The Sexual Health Hub privacy notice

We value your trust and are committed to protecting and safeguarding the privacy of your personal information.

This privacy notice explains:

• Who we are

• Why we collect information about you

• How your information will be used

• How we keep it safe and confidential

• Your rights

Please take time to review this notice carefully and understand how your information is managed.

If you would like this information in an alternative format – such as large print, easy read, or an alternative language, please let us know using the contact details below.

1. Key definitions

UK Data Protection laws:

• UK General Data Protection Regulation (UK GDPR)

• Data Protection Act 2018 (DPA 18)

Personal data: Any information relating to an identifiable individual. This might include your name, NHS number, contact details. It can also be location data or an online identifier.

Special categories of personal data are defined as: Racial or ethnic origin, politics, religious or philosophical beliefs, trade union membership, genetics, and biometrics (where used for identification) information concerning your health, sex life or sexual orientation.

Data Controller: An entity or individual that determines how and why personal data is processed.

Data Processor: A entity or individual that processes personal data on the behalf of the data controller.

2. Who are we?

HCRG Care Services Ltd are commissioned to provide integrated sexual health services in:

• Cheshire West and Chester

• Oldham, Rochdale and Bury

• Coventry and Warwickshire

• Leicestershire and Rutland

We are the data controller for any personal information we hold about you.

HCRG Care Services Ltd is a limited company registered in England and Wales, registered number 7557877. Registered office: The Heath Business and Technical Park, Runcorn, Cheshire, WA7 4QX. Part of the HCRG Care Group of companies.

Please see our website for further information about the services we provide: thesexualhealthhub.co.uk

HCRG Care Group is partnering with SH:24 Digital Ltd (company number 16330439). SH:24 is commissioned to provide postal STI testing kits, emergency hormonal contraception and other supplementary services on our behalf.

Details on how SH:24 deliver this service and handle, process and store patient data can be found in the SH:24 privacy policy.

Coventry and Warwickshire only: HCRG Care Group has partnered with BHA for Equality (Company number 03818058) to provide targeted community engagement and participation, community STI testing, health promotion and education. Details on how BHA deliver this service and handle, process and store patient data can be found in the BHA for Equality privacy policy

Leicestershire and Rutland only: HCRG Care Group has partnered with Trade Sexual Health (Company number 03958484) to provide targeted community engagement and participation, community STI testing, health promotion and education. Details on how Trade deliver this service and handle, process and store patient data can be found on the website wearetradehealth.co.uk

Oldham, Rochdale and Bury only: HCRG Care Group has partnered with Early Break (Company Number 33220039) to employ a young person to the Voice to Voice model where a young person with relevant support and training will engage with service users by the way of focus groups and support future co-design and development, quality assurance processes across the service for young people.

3. Who can you contact regarding your personal information we hold?

Data Protection Officer

Deborah Tonkin
The Heath Business Park
Runcorn
Cheshire
WA7 4QX

via email: Ask.IG@hcrgcaregroup.com

If you are not happy about the way your information is handled, you have the right to lodge a complaint with a supervisory authority.  In the UK, this is the Information Commissioners Office (ICO).

The Information Commissioner’s Office

Wycliffe House
Cheshire, SK9 5AF

Helpline: 0303 123 1113 (local rate)
Email: casework@ico.org.ukWebsite: ico.org.uk

4. What information do we collect about you?

We will collect ‘personal data’ about you such as your name, date of birth, address and contact details. We may also ask you for more sensitive data, called ‘special category data’, such as your ethnicity, sexual orientation, and information about your health.

Health care professionals are required by law to maintain records about your health. Your health record may include:

• Your contact details and preferences.

• Your NHS number.

• Information about the treatment or care you have received.

• Supporting information such as test results, letters, or reports.

• Relevant information from other health professionals, relatives or those who care for you.

These records help to provide you with the best possible healthcare.

5. What is our legal basis for processing your information?

In order for HCRG Care Group to legally process your information a ‘lawful basis’ needs to be identified.

Our legal basis for processing your personal information falls under one of the following legal bases:

• It is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

• It is necessary for a legal obligation or such as responding to a request from a coroner.

• We have your explicit consent (where none of the above bases apply).

Our legal basis for processing special category data falls under one of the following legal bases:

• The provision of health or social care.

• Social protection law for safeguarding purposes.

• Where it is necessary to protect your vital interests - when you are physically or legally incapable of providing consent.

• It is necessary for reason of public interest in area of public health.

• We have your explicit consent (where none of the above bases apply).

6. How do we use your information?

The information we hold about you is used to:

• Provide information to make health decisions made by care professional with and for you.

• To register you on our clinical system and book an appointment.

• You will also have the option to add your appointment directly in to your mobile calendar at the end of the online booking process.

• To post home sampling kits with your consent.

• Make sure your care is safe and effective.

• To issue treatments or supply contraception.

