Who This Page Is For

This page relates to Service Users and Service User Representatives, as defined below:

• Service User: An individual who has expressed an interest in, currently utilises, or has utilised services provided by MHWS .
• Service User Representative: An individual who represents a Service User in any capacity and may be their parent, guardian, friend, or relative.

Your Information Rights

Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have several rights relating to your personal information.

You may have the right to:

• Be informed about how your personal information is collected and used
• Access your personal information (Subject Access Request)
• Correct inaccurate or incomplete information
• Request deletion of information in certain circumstances
• Restrict how your information is used
• Object to certain types of processing
• Receive a copy of your information in a portable format
• Withdraw consent where processing relies on your consent

Not all rights apply in all circumstances. Where a right does not apply, or a legal exemption applies, we will explain our decision and your options.

The Information Commissioner's Office (ICO) is the UK's independent regulator for data protection and privacy rights, and publishes detailed guidance for the public on each of these.

ICO guidance - the ICO explains the individual rights available under data protection law, including access, rectification, erasure, restriction, portability, objection and rights relating to automated decision-making: For the public | ICO

Who Looks After Your Information

We take the security and confidentiality of your information seriously, with named individuals responsible for how it's protected and how your rights are handled:

Caldicott Guardian – Dr Wasi Mohamad

Provides senior advice on protecting the confidentiality of your health and care information and ensuring it is used appropriately and ethically.

Senior Information Risk Owner (SIRO) – Lia Lutfi

Holds overall accountability for managing information-related risks across MHWS.

Data Protection Officer (DPO) – Leadership Through Data

Provides independent advice and monitors our compliance with data protection law. The DPO can be contacted directly about data protection matters via https://leadershipthroughdata.com/contact/ or 01206 807 267.

Quality and Governance Manager – Ami Leech

Coordinates how we handle requests relating to your data protection rights.

What Information Do We Hold and How Do We Use It?

For information about the personal information we collect, how we use it, who we may share it with and how long we keep it, please see our Privacy Notice.

Accessing Your Records

You have the right to request a copy of the personal information we hold about you. This is known as a Subject Access Request (SAR), and covers the personal information we hold about you - not only your clinical notes.

This can include, for example:

• Care records
• Assessment records
• Consultation notes
• Correspondence
• Referral information
• Records relating to services you have received

If you're looking for something specific, let us know - it can help us respond more quickly.

How to Make a Subject Access Request

You can make a request:

• By email
• Through our website contact form
• By letter
• Verbally, including by telephone
• Via an authorised representative acting on your behalf

To help us process your request, please provide:

• Your full name
• Contact details
• Details of the information you require
• Relevant dates where known

We'll need to verify your identity where necessary before releasing any information. Rather than sending identification documents when you first contact us, we'll confirm with you what's needed and the best way to provide it securely once we've received your request.

Response Times

We will acknowledge your request within 48 hours (excluding weekends and bank holidays), and let you know what happens next, including any identity checks we need to carry out.

We will normally respond in full within one calendar month of receiving a valid request and any required identity verification.

In some circumstances, where a request is complex or you have made a number of requests, we may extend the response time by up to a further two months. If this applies, we will let you know within one month and explain why.

Subject Access Requests are usually free of charge. We may charge a reasonable fee for further copies of information already provided, or where a request is manifestly unfounded or excessive, as permitted by data protection law.

If You Are Under 18

Your personal information belongs to you, whatever your age. If you're under 18, you may be able to make your own request depending on your understanding of what this involves, or a parent or legal guardian may be able to make a request on your behalf where appropriate. We will consider your age, understanding, privacy and best interests when deciding how to respond to a request. If you're not sure what applies to you, please contact us and we'll guide you.

Correcting Your Information

We want our records to be accurate and up to date.

If you believe any information we hold about you is inaccurate or incomplete, please contact us and we will review the information and make corrections or additions where appropriate.

Please also let us know promptly if your:

• Address changes
• Telephone number changes
• Email address changes
• Emergency contact details change

Sharing Your Information

There are occasions when we may need to share information with others involved in your care or where there is a legal requirement or other lawful reason to do so.

This may include:

• Healthcare professionals
• Legal representatives
• Court officials
• Regulators
• Safeguarding agencies
• Other organisations involved in your care

Whenever information is shared, MHWS will ensure there is an appropriate lawful basis for doing so, that relevant confidentiality requirements are met, and that only information necessary for the purpose is shared.

Requests About Someone Who Has Died

If you're asking about information relating to someone who has died, this is handled differently to a Subject Access Request. Requests like this may fall under the Access to Health Records Act 1990 rather than UK GDPR, and can usually be made by a personal representative of the person who died, or by someone who has a claim arising from their death. Please contact us and we'll explain what's needed.

National Data Opt-Out

MHWS supports the National Data Opt-Out Programme (NDOP), which lets you decide whether your confidential Service User information can be used for purposes beyond your direct care and treatment (e.g. research and planning), subject to certain exemptions. Although NDOP is an NHS initiative, we apply it consistently to both NHS and private Service User's.

Full details of how we apply this are in our Privacy Notice.

For more information about the national programme itself:

• nhs.uk/your-nhs-data-matters
• digital.nhs.uk/services/national-data-opt-out

Freedom of Information

MHWS is a private healthcare provider and is not generally subject to the Freedom of Information Act 2000 in the same way as public authorities.

Where we provide services on behalf of an NHS or other public authority, some information we hold in connection with those services may fall within the scope of the Freedom of Information Act. In these circumstances, the relevant public authority is responsible for responding to the request, and MHWS will provide appropriate assistance where required.

If you are seeking information about MHWS , please contact us and we will consider requests wherever possible in line with our legal obligations, contractual arrangements and duties of confidentiality.

Need Help Exercising Your Rights?

If you wish to:

• Access your records
• Correct information
• Update your contact details
• Object to processing
• Exercise another data protection right
• Ask a question about your information

Please contact us using the details below.

Address

Oak House, Sitka Drive,
Shrewsbury Business Park,
Shrewsbury, SY2 6LG

Telephone

01743 297 937

Website contact form

Bottom of this page

Data Protection Complaints

If you are unhappy with how MHWS has handled your personal information, you can make a data protection complaint to us - see Contact Us above.

We will acknowledge your complaint within 30 days, investigate your concerns appropriately, keep you informed where necessary, and let you know the outcome without undue delay.

You also have the right to complain to the:

Information Commissioner's Office (ICO)

The ICO is the UK's independent regulator for data protection and privacy rights.

Website

ico.org.uk

Helpline

0303 123 1113

Complaint service

ico.org.uk/make-a-complaint

Quick Guide

We're Here to Help

If you are unsure which information right applies to your situation, please contact MHWS and we will help guide you through the process. Our aim is to ensure that your information is handled lawfully, fairly, transparently and securely at all times.

Contact Us Regarding Information Rights

Often the quickest way is to call us on 01743 297 937 or complete the form below:

Note: Required fields are marked with an asterisk.