Privacy Notice – Quality and Research


  • Child Death Review


    In accordance with statutory requirements under the Children’s Act 2004, ICBs and local authorities (as child death review partners) are able to make arrangements for child death reviews as they see fit.

    Data flows are established between partner organisations to support the systematic data capture process:

    • Health services across Norfolk and Waveney (across all sectors: acute, maternity, mental health, primary care and community);
    • Children’s social care services;
    • Police, including British Transport Police and Royal Military Police;
    • Coronial services;
    • Education; and
    • Public health.

    Legal Basis

    Children Act 2004 (the Act), as amended by the Children and Social Work Act 2017[93] in relation to the ICBs statutory responsibility to act as a “child death review partner”.

    Processing Activities

    The processing is a statutory duty for ICB’s and local authorities. The ultimate goal of the processing activity is to:

    • Satisfy the statutory duty;
    • Support the family / carers during their bereavement;
    • To ensure that all systematic collaborative review is conducted when a child dies;
    • Ensure that information from the child death review process is systematically captured in every case to enable learning to prevent future deaths.

    The data will include:

    • Information relating to children;
    • Information relating to the child’s family and/or carers;
    • Professionals engaged in the child’s care before their death;
    • Professional involved in the child’s end of life care;
    • Special category data including medical records, social care records, police records, education records.

    Information will be exchanged via secure email.

    The geographical area covered will be Norfolk and Waveney.

    During the process of review and learning on a national and local level, information will also be exchanged with the National Child Mortality Database.

  • LeDeR Programme


    The LeDeR Programme (aka. Learning from lives and deaths of people with a learning disability and autistic people) is a national programme that aims to review the death of any person who lived with learning disabilities or autism, identifying any health and social care factors relating to the death where things could have been done differently, and seeking to ensure that where care and treatment have not been at the expected standard this is not repeated elsewhere.

    Legal Basis

    Legal basis for use UKGDPR Art. 6(1)(e) and Art. 9(2)(h) - or processing contact details of family, next of kin, friends

    The use of personal data for the programme is specifically approved under S251 of the NHS Act 2006. This approval is subject to the National Data Opt-Out, which means that if the patient, or those with a legal relationship to act on their behalf, have opted-out of sharing their confidential information beyond their care and treatment, an independent LeDeR review of the death should not take place

    Processing Activities

    Type of data: Personal and Special Category

    Source of data: Primary Care, Secondary Care and Community Care

    The programme is co-ordinated by NHS England. The ICB participates in the programme by co-ordinating reviews at a local level.

    Relevant deaths are notified to the programme via a secure web portal. This information is then shared with the ICB for patients who were registered with GPs in Norfolk & Waveney.

    Trained reviewers in the ICB’s LeDeR Team then seek further information about the person who has died from health and care professionals who were involved in supporting the person, including information about their health and care and the circumstances leading up to their death. The LeDeR Team will also contact, where possible, those closest to the patient, including their families and/or carers, so that they can contribute to the review should they wish.

    The personal identifiable information collected for LeDeR reviews is uploaded, stored and communicated via a secure web platform protected by rigorous processes that meet NHS information governance requirements. Reports shared with local steering groups and other forums for the promotion of improvement and learning are shared in anonymous form. Information relating to LeDeR reviews is retained by NHS England for a period of 5 years from the completion of a review.

    The ICB does not retain personal identifiable information relating to reviews locally.

  • Community Keyworker - National Evaluations


    The National Evaluation has been set up to gain a picture of progress of the Keyworker Programme in line with the NHS Long Term Plan.

    This will support with the management and planning of future developments. NHSE is conducting this national evaluation to understand the impacts and value of the programme.

    Norfolk and Waveney ICB are a member of NHSE’s Keyworking Steering Group Evaluation Sub-group. Norfolk and Waveney ICB are the Lead Provider on behalf of early adopter organisations.

    Legal Basis

    NHS Act 2006 – Health and Social Care Act 2012

    Processing Activities

    NHS England (NHSE) have commissioned NHS Arden & GEM Commissioning Support Unit (AGEM CSU), who are working with the National Children's Bureau, to undertake the national evaluation of the Keyworking programme

    Each Provider, as Data Controller, submits their activity and outcome data, in line with the Data Specification, via the NHSE Data Landing Portal.

    AGEM CSU and National Children’s Bureau will make contact with all Keyworking sites for access to relevant information to enable successful evaluation. AGEM CSU and National Children’s Bureau will receive records and documents from these local service contributors for the purpose of evaluation. Participants will be identifiable to the evaluator from this data flow. The dataset will include information on sex, age, information about diagnosis, treatment, and outcomes.

