Skip to content

This site uses cookies. By continuing to browse the site you are agreeing to our use of cookies. Find out more here. Hide this message

About us

LAMP testing privacy notice

Why are we collecting your information?

This Privacy Notice has been written to inform staff members or 3rd parties working on behalf of York and Scarborough Teaching Hospital NHS Foundation Trust (The Trust) how we are using your information to conduct Loop-Mediated Isothermal Amplification (LAMP) COVID-19 tests. The use of LAMP tests allows us to identify individuals with COVID-19 who do not have symptoms, allowing us to take steps to protect everyone. This Privacy Notice should be read in conjunction with our Staff Privacy Notice.

Who are we?

The Trust is a ‘Data Controller’, this means that we determine the purposes for which, and the manner in which, your personal data is processed. We have a responsibility to you and your personal data and will only collect and use this in ways which are compliant with data protection legislation.

The Trust has appointed Rebecca Bradley (Head of Information Governance) to be its Data Protection Officer (DPO). The role of the DPO is to ensure that the Trust is compliant with Data Protection legislation and to oversee data protection procedures. The DPO contact details are:

York and Scarborough Teaching Hospital NHS Foundation Trust
York Hospital
Wigginton Road
York
North Yorkshire
YO31 8HE
yhs-tr.Information.Governance@nhs.net

What Information are we collecting?

  • Name
  • Address
  • Postcode
  • Date of birth
  • Gender
  • Contact number
  • Email address
  • Associated organisation
  • Site location
  • COVID LAMP-test results
  • Sample pot barcode
  • Date sample taken
  • Date sample deposited
  • Date test performed

What is our lawful basis for processing your information?

Any personal data we process is done so in accordance with the UK GDPR.

Where you are an employee:

  • Article 6 (1)(b) processing is necessary for the performance of a contract. Version 2 20/03/2023
  • Article 9 (2)(h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis.

Where you are working on behalf of the Trust:

  • Article 6 (1)(e) processing is necessary for the performance of a task carried out in the public interest.
  • Article 9 (2)(i) processing is necessary for reasons of public interest in the area of public health.

How long do we keep your information for?

We will keep your information for 30 days from when your account becomes inactive.

Who do we share your information with?

When you take part in the testing programme and receive results, we are required by law to share this information with the Department of Health and Social Care. Information on how the Department of Health and Social Care uses this information can be found here.

To share your personal data with other controllers we need to have a lawful basis for doing so. This lawful basis is:

  • Article 6 (1)(c) processing is necessary for compliance with a legal obligation to which the controller is subject.
  • Article 9 (2)(i) processing is necessary for reasons of public interest in the area of public health.

What rights do you have over your data?

Under GDPR data subjects have the following rights in relation to the processing of their personal data:

  • to be informed about how we process your personal data. This notice fulfils this obligation
  • to request access to your personal data that we hold, and be provided with a copy of it
  • to request that your personal data is amended if inaccurate or incomplete
  • to request that your personal data is erased where there is no compelling reason for its continued processing
  • to request that the processing of your personal data is restricted
  • to object to your personal data being processed

If you have any concerns about the way we have handled your personal data or would like any further information, then please contact our DPO on the address provided above. To put in a Subject Access Request please contact:

01904 725680
yhs-tr.SubjectAccessRequests1@nhs.net

If we cannot resolve your concerns you may also complain to the Information Commissioner’s Office (the Data Protection Regulator) about the way in which the Trust has handled your personal data. You can do so by contacting:

First Contact Team
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
casework@ico.org.uk // 0303 123 1113

Version 2 - 20/03/2023

Two female receptionists on the phone at a desk smiling

Feedback

Chinese Poland

View all languages >