This notice provides additional patient-specific information and should be read alongside the Trust’s General Privacy Notice. It provides further information about:

• what information we collect and hold about you as a patient;
• where we obtain your information, including through referrals and from other health and care organisations;
• how we use your information to assess, diagnose, treat, coordinate and support your care;
• how we use your information to manage and improve our services;
• who we may share your information with for your care and other lawful purposes;
• how we use digital services and technologies to support your care and our services;
• your data protection rights and choices;
• how you can access your health records; and
• how you can raise a concern or complaint about the use of your information.

When you are referred to us, receive care or use our services, The Dudley Group NHS Foundation Trust (‘The Trust’) creates and maintains records about your health, treatment and the care we have provided or plan to provide. These records are called your health records and may be held digitally or on paper.

Depending on the care or service you receive, the information we hold may include:

• your name, address, date of birth, NHS number and contact details;
• details of your next of kin, relatives, carers or representatives;
• information about referrals, appointments, admissions, attendances, transfers and discharges;
• clinical notes, assessments, diagnoses, treatment plans and care plans;
• information about your physical and mental health;
• results of investigations, such as blood tests, X-rays, scans and laboratory tests;
• information about medicines, prescriptions, allergies and adverse reactions;
• information provided by your GP, other health and care professionals, relatives or carers;
• information about your ethnicity, religion or beliefs, language, communication needs, disabilities and reasonable adjustments;
• safeguarding, social care or family information where this is relevant to your care, safety or wellbeing; and
• correspondence and communications relating to your care, including letters, emails and telephone calls.

This list is not exhaustive. We will only collect and use information that is relevant and necessary for your care or another lawful purpose.

It is important that the information we hold about you is accurate and up to date. We may check your details when you attend an appointment or use our services. Please tell us if your details change or if you believe that information we hold about you is inaccurate.

We collect information directly from you when you receive care or communicate with us. This may be during your appointment, admission, telephone call, virtual consultation or through a letter, email, online form or other approved communication channels.

We may also receive information about you from other people and organisations involved in your health and care. Depending on your circumstances, this may include:

• your GP or another healthcare professional who refers you to the Trust;
• another NHS trust or healthcare provider;
• ambulance, community, mental health or social care services;
• local authorities and other public services;
• care homes, hospices and independent healthcare providers;
• pharmacists, laboratories and diagnostic services;
• relatives, carers, representatives or people supporting you, where appropriate;
• NHS England and other NHS organisations; and
• shared health and care records and other approved clinical systems.

We may receive your information when you are referred to us, admitted to hospital, transferred between services or organisations, discharged from our care or supported through a shared care arrangement.

Where information is provided by someone other than you, we will only use information that is relevant and necessary for your care or another lawful purpose. We will handle it in accordance with the same confidentiality, security and data protection requirements that apply to information collected directly from you.

We use your personal information primarily to provide and manage your care. This may include:

• reviewing and managing referrals;
• arranging appointments, admissions, tests and treatment;
• assessing your health and care needs;
• making diagnoses and clinical decisions;
• developing, delivering and reviewing treatment and care plans;
• prescribing and managing medicines;
• requesting and reviewing tests, scans and other investigations;
• communicating with you, your carers and other professionals involved in your care;
• coordinating your care between teams, services and organisations;
• supporting transfers of care and discharge arrangements;
• maintaining an accurate and complete health record;
• responding to enquiries, concerns, complaints and legal claims; and
• protecting you or others where there is a safeguarding concern or risk of serious harm.

We may also use information to:

• review the quality, safety and effectiveness of the care we provide;
• plan, manage and improve our services;
• monitor performance and prepare statistics;
• ensure the Trust receives appropriate payment for the care it provides;
• audit NHS services and accounts;
• train and educate healthcare professionals;
• protect and improve public health; and
• support approved research and development.

Where possible, we will use anonymised information for purposes that do not require you to be identified. Anonymised information does not identify you and cannot reasonably be used to identify you.

We may also use approved digital services and technologies to support your care and the operation of our services. These may include patient portals, digital appointment letters, text and email communications, secure online forms, clinical and administrative systems and artificial intelligence tools.