    AGEM CSU and National Children’s Bureau will receive patient/service user, staff identifiable data, along with, where possible and practical to the required outcomes of this process, pseudonymised data. AGEM CSU and National Children’s Bureau will also collect information through interviews, which will be anonymised before sharing with NHS England.

    Only anonymised information for purpose of reporting the recorded aims and objectives will be shared with NHSE by the evaluator.

  • Evaluations


    To support and facilitate evaluations within Norfolk and Waveney ICB/ICS. Evaluations ensure services and initiatives meet their aims, to monitor and improve the quality of health services by gaining patient and service user experience and feelings.

    Legal Basis

    Whilst you will consent to complete the evaluation forms, and these forms will advise you what will happen with the information you provide, the legal basis for processing this information is a task in the public interest, established by statute or University Charter. standards-legislation/data-protection-and-information-governance/

    Explicit Consent – We will need to rely on your explicit consent in writing to conduct evaluation interviews and focus groups using identifiable information.

    Processing Activities

    Where identifiable data is required for evaluation purposes, the service user will only be contacted by the health care organisation who provided the original care. The individual will ask if they wish to participate in the evaluation and be informed about how their information will be processed for this purpose.

    Once information is received it will be kept securely and analysed. The analysed data will be presented in reports for patients and the NHS. We might want to use some of your anonymised comments in reports to help us show what has worked well and where it could be improved.

    Information will be held as per the record keeping standards.

  • Micro-aggression portal


    To enable citizens to give open and anonymous feedback about any negative experiences they have witnessed or received due to.

    Micro-Aggression Portal - Norfolk and Waveney ICS (

    Legal Basis

    Explicit Consent

    Processing Activity

    Information submitted may be considered sensitive even though it does not name individuals so will be treated as if it is.

    • No personal information will be collected through the portal
    • Any personal information provided in error will be redacted before being shared
    • Anonymised data from the portal will be shared with system providers
    • The portal explains fully what data will be collected, why we are collecting it and what it will be used for
  • Management of General Dental Services


    To respond to enquiries and information sent through from the ICB Enquiries team, raising issues through the appropriate channels to reach resolution.

    Legal Basis

    NHS Act 2006, Health and Social Care Act 2012

    Processing Activities

    Responding to enquiries received through the Dental generic inbox from Dental Providers or members of the public. Members of the team investigate these matters, which may contain provider details and patient NHS number. Emails are not forwarded on unnecessarily to avoid information being overshared.

  • PRIMARY CARE - Management of Special Allocation Scheme (SAS)


    To manage patients that have been transferred onto the Norfolk and Waveney SAS Scheme and those patients that are being considered for inclusion and removal from the SAS scheme. NHS England » If you are a patient assigned to the Special Allocation Scheme

    Legal Basis

    NHS Act 2006, Health and Social Care Act 2012

    Processing Activities

    Processing and managing requests from GP Practices to transfer patients onto the SAS Scheme.

    Sharing and working with the GP Practices and Primary Care Support England (PCSE) Primary Care Support England - Primary Care Support England.

    Supporting general complaint correspondence from patients on the scheme.

  • Provision of Pharmacy and Ophthalmology Services


    Pharmaceutical Services and Local Pharmaceutical Services Functions

    Primary Ophthalmic Services Functions Effective delivery of the services

    Legal Basis

    NHS England delegates the Delegated Functions to the ICB under section 65Z5 of the NHS Health and Care Act 2022

    Processing Activities

    NHS Hertfordshire and West Essex ICB are hosting the above services for Norfolk and Waveney patients on behalf of the NWICB.

    The NWICB will be in receipt of contract management and performance information. To enable the effective running of these services.

    Privacy notice – Hertfordshire and West Essex NHS ICB

  • Quality, Equality & Safety


    To process your personal information if it relates to a complaint, or provider contract where a quality issue has been raised. If you have asked for our help or involvement or where we have a duty to investigate where a risk to patient safety or potential harm has been highlighted.

    Legal Basis

    NHS Act 2006, Health and Social Care (Safety and Quality) Act 2015. If you have initiated we will ask for your explicit consent to investigate with our providers.

    Processing Activities

    If you have raised a concern about a provider or a service that we commission, we will use your information to communicate with you and to investigate any concern that you raise in relation to that provider or service.

    Where a provider raises a concern about another provider, we may use your information (including personal details such as name, NHS number, date of birth) in order to allow an investigation to be undertaken into the concerns raised where this relates to quality and patient safety.

    Where we are investigating concerns relating to several organisations, your information may need to be shared with those organisations involved in your care in order for any concerns to be investigated.

