FOI Information

We aim to respond to all information requests and concerns fairly, clearly and within the relevant statutory or organisational timescales. If you are unhappy with how your request has been handled, the response you have received, or the service you have experienced, you can ask us to review the matter or make a complaint using the appropriate route below.

Freedom of Information and Environmental Information Regulations complaints

If you are dissatisfied with the response to a Freedom of Information (FOI) or Environmental Information Regulations (EIR) request, or you are unhappy with the way your request has been handled, you should first ask the Trust to carry out an internal review FOI@uhnm.nhs.uk . This may include concerns that information has been withheld, that an exemption or exception has been applied incorrectly, that the response is incomplete, or that the statutory timescale has not been met.

An internal review is a fresh consideration of the original request and response. Wherever possible, it will be undertaken by someone who was not involved in the original decision. Most internal reviews should be completed within 20 working days, although in exceptional cases this may take up to 40 working days. If you remain dissatisfied after the internal review, you have the right to complain to the Information Commissioner’s Office (ICO).

Subject Access Request complaints

If you are unhappy with the way your Subject Access Request (SAR) has been handled, or you believe that information is missing, has been incorrectly redacted, or has not been provided within the required timescale, you should contact the Trust in the first instance so that we can review your concerns nos-tr.ministries@nhs.net Please provide your request reference number, the date of your request, and clear details of what you believe has not been addressed.

We will consider the issues you raise and explain whether any further information can be provided, whether information has lawfully been withheld or redacted, or whether any additional searches are required. If you remain dissatisfied after we have had the opportunity to respond to your concerns, you can raise the matter with the Information Commissioner’s Office (ICO).

Other complaints about care, treatment or Trust services

Complaints about care, treatment, communication, appointments, staff conduct, or any other Trust service are handled through the NHS complaints process rather than the FOI, EIR or SAR process. Many concerns can be resolved quickly by speaking to the ward, department or service involved, or by contacting the Patient Advice and Liaison Service (PALS) PALS@uhnm.nhs.uk

If the issue cannot be resolved informally, you can make a formal complaint to the Trust’s Complaints Team Complaints.Department@uhnm.nhs.uk 

When contacting us about any complaint, please include your name, contact details, any relevant reference number, and a clear explanation of what you are unhappy about and what outcome you are seeking. This will help us direct your complaint to the correct team and respond as effectively as possible.

To allow us to manage your request swiftly and efficiently, you may find it helpful to consider the ICO’s advice contained in the ICO Guidance – How to access information from a public authority.

It is important that requests are clear and focussed, providing the Trust with enough information to determine and understand what information you are seeking.  If your request does not allow us to make that determination, we will likely need to respond back to you asking for clarification.  Our overall timeframe for answering your request will halt at that point – further delaying us in providing you with your information, so it is important that you make your request clear and specific.

If your request is very general or you are asking for a large volume of information, you may wish to consider narrowing or refining the scope of your question.  This may help you to get the information you are requesting in a timely manner.

This privacy notices advises you on how the Trust collects and uses your personal information that is provided to us via a request for information.

What Information we collect

• Your full name (first name and surname)
• Your address (full postal address in the case of a subject access request)
• Your email address (as used when making your request for information)
• Your request
• Any personal information held by the Trust disclosed to you in response to a subject access request (SAR)

How we collect your information

The bulk of information we collect has been provided to us by you for one of the following reasons:

• When you make an FOI request (or EIR request)
• When you have made a subject access request as is your right under the Data Protection Act 2018

How we use your information

We use the information that you have provided in order to answer your request for information made under the relevant access to information legislation (either FOI Act/EIR Regulations or the Data Protection Act 2018).  We will only use your information when the law allows us to do so or where it is necessary to allow us to complete one or more of our official functions.  Most commonly, we will use your personal information where:

• We need to comply with a legal obligation
• It’s necessary for the performance of a task carried out in the public interest or in the exercise of our official authority as a public body
• To help us confirm your identity when you contact us
• To provide and improve our service to you
• In limited circumstances (and we would explain these circumstances at the time should they apply), we may ask you for your consent to use your personal information.  However your consent is not required if any of the above points apply.

