Sirona (Sirona care & health C.I.C) is a Data Controller and is registered with the Information Commissioner’s Office (ICO), registration number is Z2861455. Our registered office is Sirona care & health, Badminton Rd Office, 2nd Floor, Badminton Rd, Yate, BS37 5AF.

Established in October 2011, Sirona care & health Community Interest Company are the sole provider of NHS and local authority funded adult and children’s community healthcare services across Bristol, North Somerset and South Gloucestershire (BNSSG). Sirona is a not-for-profit social enterprise committed to serving its communities and funded by the NHS and local authorities.

Sirona provide the following core services:

• Community mental health services with learning disabilities or autism
• Community health services for adults
• Community health inpatient services (four inpatient rehabilitation units)
• Community end of life care
• Community health services for children, young people and families
• Urgent care services (two minor injury units and one urgent treatment centre)

Sirona are registered for the following regulated activities:

• Accommodation for persons who require nursing or personal care
• Diagnostic and screening procedures
• Personal care
• Treatment of disease, disorder or injury

This notice is aimed at our patients, service users and others who may come in contact with our services.

Sirona is one of many organisations working in the health and care system to improve care for patients and the public.  We aim to provide you with the highest quality care. To do this we must keep records about you, your health and the care we have provided or plan to provide to you. It is important for us to have a complete picture as this information enables us to provide the right care to meet your individual needs.

The records we keep can be collected in paper form or electronically (or both) and may include:

• Personal details including name, address, date of birth, next of kin, telephone numbers, email addresses etc.
• Sensitive personal information including details and records of treatment and care, notes and reports about your health, including any allergies or health conditions; results of x-rays, scans, blood tests etc; contact we have had with you, such as appointments, attendances and home visits; relevant information from people who care for you and know you well. We may also collect other information about you, such as your sexuality, race or ethnic origin, religious or other beliefs, and whether you have a disability or require additional support with appointments (such as an interpreter or advocate).

Your information can be collected in several different ways. This might be from a referral made by your GP or another health or social care professional you have seen, or perhaps directly from you in person, over the phone or on a form you have completed.

There may also be times when information is collected from your relatives or next of kin for example, if you are unconscious or unable to communicate.

Everyone working for, or with Sirona, has a legal duty to keep your information secure and confidential at all times. Staff are trained on requirements of keeping data secure.  We are committed to protecting your privacy and will only process data in accordance with legislation.

Strict principles govern our use of your information and our duty to ensure that it is kept safe and secure. Your information may be stored within electronic or paper records, or a combination of both. All our records are restricted so that only those individuals who have a need to know the information, can get access.

In circumstances where we need to share your personal data; we will always ensure this is conducted lawfully and account the justifications for doing so.

Unless there are exceptional circumstances (such as likely risk to the health and safety of others) or a valid reason permitted by law, we will not disclose any information to third parties which can be used to identify you without your consent.

Sometimes we are required by law to disclose or report certain information that may include details that identify you. However, this is only done after formal authority by the courts or by a qualified health professional. This may include reporting a serious crime or identification of an infectious disease that may endanger the safety of others.

When we need to share personal data outside of Sirona, we always assess the potential benefits and risks to you and others. We consider whether the purpose can be achieved without sharing personal data, whether the sharing is proportionate, and what safeguards are required to protect your information. Any data shared is transferred securely and only to organisations with a legitimate need to receive it.

Below are examples of organisations we may share your information with, where necessary, to enable them to provide services on our behalf or to support the delivery and improvement of care. The data shared will depend on the specific service you are receiving from Sirona.

• External suppliers who support telephone call recording for certain services.
• Word360, who provide translation and interpretation services.
• The National Respiratory Audit Programme (NRAP), where we share relevant information for the Pulmonary Rehabilitation Audit, which monitors and improves the quality of pulmonary rehabilitation services.

Connecting Care is a digital care record system for sharing information in Bristol, North Somerset and South Gloucestershire. It allows instant, secure access to your health and social care records for the professionals involved in your care. Relevant information from your digital records is shared with people who look after you. This gives them up-to-date information making your care safer and more efficient.

Further information about ‘Connecting Care’ can be found using the web link below.

https://www.connectingcarebnssg.co.uk/

Health and care organisations across Bath and North East Somerset (BaNES), Swindon and Wiltshire are working to improve the care our population receives through a wide reaching programme of digital transformation designed to use digital technology to provide better care for local people and use our resources in a more effective and efficient way.

Part of this digital transformation programme is focusing on the development of Integrated Care Records (ICRs).