    Where a complex issue has been raised and it is necessary to bring providers together to find a solution, we will act as facilitators in multi-disciplinary team meetings to ensure a coordinated approach in ensuring the best possible outcomes for patients.

    Information gathered can be anonymised and used to analyse trends and equalities across the population

  • Safeguarding


    Advice and guidance will be provided to care providers to ensure that adult and children’s safeguarding matters are managed appropriately.


    Access to identifiable information will be shared in some limited circumstances where it is legally required for the safety of the individuals concerned.

    Legal Basis

    Statutory Obligation – Care Act 2012

    Processing Activities

    Due to public interest issues, i.e., the need to protect the safety and welfare of vulnerable children and adults, we will rely on our statutory obligation to process person identifiable information, rather than seek consent.

  • Special Education Needs and Disability (SEND)


    To support the processing of data for a child or young person who has special education needs and disabilities. (SEND) The ICB is has a role in co-operating with councils and education with multiagency working

    The ICB has a Designated Clinical Officer (DCO) role which supports the Integrated Care Board (ICB) to meet our statutory responsibilities for children and young people with SEND. The DCO plays a key part in putting into action the SEND reforms, and in supporting joined up working between health services and local authorities.…

    Legal Basis

    UK GDPR,

    Article 6(1): (e) Public Task, processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller.

    Article 9(2)(h) Health or social care (with a basis in law)

    Children and Families Act 2014 and SEND Code of Practice 2014.

    The Children and Families Act (2014) requires Integrated Care Boards and Local Authorities to work together with children and young people with SEND and their families, to ensure that appropriate services are available to meet their needs and enable them to live ordinary lives.

    Processing Activities

    The processing is a statutory duty for ICB’s and local authorities

    Information is collected by the County Councils to inform the overall SEND process.

    The ICB has a Designated Clinical Officer role which supports the Integrated Care Board (ICB) to meet our statutory responsibilities for children and young people with SEND. The DCO plays a key part in putting into action the SEND reforms and in supporting joined up working between health services and local authorities.

    The ICB will have access to information to assist in the co- production of Education Health Care Plans (EHCP) for a child or young person with SEND. Liaising with families and professionals to agree appropriate plans to support their needs.

    Information will be both personal and special category information



    Local system ID Sex/ gender Age

    Date of birth Address/ postcode Ethnicity

    Early Help and Social Care data (where it applies to or is part of the EHCP application, plan or review).

    Children’s statutory education school or post-16 education destination information

    Health (where it applies to or is part of the EHCP application, plan or review, NHS Number).

    Disability status

    SEND data, including EHCP and Annual Review information and content, High Needs Funding banding information.


    The ICB is required as part of SEND legislation to monitor quality and improvements within the multi-agency system for children and young people with SEND. This involves the Auditing of quality and improvement of Statutory health advice for EHCP needs assessments and reviews following any actions from Joint area SEND inspections. The ICB have a duty to ensure CYP health needs are met as part of EHCP which requires joint quality review visits.

    The ICB will also act as mediator, where there is disagreement resolution and tribunal dispute. It can sit on panels relevant to support required for the child or young person, such as but not limited to, placement panels, exception funding panels, and tripartite funding panels.

    Local Authorities and NHS also contact the ICB for advice and support and escalate where necessary, Children & Young People with SEND under SEN needs but are not under an EHCP as well as those with medical needs moving around and in and out of our ICB area to and from others.


  • Applicants for letters of Access (LOA) /Honorary Research Contracts (HRCs)


    To ensure that individuals hold the appropriate skills/qualifications to participate in research.

    Legal Basis


    The NHS Act 2006

    Processing Activities

    We hold and store copies of your applications and Letter of Access (LOA) / Honorary Research Contracts (HRC) we have issued.

    Where the application is for research at a partner organisation (Norfolk Community Health and Care NHS Trusts (NCH&C) or East Coast Community Healthcare CIC (ECCH)) we will share relevant details with the partner organisation for the purposes of issuing the LOA or HRC.

  • Research Grants / Bursaries / Funding and collaboration


    To support valuable research across Primary and community Care in the East of England. The ICB Research team support Recipients of Research Bursaries / Research Capability Funding (RCF) Awards and individuals collaborating on, or applying for, National Institute for Health and Care (NIHR) research grant applications through the ICB.

    Legal Basis


    The NHS Act 2006

    Processing Activities

    The ICB hold and store personal details for the purposes of processing applicants, calculating costs, managing appropriate funding payments and progress reports.


    Where appropriate details of the spending are:

    • reported to the Department of Health and Social Care (DHSC) as part of mandatory reporting requirements, for RCF and for NIHR held grants.
    • Shared with the grant funder as part of the application process