Who we share your data with

• Your personal information may be shared within the Trust to allow us to undertake and complete your request, to allow us to identify and locate information held about you, for example.
• We will need to share your request with the Information Commissioner’s Office to answer any complaint made to the Commissioner
• We will share your information with Digital Interactive Ltd., our 3rd party Data Processor and the suppliers of the software used to manage our Requests for Information.
• We will share your information if we are required to do so by law or regulation e.g. Court Order, or to prevent fraud or other crime

We will NOT:

• Use your personal information for the purposes of data analytics
• Share your information with third parties for marketing purposes
• Sell or rent your personal information to other third parties

Our Lawful Basis for processing your personal information

Under the Data Protection Act 2018 (and the UK GDPR), we rely on the following lawful bases to process your personal information:

• We have a legal obligation as a data controller to provide you with access to information under the different Requests for Information legislation
• We require your information to allow us to perform a public task
• We have a legitimate public interest
• We have your consent.  

Special category data is that which is particularly sensitive (for example your health record data) and this requires a higher level of protection.  

To allow us to use this data we need to provide further and additional justification for collecting, storing and using special category data.

If required, we will process special category data in the following circumstances:

• Where we have a legal obligation to do so
• Where it is in the public interest to do so and is necessary to:

• Allow the Trust to undertake its functions as a public authority
• For the prevention, investigation, detection or prosecution of criminal offences

Transferring Data Abroad

The Trust does not share your personal information outside of the UK without ensuring that sufficient safeguards are in place that meet the ICO’s criteria, together with the requirements of the UK GDPR.

Automated Decision Making

There are restrictions on decision-making based solely on automated means (i.e. without any human involvement), this includes restrictions on profiling.  In terms of FOI requests, the Trust does not utilise automated decision-making without human involvement.  If you have any queries, please contact the Trust’s Data Protection Officer.

How we store your Personal information

Information on this subject is available at the Trust’s over-arching privacy notice which can be found here.

How long do we keep your information

Your personal information is stored in accordance with the NHS Records Management Code of Practice

Your rights under the Data Protection Act 2018

Information on this subject is available at the Trust’s over-arching privacy notice which can be found here.

How to contact us

Information on this subject is available at the Trust’s over-arching privacy notice which can be found here.

How to complain

Information on this subject is available at the Trust’s over-arching privacy notice which can be found here.

Some of the information we provide to you under the Requests for Information legislation (FOI Act/EIR Regulations) will be subject to copyright protection.

It is appropriate for you to use the information we provide for your own purposes, including any non-commercial research that you are doing and for the purposes of news reporting.  Any other re-use will require the permission of the copyright holder.  This is to comply with the Re-use of Public Sector Information Regulations 2015.

It is NOT appropriate or admissible for you to use personal data for direct or electronic marketing purposes (e.g. including but not limited to email, telephone calls, letters) or to provide it to third parties.  Any such action does not have the consent of the data subject concerned and that by selling, giving or sharing of this personal information would be a breach of the Data Protection Act 2018.  Any re-use of this nature must only be undertaken with the prior written permission of the Trust.

For information on where the copyright is owned (in the case of corporate data), please submit a request in writing with:

• Your name and address
• Full details of the information you wish to re-use
• Your intended re-use purpose of the information

The Environmental Information Regulations 2004 give you the right to obtain information held by public authorities about the environment.  

We co-ordinate our responses to both Freedom of Information and Environmental Information requests from the same office and you can make an EIR request here: Make An EIR Request. Your request will automatically be acknowledged and the Trust has 20 Working Days in which to respond.  

For more information about making either an FOI or EIR request, please see the Information Commissioner’s (ICO) page on How to access information from a public body.  It may not always be possible to provide all the information requested.

There are a number of valid reasons why some information may be withheld but we will tell you if an exemption is being applied and why.  Some exemptions are absolute while others require us to consider whether providing the information to answer your request is in the public interest or whether withholding the disclosure outweighs the public interest in releasing it. If this is the case, we will advise you of our reasons for withholding data.

Subject Access Requests

Under data protection law, you have the right to see the information we hold about you. This is known as a Subject Access Request (SAR).

What information can I ask for?

You can request access to any personal information we hold about you, including:

·         Copies of your medical records

·         Clinic letters, test results, or discharge summaries

·         Information held by services involved in your care

·         Images or scans (e.g., X-rays, MRI)

·         Correspondence relating to your treatment or care

We will only provide information that relates to you. Details about other people (including family members or staff) will be removed if we are not able to release them.

