Our Care Record Guarantee

You can find further details about what personal information we process and what your data protection rights are in our privacy notices. To view BPAS privacy notices please visit bpas.org/privacynotice

1. We will comply with requests you make to access your information in accordance with the Data Protection Act 2018 & Access to Health Records Act 1990. We will provide other ways for you to apply to see your records if you cannot do so in writing. You can find more information about all your data protection rights in our privacy notices.
2. When we provide healthcare, we will share your record with the people providing care or checking the quality of care. Everyone looking at your record, whether on paper or computer, must keep the information confidential. We will aim to share only as much information as people need to know to play their part in your healthcare.
3. We will not share health information that identifies you for any reason other than providing your care, unless we have a clear need to do so in accordance with data protection laws. We will be transparent about the lawful bases in our privacy notices.
4. We may process your information in accordance with public tasks that are conducted in the public interests. We will only do this where such tasks are set out in law, and we will be clearly detail this information in our privacy notices.
5. We will be transparent about what information we share and with who. We may need to share your information with other third parties such a care providers and NHS partners. We will provide the details of information sharing within our privacy notices.
6. Where appropriate we will ask for your consent about processing your personal information. You can find further information about how we manage consent and details of the national data opt out scheme in our privacy notices.
7. We will deal fairly and efficiently with your questions, concerns and complaints about how we use information about you. Details on how to make privacy related complaints are included within our privacy notices. We will use any information we learn from your concerns and complaints to improve services.
8. We will take appropriate steps to make sure information about you is accurate. If you are not happy with an opinion or comment that has been recorded, we will add your comments to the record. You have the right to act to request for your information to be rectified or deleted.
9. We will take appropriate steps to ensure that all BPAS partners understand their confidentiality and data protection obligations.
10. We will take appropriate steps to make sure we hold records about you securely and only make them available to people who have a right to see them.
11. We will appropriately manage access to your information and we will take steps to audit access to your personal information.
12. If you believe your information is being viewed inappropriately we will investigate and report our findings to you. If we find that someone has deliberately accessed records about you without permission or good reason, we will take the appropriate action. This can include disciplinary action, which could include ending a contract, firing an employee or bringing criminal charges.

We will ensure that we always take steps to maintain security and confidentiality of your information, including but not limited to:

• Managing access controls
• Managing audit history
• Consider your consent where applicable
• Ensuring the appropriate technical, organisational, and physical measures are in place to promote security at all times