Without your permission we will not:

• Inform your GP or healthcare professional about the fact that you had the test or your results. The only time we may need to discuss your results with a GP or healthcare professional is if we are unable to contact you by your chosen method of communication and your test is positive. This is to help protect your health.

• Refer you to other specialist services.

• Share your information.

Use of NHS number:

• We collect and use an individual NHS number where this is necessary to support the safe and effective delivery of sexual health services. This includes registering patients who choose to be registered under their formal (legal) name and accurately matching records.

• We also use the NHS number to request pathology testing from our third-party laboratory provider, The Doctors Laboratory (TDL). This ensures samples are correctly identified, processed and results are securely returned to the correct patient record. In a case where you have chosen to register into the service anonymously without the NHS number, we will request your pathology test via the paper route with multiple identifiers available.

• The NHS number is used strictly on a need-to-know basis, shared only with authorized partners involved in direct care, and handled in line with UK GDPR, the Data Protection Act 2018, and the NHS Confidentiality Code of practice.

We may also use, or share, your information for the following purposes:

• Looking after the health of the general public.

• Making sure that our services can meet patient needs in the future.

• Preparing statistics on NHS performance and activity.

• Investigating concerns, complaints or legal claims.

• Helping colleagues review the care they provide to make sure it is of the highest standards.

• Training and educating staff.

• For research purposes (we will always ask your consent for this).

Reflective practice: Health and care professionals may look at confidential patient information about the care they gave you to understand and learn from their work. This is called ‘reflective practice’ and is done to help staff to provide better and safer care. Only regulated health or social care professionals who cared for you are allowed to access your information for this reason. For further information, please see: NHS England: Using information for reflective practice

The Friends and Family Test (FFT): NHS organisations including HCRG Care Group are required to use the Friends & Family Test (FFT) to capture feedback and submit response data to NHS England each month.

Patients can access the data which will then help them make informed choices about their future care. We collect feedback from a number of different channels, including SMS text messaging, online – via our HCRG Care Group website and paper questionnaires/feedback forms.

Invoice validation: Invoice validation enables us to identify which ICB is responsible for paying for your treatment.

Section 251 of the NHS Act 2006 provides a statutory legal basis to process data for invoice validation purposes and uses your NHS number to validate payment. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly.

For further information please see: NHS Digital - how we use your information for invoice validation

CCTV: We have installed CCTV systems in our premises for the purposes of public and staff safety and crime and prevention and detection. In all locations, signs are displayed notifying you that CCTV is in operation and providing details of who to contact for further information.

Images captured by CCTV will be deleted 30 days after the CCTV footage was taken. However, on occasions there may need to be a need to keep images for longer, for example where a crime is being investigated.

You have the right to see CCTV images of yourself and be provided with a copy of the images. We will only disclose images to authorised bodies such as the police, who intend to use it for the purposes stated above. You will find our contact details at the beginning of this privacy notice if you wish to request a copy of the CCTV recording.

Home sampling kits: When ordering a home sampling kit for sexually transmitted infections, your information will be shared with a third-party provider, namely SH:24. SH:24 will send the home sampling kits to you, and when returned, carry out the testing and return results to HCRG Care Group Ltd. via a secure link. This information will not be processed further by SH:24 but will be stored on their IT servers within the UK. HCRG Care Group Ltd. and SH:24 have comprehensive agreements in place to ensure the secure and confidential processing on your information.

Without your permission we will not:

• Inform your GP or healthcare professional about the fact that you have had the test or your results. The only time we may need to discuss your results with a GP or healthcare professional is if we are unable to contact you by your chosen method of communication and your test is positive. This is to help protect your health.

• Refer you to other specialist services.

• Share your information.

SMS text service: We will ask you to update your contact preferences when you book an appointment or visit our service. This is to understand how you wish to be contacted about your results or appointment reminder. If you need to update your contact preferences or opt out of receiving SMS messages, please contact your local service. Some of our services have a dedicated results line for you to contact to obtain your results. If this service is available in your area, details will be provided when you take your test.

7. Who do we share your information with?

We may share your information for the purpose of providing you with care, or another lawful reason, with our partners and other recipients. We work in partnership with our commissioners and other health and care providers.

• NHS England and NHS Digital

• Integrated Care Boards (ICB’s)

• Other health service providers such as hospitals, GPs, ambulance services, urgent care

• Local Authorities

• Regulatory Bodies

• Trusted providers that host our IT, archiving, email and texting services and surveys.

• HCRG Care Group corporate teams who provide our ‘back office’ support – such as IT.