Artificial intelligence may be used to support activities such as ambient voice technology to support clinical documentation, analysis of medical images or other clinical information, service planning and administrative work. These technologies support, but do not replace, the professional judgement of our staff. Decisions about your clinical care will remain subject to appropriate human review and oversight. Where these technologies process personal information, appropriate technical, organisational and contractual safeguards are applied, and access is restricted to authorised users.

This may include healthcare professionals, NHS organisations and other care providers involved in your treatment or care.

As part of the Group model between The Dudley Group NHS Foundation Trust and Sandwell and West Birmingham NHS Trust, relevant patient information may be accessed, used or shared between authorised staff at both Trusts where necessary to support referrals, transfers of care, clinical advice, joint or shared services, care coordination and the delivery of safe and effective healthcare.

We may also share information where it is necessary to safeguard a child or vulnerable adult, protect you or another person from serious harm, prevent or investigate serious crime, protect public health, comply with a legal obligation or court order or support approved NHS planning, audit, research or service improvement activities.

Your information is only shared where relevant and necessary for the purpose. Appropriate confidentiality, security and information-sharing arrangements will be in place and access will be restricted to authorised people with a legitimate need to use the information.

Under the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 (DPA 2018) and the Data (Use and Access) Act 2025 (DUAA), you have a number of rights in relation to your personal information.

These rights may include:

• requesting access to information we hold about you;
• requesting that inaccurate information is corrected;
• requesting that certain processing activities are restricted or stopped in specific circumstances;
• objecting to certain uses of your information; and
• raising concerns about how your information is used.

Not all rights apply in every situation and some may be limited by law. We will consider each request based on the circumstances and explain our decision where a right cannot be fully applied.

Further information about your data protection rights is available in the Trust’s General Privacy Notice and on the Information Commissioner’s Office website.

You may be able to access parts of your health record through patient-facing digital services, including patient portals and the NHS App.

Through these services, you may be able to view appointment details, medical correspondence, clinical information, test results and other information made available to you by the Trust. Refer this Link.

Information available through the NHS App or patient portals may not represent your complete health record. If you would like access to information that is not available through these services, you can make a request to access your records.

The Health Records Access Team also manages applications relating to the health records of deceased people. Access to these records is governed by the Access to Health Records Act 1990.

Further information about accessing your medical records is available on the Trust website.

The National Data Opt-Out allows you to choose whether your confidential patient information is used for purposes beyond your individual care, such as research and planning. Choosing to opt out will not affect the care and treatment you receive from the Trust.

The National Data Opt-Out does not generally apply where information is being used to support your direct care.

You can find out more information or record your choice by visiting the NHS Data Matters Website.

If you have any questions or concerns about how we collect, use, share or protect your personal information, please contact Trust’s Complaints Team so we can investigate and respond. We will acknowledge and investigate concerns relating to the use of personal information and respond in accordance with data protection legislation.

If your concern relates specifically to how your personal information has been handled and you remain dissatisfied following the Trust’s response, you may contact the Trust’s Data Protection Officer at dgft.dpo@nhs.net for further advice and review.

If you remain dissatisfied after contacting the Trust, you have the right to raise your concerns with the Information Commissioner’s Office (ICO), the UK’s independent authority responsible for upholding information rights. Further information about making a complaint to the ICO is available here.

If you require any Information Governance, Data Protection or Freedom of Information policies, these are available on request from dgft.foi@nhs.net.

The Trust carries out Data Protection Impact Assessments (DPIAs) where new systems, technologies, services or information-sharing arrangements may affect privacy. These assessments help identify and manage privacy risks before implementation. Information regarding Trust DPIAs and available documentation may also be requested via dgft.foi@nhs.net.

If you require this privacy notice in an alternative format, accessible version or another language, please contact the Trusts Information Governance Team at dgft.info.gov@nhs.net and we will make reasonable efforts to meet your needs.

We may update this privacy notice from time to time. The latest version will always be available on Trust’s website.

This notice was last updated in August 2026.