Overview

The Privacy Notice tells you about the information we collect and hold about you, what we do with it, how we will look after it, and who we might share it with. It covers information we collect directly from you or receive from other individuals or organisations.

We review our Full Privacy Notice regularly to ensure that it continually provides transparent information about the use of your data. This overview was reviewed in June 2025. The current full privacy notice can be found here. Further supporting documents, such as an easy read version, can be found at the bottom of this page.

We are committed to protecting your privacy and will only process personal information in accordance with the Data Protection Act 2018, UK General Data Protection Regulations (UK GDPR), the common law duty of confidentiality and the Human Rights Act 1998.  

Why we collect information about you

If you are receiving services from the NHS, we will need to use your information (paper or electronic) to provide services, to check the quality of your care, to help you make good decisions about your health and to investigate complaints and claims. We also use your information to:

• Check the quality of care provided by commissioned services (e.g. a clinical audit)
• Protect the health of the general public
• Monitor how we spend public money
• Train healthcare workers
• Carry out research
• Help the NHS plan for the future.

The ICB also uses patient data to analyse the health of a population. This is required for the commissioning of health services, or to help target preventive care at certain groups of patients.

Please see the graphic below to learn more about how your data is used.

Security of your information

When using information, if we need to use information that identifies you, we will always ensure that there is a fair and lawful basis for doing so.  We will always remove names and personal identifiers unless it is impossible to complete the task without them.

The ICB works with our data processors, to ensure that information is held in secure locations with restricted access for authorised personnel. We protect any personal information that is held on our systems with encryption so that it cannot be accessed by those who do not have access rights.

• Your information will not be sent by the ICB outside of the United Kingdom to a country that does not have appropriate legislation to protect your privacy.  
• We will never sell any information about you.
• We will never share your information with a third-party organisation for marketing purposes without your prior written consent. 
• We will observe your right to opt-out of the use of your personal data, or more information on Opt Outs refer to the full Privacy Notice.

Access to your information

You have the right to see or be given a copy of the personal data an organisation holds about you.  This is known as a Subject Access Request. You can make a request to the ICB please email the details to nwicb.informationgovernance@nhs.net. Tell us your details, details of the records you would like and date ranges. There are other ways to raise a request.  Full details of how to raise a request can be found in NHS Norfolk and Waveney ICB’s Information Rights Policy.

You have further rights under the UKGDPR – to find out more please view the full Privacy Notice here, or visit the Information Commissioner’s Office website.

Information sharing

There must be a legal basis to share personal information.  The ICB has signed sharing agreements and processing contracts with different partnering organisations in the ICS, to enable services to run. These are detailed in the privacy notice in the section labelled ‘what information we have and what we do with it’.  Some examples of how information is shared are below.

My Care Record

My Care Record is used throughout the East of England region and allows information to be shared for direct care purposes only.  NHS Norfolk and Waveney Integrated Care Board is a signatory to My Care Record. My Care Record is an information sharing framework, to ensure that your data is processed in a consistent and secure manner. Further information can be found on the My Care Record website. You can also see the My Care Record privacy notice here.

Sub licensing

The ICB receives de-identified (pseudonymised) information for commissioning purposes only, within the Norfolk and Waveney Health and Social Care System.  Under strict rules, the ICB can share this information with sub-licensees. A list of sub-licensees can be found here. For further details, please see the privacy notice here and NHS England sub licensing information here.

Data Hub

The ICB host the Norfolk and Waveney Integrated Care System (ICS) Data Hub, which is aimed at improving the well-being of people and communities. The Data Hub serves as a secure and centralised library, housing a wealth of information about people’s interactions with our health and care services. This data is meticulously anonymised to help us gain valuable insights into the journeys people undertake within our health and care system. 

Privacy notice documents