The Health and Care Transformation Programme (HCTP) Privacy Notice
The Department of Health and Social Care (DHSC) manages the HCTP. Therefore Department of Health and Social Care is the Data Controller and responsible for your personal data. We recommend you take some time to read this Privacy Notice and if you do not agree to it, please do not provide us with your personal data.
This Privacy Notice provides information on how we collect and process your personal data when you participate in an online survey, workshop, face-to-face or remote interview to help us collect feedback and improve how health and care is delivered across the island.
When we collect your personal data, we will
- only collect what we need and no more
- keep your information secure
- tell you how we will use your information
- delete your information when it is no longer needed
- only process your information in line with rules set out in the Data Protection Legislation
What this privacy notice explains
- What information is collected and why
- Who is collecting it
- How it is collected
- Why it is being collected
- How it will be used
- How long it will be kept
- Who it will be shared with
- How that information will be kept secure
- International transfers
- Your rights, choices, including how to access and update information
If we decide to change our Privacy Policy we will post changes to this Privacy Notice. If you have any questions or comments on this Privacy Notice please email the DHSC Data Protection Officer.
Contact the Data Protection Officer for the DHSC
DPO, Department of Health and Social Care,
1st Floor Belgravia House,
Circular Road, Douglas,
IM1 1AE, Isle of Man
Email: DPO-DHSC@gov.im
Phone: +44 1624 685013
How and why we ask you to share your personal data
We collect and process information, including personal data, to help us collect and collate feedback from service users and care professionals to improve the quality and design of health and care services across the island. We have designed our interviews, workshops and surveys to collect as little personal identifiers as possible and we will aggregate the information you have disclosed to us into reports, which will remove all personal data.
We collect and process information, such as your contact details, for organisational purposes, to plan and schedule workshops, interviews and surveys.
We may also collect and process information that may be considered as sensitive, such as physical or mental health information, when you’ve explicitly agreed to do so. We use your personal data in line with the rules set out in the Data Protection Legislation for the following reasons:
- Where you have agreed to the collection
- To allow the HCTP to communicate with you, for organising interviews, surveys and workshops, or when you have requested to be contacted by ourteams
Our legal basis for processing your information
We will only process your personal data if there is a legal reason for us to do so. We may rely on:
- Your consent – if we rely on your consent to process your information you may withdraw your consent at any time by contacting the Data Protection Officer
- The need to meet a request you have made to be contacted in relation to the HCTP, where applicable
When you decide to provide information that is considered sensitive to us, such as health or care information, we rely on your explicit consent to collect and process this information. This is purely voluntary and optional, and you will always have the choice not to disclose your sensitive information to us.
Types of personal data we collect about you
Depending on the Project, we may collect, use, store and transfer different kinds of personal data about you that you provide to us directly as follows:
- Contact information: Name, email address, telephone number
- Health or care information: Diagnosis, health history and past care received
- Other information: Feedback, comments, complaints
- Identification information: Name, title, profession, professional address
How long we keep your personal data
We will only keep your information for the minimum time necessary. This may be to:
- To respond to an enquiry from you
- To collect and process the information you have provided us with in your feedback through online surveys, interviews and workshops
How we keep your personal data secure
The security and confidentiality of your information is very important to us. We will ensure that:
- We put safeguards in place to make sure your personal data is kept securely
- We only hold your information in secure, private folders with access strictly limited only to authorised staff responsible for the analysis or use of your data
- We maintain security of the systems which hold personal data in line with ISO27001 standard
- We comply with the requirements of the PCI Security Standards Council
How we share your personal data
We may share your information:
- With or between other Government Departments, Boards and Offices to provide a service or information you have requested
- With our data processors, such as Microsoft, for collecting and processing your personal data
We will not sell to, or share, your personal data with other companies, organisations or individuals. Your personal data will not be disclosed to any other third party without your prior consent or where we are required to do so by law. When we share your personal data with third parties, we will always ensure that appropriate contractual provisions are in place to protect your rights.
Your legal rights
To ask if we hold personal data about you
You can ask to see what information we hold about you by submitting a Subject Access Request (SAR) to the Department of Health and Social Care Data Protection Officer (DPO).
To request access to your personal data
Under the Data Protection Legislation, you have a right of access to your personal data and to check the accuracy of that data by making a Subject Access Request.
A SAR is made by contacting the Data Protection Officer of the Department, Office or Board that collects the information.
To make a request of your personal data, contact the DHSC DPO whose contact details appear at the beginning of this Privacy Notice.
We may apply a charge in certain circumstances. We will respond to your request promptly and in any event within a maximum of 1 month, unless your request is complex or excessive. Depending on the circumstances, we may either extend this period for further 2 months, or refuse to respond to your request. We will always inform you of the status of your request within 1 month of receipt.
To review your personal data and ensure it is accurate
Where possible we will provide you with access to the information we hold about you so that you can view this information and provide a means for you to have this information changed if it is not accurate.
Alternatively, you can ask for the information we hold about you to be amended by making a request to the Department of Health and Social Care's Data Protection Officer.
To withdraw your consent
The participation in the HCTP is purely voluntary and we rely on your consent to process your personal data. If you decide to withdraw your consent and stop participating in the programme, please contact the Department of Health
and Social Care Data Protection Officer.
Please note that once the data is aggregated into reports, it will no longer be identifiable and withdrawing your consent will not affect the personal data lawfully collected.
To remove your personal data
You can request to remove the personal data about you. If you wish to exercise this right, please contact the Department of Health and Social Care's Data Protection Officer.
Please note that once the data is aggregated into reports, it will no longer be identifiable and requesting to remove your data will not affect data that has been already anonymised.
To make a complaint
If you are not happy about the way we have handled your personal data you can submit a complaint to the Department of Health and Social Care's Data Protection Officer who will work with you to resolve any issues.
The Information Commissioner is the independent authority responsible for upholding the public's information rights, promoting as well as enforcing compliance with the Island's information rights legislation. Further information can be found on the Information Commissioner's website.
You have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Data Protection Legislation.
Contact details
To exercise any of your rights listed above, or for any query, please contact the Data Protection Officer whose contact details appear at the beginning of this Privacy Notice.
Will this privacy notice change
This Privacy Notice may change. We will not reduce your rights under this Privacy Notice without your consent. If any significant change is made to this Privacy Notice we will provide a prominent notice on this website so that you can review the updated Privacy Notice.
This privacy notice was last updated in April 2024.