How long does it take?

We will respond within one month of receiving:

·        Your completed request,

·         Any identification we may need, and

·         Enough detail to locate the information you’re asking for.

If your request is complex or involves large amounts of information, we may extend this by up to two more months, but we will always tell you if this happens.

How do I make a request?

You can submit a SAR by completing the online form here

We may ask for ID to make sure we are giving information to the right person.

Can someone else apply on my behalf?

Yes, but we will need:

·         Your written permission, or

·         Proof of legal authority (e.g., lasting power of attorney, parental responsibility).

How will my information be sent to me?

We will provide your information:

·         Securely by email

·         Through a secure online portal (if available)

What if I think something is wrong in my record?

If you believe any information is inaccurate or incomplete, please let us know. We will review it and add a note to your record where appropriate.

Why we need to check information before releasing it

To protect your privacy, we must sometimes remove (redact) information about:

·         Other individuals

·         Staff members

·         Information that could cause harm if released

This ensures your information is provided safely and lawfully.

To help us manage your request as quickly and efficiently as possible, you may find it useful to read the ICO guidance on How to access information from a public authority  before submitting your request. Requests should be clear, focused and specific, with enough detail for the Trust to understand exactly what information you are asking for.

If your request is unclear, very broad, or asks for a large volume of information, we may need to contact you for clarification or ask you to refine the scope of your request. Where clarification is needed, the statutory timeframe for responding may pause until we receive the information we need from you. This can delay the overall time it takes to provide a response.

We understand that some requesters may use artificial intelligence tools to help draft their request. While this can be helpful, AI-generated requests can sometimes be very broad, repetitive or overly complex. This may make it harder for us to identify the information you are seeking and may increase the time needed to process your request.

Before submitting your request, please check that it clearly explains what information you want, the timeframe or subject area your request relates to, and whether you are asking for recorded information, personal information about yourself, or information about Trust services. Keeping your request simple, clear and focused will help us respond more efficiently and may help you receive the information you need sooner.

The privacy notice explains how the Trust uses personal information provided to us when you make a request for information, including a Freedom of Information request, Environmental Information Regulations request or Subject Access Request.

Privacy Notice

What information we collect

We will collect the information needed to manage and respond to your request. This may include your name, contact details, request details, proof of identity where required, and any personal information that is relevant to locating or responding to your request.

How we use your information

We use your information to confirm who you are where necessary, understand your request, locate relevant information, respond to you, keep an audit trail of how your request was handled, and meet our legal responsibilities under access to information and data protection legislation.

Our lawful basis

We process this information because it is necessary for us to comply with our legal obligations and to carry out our public functions. Where your request involves special category information, such as health information, we will only process it where the law allows us to do so and where appropriate safeguards are in place.

Who we may share information with

We may share your information with relevant Trust staff who need it to help process your request. We may also share information with our request management system supplier, Digital Interactive Ltd, where this is necessary to support the system used to manage requests. If you make a complaint to the Information Commissioner’s Office, we may need to share relevant information with them. We may also share information where required by law.

What we do not do

We do not use your request information for marketing, sell your information, or use it for automated decision-making without human involvement.

Keeping your information safe

We will keep your information secure and only keep it for as long as required in line with the NHS Records Management Code of Practice and the Trust’s records retention arrangements. Further information about how we protect personal information, your rights, how to contact us and how to complain is available in the Trust’s main privacy notice.

Some of the information we provide to you under the Requests for Information legislation (FOI Act/EIR Regulations) will be subject to copyright protection.

It is appropriate for you to use the information we provide for your own purposes, including any non-commercial research that you are doing and for the purposes of news reporting.  Any other re-use will require the permission of the copyright holder.  This is to comply with the Re-use of Public Sector Information Regulations 2015.

It is NOT appropriate or admissible for you to use personal data for direct or electronic marketing purposes (e.g. including but not limited to email, telephone calls, letters) or to provide it to third parties.  Any such action does not have the consent of the data subject concerned and that by selling, giving or sharing of this personal information would be a breach of the Data Protection Act 2018.  Any re-use of this nature must only be undertaken with the prior written permission of the Trust.

For information on where the copyright is owned (in the case of corporate data), please submit a request in writing with:

• Your name and address
• Full details of the information you wish to re-use
• Your intended re-use purpose of the information