opt-out will stop data being shared from one organisation to Interweave, whereas the central opt-out will stop data being shared via Interweave as a whole.
Please contact the organisation at which you are receiving care to discuss your options. Your organisation will get in touch with us if you request to opt-out centrally. Alternatively, you can contact Interweave directly on hnf-tr.interweave@nhs.net and we will discuss your options with you and with the organisation at which you receive care.
Erasure
You as an individual have the right to have erased any records that have been inaccurately added to your medical records, personal records or other computerised system. If you think any information is inaccurate or incorrect, please contact the data controller (the organisation who hold your data). Alternatively, you can email Interweave on: hnf-tr.interweave@nhs.net and we will inform your data controller.
Retention
The retention period for medical records once you have been discharged from care is eight years. Once this period is up your records will then be destroyed within the guidelines set out by the Data Protection legislation. There are some exemptions to this, such as maternity and child’s records; these will be kept for 25 years.
Please note that Interweave do not keep copies of your medical records.
Complaints
If you have any concerns about how we have handled your data you have the right to complain. To do this, you can contact our Complaints and Feedback Team on hnf-tr.complaints@nhs.net. Please note that if your complaint is with the organisation sharing or using your data, your complaint should be directed to that organisation instead,
Additionally, you have the right to raise a complaint with the Information Commissioner’s Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF Helpline: 0303 123 1113 or report online at: https://ico.org.uk/make-a-complaint/dataprotection-complaints/
Freedom of Information
The Freedom of information Act 2000 provides any person with the right to obtain information held by the Humber Teaching NHS Foundation Trust, subject to exemptions.
Notification
The Data Protection Legislation requires organisations to lodge a notification with the Information Commissioner to describe the purposes for which they process personal information. These details are publicly available from:
Information Commissioner’s Office Wycliffe House
Water Lane Wilmslow SK9 5AF
Telephone: 08456 306060
Website: www.ico.gov.uk
Last updated: 15/07/2026
