Privacy Policy

Who we are

Surrey Healthy Children and Families LLP is a Limited Liability Company (LLP) that delivers NHS community healthcare services to children and families within Surrey and parts of North East Hampshire and Farnham. The LLP delivers these services via three providers (known as ‘provider organisations’). These are: CSH Surrey; First Community Health and Care (First Community); and Surrey and Borders Partnership NHS Foundation Trust (SABP). Together they jointly deliver the NHS community health service known as Children and Family Health Surrey.

The LLP is a Data Controller under the Data Protection Act 1998 and our ICO registration number ZA243132. The company registration number is OC415159.

A list of services delivered through Children and Family Health Surrey can be found on our website. These services will either be provided by CSH Surrey, First Community or SABP.

This notice details the information which we collect, why we collect it and how we keep it secure, from the perspective of Children and Family Health Surrey only. You can find more detailed information relating to the LLP providers within their privacy notices: CSH Surrey, Surrey and Borders Partnership and First Community Health and Care.

What information do we collect and use

As an organisation, we are committed to protecting your information and respecting your privacy in accordance with the Data Protection Act 1998.

The LLP is responsible for the core functions and overseeing the delivery of Children and Family Health Surrey services.

We will only use data that identifies you where it is necessary to achieve a defined purpose, in accordance with the law. Purposes for which identifiable data will be used include the following;

Quality Assurance
• Regular auditing of your health records to review the service provided and to identify ways in which our services can be improved.

Investigating concerns, complaints or litigation
• If an incident occurs which was not expected or you have a concern or complaint in relation to our services, we will ensure it is investigated and responded to
• In the event of a claim being made against us, we will ensure relevant information such as the claims notification and investigation documents are passed onto NHS Resolution who co-ordinate the claim on our behalf.

Website enquiries
• We use a processer to provide the Children and Family Health Surrey website. You are able to submit enquiries to us using the Quick Contact Form which asks for your name, contact details and your message. This information is used to manage and respond to your message.
Information Requests
• We will co-ordinate and respond to any Subject Access Requests which relate to a Children and Family Health Surrey service, on behalf of the three providers.

IT support services
• Facilitating appropriate access to systems with other Children and Family Health Surrey providers and partners.
• To maintain the security and performance of our systems.

To keep track of finances
• We receive payment for the services which we provide to patients, we therefore share data with Clinical Commissioning Groups so that we can receive payment.

Performance Management
• Statistical information about your care is gathered from our clinical systems, eg waiting periods, newborn screening and vaccination programmes. This is used for planning and monitoring performance of NHS services.

How we secure your data
Where possible, we will use data which does not identify you – for example, we will remove your name & NHS number or anything else which uniquely identifies you. Where it is necessary to use identifiable data, we will only use data that is relevant and proportionate for the particular purposes, that is permitted by law.

Access to information is restricted and only shared with individuals who have a need to access the information.

All NHS employees are bound by the Common Law of Confidentiality which means all employees of the LLP’s provider organisations have a duty to keep your information confidential and secure. In addition, the provider organisations are required to provide the LLP with sufficient guarantees that they have trained their employees to ensure they are able to handle data correctly.

Children and Family Health Surrey have a Senior Information Risk Owner who is responsible for the management of all Information Assets and a Caldicott Guardian who will ensure patient confidentiality is protected and enable appropriate information-sharing. These individuals have overall responsibility for ensuring appropriate standards of handling data are applied across the Children and Family Health Surrey services.

How long will we keep information for?
Information is held for specified periods of time as per the Records Management Code of Practice for Health and Social Care.

Your rights under Data Protection
The Data Protection Act provides you with certain rights as an individual, these include:
• You can make a request for a copy of the information we hold about you.
• You can request that we do not process information that is likely to cause or is causing unwarranted damage or distress. Sometimes there might be a legal requirement or overriding public interest which means we are compelled to share data. This may include:
o Safeguarding an individual or to prevent a serious crime
o To control the outbreak of infectious diseases
o A legal requirement such as a court order
• A right in certain circumstances to have inaccurate data is rectified, blocked, erased or destroyed
• A right to claim compensation for damages caused by a breaching Data Protection.

Queries and how to access your records
If you have any queries concerning how the LLP uses your information, please discuss them with the Health Care Professional who is involved in your care in the first instance.
Alternatively, you can contact the Patient Experience Team so that your request and available options can be considered. You can telephone 01306 646 223, email, contact us through our website or write to us c/o CSH Surrey, Leatherhead Hospital, Poplar Road, Leatherhead, Surrey, KT22 8SD.

Under the Data Protection Act 1998, you have the right to request a copy of the information which we hold for you. If you require your medical records, please put your request in writing to the Subject Access Request (SAR) Team by email or post to the address above.

You can find more information on the Information Commission’s Office (ICO) website or you can write to them at:
Information Commissioner’s Office
Wycliffe House
Water Lane,


Date of review: March 2018