• Acculabs - Vasectomy andrology testing

• The Doctor’s Laboratory (TDL) - Pathology sample analysis

• SH:24 Digitial Ltd for online/postal STI testing and emergency hormonal contraception

• British Association for Sexual Health and HIV (BASHH)

• Family Planning Association Contraception

• Providers of Termination of Pregnancy Services

• BHA for Equality

• Trade Sexual Health

• Early Break

• Accredited commissioned pharmacies

• SXT – Partner notification tool

• Idox Health - Electronic clinical system

• SystmOne - Electronic clinical system

• Chat Health – SMS messaging application

• Accurx – Video consultation platform

• Manchester Action on Street Health (MASH)

• Translation and interpretation services

• NHS Trusts

• Police and judicial services

• Manchester University Laboratory – Cervical screening

• Black Country Pathology Services, The Royal Wolverhampton Hospital Trust - Cervical Screening

• Cervical Screening Management System (CSMS) - Cervical screening

• Lexacom – Digital Dictation

8. Where is your data stored and how long we keep it for?

Your information is stored in secure locations and only accessible on a need-to-know basis. These include:

• Electronic health records (EHR’s) on our clinical systems.

• Secure clinical areas.

• Internal encrypted servers.

• Approved storage companies.

We will keep your healthcare records in accordance with the NHS Records Management Code of Practice for Health and Social Care.

Please note that due to a legal hold on the destruction of records by NHS England, we are currently not destroying records that have reached their retention period. This is to support ongoing statutory public inquiries including:

• UK Covid 19 Inquiry

• Infected Blood Public Inquiry

• Historic Child Sexual Abuse Inquiry

9. How is your data kept safe?

At HCRG Care Group, we take the security and privacy of your information extremely seriously.

We recognise that you trust us with sensitive and personal data, and we are fully committed to keeping it protected at all times.

We follow NHS and UK data protection standards to ensure your information is stored, shared, and managed securely and responsibly.

Here’s how we protect your data:

• Strong encryption: All data is protected with industry-standard encryption when stored and when sent, preventing unauthorised access or misuse.

• Strict access controls: Only staff who need access to your information to provide care or manage services can view it. We use secure logins, multi-factor authentication (MFA), and role-based access permissions.

• Secure infrastructure: Our systems are hosted in trusted, NHS-approved environments that hold ISO 27001 certification as a minimum and are supported by partners who maintain additional internationally recognised security standards.

• Firewalls, continuous monitoring, and round-the-clock security operations protect these environments.

• Regular testing and assurance: We conduct ongoing security testing, vulnerability assessments, and independent audits to make sure our systems remain robust and resilient.

• Incident management: In the unlikely event of a security incident, we have a clear and well-practised process for responding quickly, containing the issue, and notifying the appropriate authorities in line with NHS and legal requirements.

• NHS compliance: HCRG Care Group completes the NHS Data Security and Protection Toolkit (DSPT) every year and aligns its controls with NHS Digital and relevant other stakeholders.

Your trust, privacy, and safety are at the heart of everything we do, and we are committed to maintaining the highest standards of information security across all our services.

10. How can I access a copy of my information?

UK data protection laws provide you with the following rights:

The right to be informed

As a data controller, we are obliged to provide understandable and transparent information about the way we process your data (this is provided by our privacy policy)

The right of access

You are entitled to request a copy of the personal data we hold about you.

The right to rectification

You are entitled to request changes to information if it is inaccurate or incomplete.

The right to erasure

Where no overriding legal basis or legitimate reason continues to exist for processing personal data, you may request that we delete the personal data.

The right to restrict processing

Under certain circumstances, you may ask us to stop processing your personal data. We will still hold the data but will not process it any further.

The right to data portability

Subject to certain conditions, you may request a copy of your personal data to be transferred to another organisation.

The right to object to processing

You have the right to object to our processing of your data where:

• Processing is based on legitimate interest.

• Processing involves automated decision-making and profiling.

• Processing would be for a purpose beyond your care and treatment, e.g., direct marketing and scientific or historic research.

You can opt-out to the sharing of this information under the National Data Opt-Out. Further information can be found at NHS Digital Data Opt-Out

The right to make a complaint

If you are not happy about the way your information is handled, you have the right to make a complaint to the data controller (HCRG Care Group).

If you are not happy with our response, you can escalate the complaint to the Information Commissioners Office (ICO).

The Information Commissioner’s Office
Wycliffe House
Cheshire
SK9 5AF

Helpline: 0303 123 1113 (local rate)
Email: casework@ico.org.ukWebsite: ico.org.uk

Please note that the above rights may not apply in all circumstances, but we will respond within a month of any requests. If you have any questions or concerns about the information we hold on you, please contact our Data Protection Officer.

How to request a copy of your information

Please email the Access to Records Team accesstorecordsteam@hcrgcaregroup.com or write to us at The Heath Business Park, Runcorn, Cheshire, WA7 4QX.

Keep us updated of any changes

Please let us know if you change your address or contact details etc. so that we can keep your information accurate and up to date.

11. Contract end provisions

In the event of the contract with the service and HCRG Care Ltd coming to an end, all relevant documentation and records will be transferred to the new provider(s).

The transfer of records will be conducted in accordance with the current UK Data Protection Law.

12. Changes to our privacy notice

We will update this privacy notice from time to time to reflect any changes to our ways of working.

Date privacy notice last updated: February 2026