An ICR enables the different health and care organisations involved in an individual’s care to access relevant information about them without the need to access multiple IT systems.

For more information, please see the Bath and North East Somerset, Swindon and Wiltshire ICB website: Your Care Record.

Our business is based on statutory powers which underpin the legal bases that apply for the purposes of the UK GDPR. The legal bases for most of our processing are:

Article

Article 6(1)(a) – the individual has given clear consent for you to process their personal data for a specific purpose.

Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Article 6(1)(b) – processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract.

Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.

Where we process special categories data, for example data including health, racial or ethnic origin, or sexual orientation, we need to meet an additional condition in the UK GDPR. Where we are processing special categories personal data for purposes related to the commissioning and provision of health services the condition is:

Article 9(2)(a)- Explicit consent

Article 9(2)(h) – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services

Article 9(2)(b) – processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law

Sirona may rely on the following legal bases when processing your personal information:

When required to comply with the law.

This may be in circumstances to:

• Communicating when things go wrong: we have a duty which is set out under The Health and Social Care Act 2012.
• Safeguard individuals, set out in the (Safeguarding Vulnerable Groups Act 2006), Children Act 1989 & 2004.
• Notify officials of infectious diseases which present significant risk to human health and the wider public, set out in The Public Health (Control of Disease) Act 1984 and the Health Protection (Notification) Regulations 2010.
• Support other organisations with their regulatory requirements, eg Care Quality Commission (CQC), Information Commissioner’s Office (ICO).
• Support detection, investigation or to prevent a serious crime, monitor referral to treatment times and ensuring compliance with the NHS Constitution and the NHS Operating Framework, conduct audits to measure compliance with the law (e.g., Confidentiality Audits), respond to the rights of individuals requests under data protection law, share information relating to vulnerable individuals with emergency services in the event of an emergency (Civil Contingencies Act 2004).
• To support court orders requiring us to share information.

Vital interests 

To protect someone’s life. This may be in circumstances to share information to safeguard an individual and therefore prevent harm.

Public task 

When carrying out statutory, governmental or statutory functions. This may be in circumstances to deliver patient care, when responding to complaints or concerns relating to the delivery of care, when monitoring patient pathways, to share information about a patient for their direct care (subject to both the common law duty of confidence, data protection legislation), and statutory duty under section 251B of the Health and Social Care Act 2012, to manage waiting lists, performance against national targets, activity monitoring e.g. number of referrals, when undertaking local clinical audits, commission funding for treatment and/or equipment.

Legitimate interests 

This may be in circumstances to support business functions, e.g. IT support, arranging access to system, social mediageneral website enquiries, storage of next of kin data in the event of a medical emergency record and use of CCTV/body worn cameras.

We recognise the importance of protecting personal and confidential information in all that we do, and take great care to meet our legal and other duties, including compliance with the following:

• UK General Data Protection Regulation (GDPR) and Data Protection Act 2018
• Human Rights Act 1998
• Access to Health Records Act 1990
• Health and Social Care Act 2012, 2015
• Public Records Act 1958
• Copyright Design and Patents Act 1988
• Re-Use of Public Sector Information Regs 2004
• Computer Misuse Act 1990
• Common Law Duty of Confidentiality
• NHS Care Records Guarantee for England
• Social Care Records Guarantee for England
• International information Security Standards
• Information Security Code of Practice
• Records Management Code of Practice for Health & Social Care
• Accessible Information Standard
• Privacy and Electronic Communications Regulations (PECR)

Please be aware that while Sirona is not legally obligated to provide information under the Freedom of Information Act 2000, we will evaluate all requests for disclosure as part of our organisation’s commitment to transparency.

Your information will not normally be sent outside of the United Kingdom (UK). For any request to transfer your data outside of the UK, we will make sure that an adequate level of protection is guaranteed before the transfer happens.

Right of access

We have a duty to provide you with rights of access to your data when requested.

Under Data Protection Legislation 2018, patients have the right to obtain a copy of their personal records held by us; this is called a Subject Access Request (SAR).

To obtain a copy of your health records, please submit your request to the Sirona Subject Access Request Team.

Mail: Sirona care & health, Badminton Rd Office, 2nd Floor, Badminton Rd, Yate, BS37 5AF.

Email: sirona.dataprotection@nhs.net

You will need to provide your information (e.g. full name, address, date of birth,

Hospital/NHS number) and forms of identification.  You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you wish for another person to process your request on your behalf, they will need to obtain your written permission to do so before we can provide copies of health records.

This ensures we are providing confidential information to an authorised persons.

An individual may choose to nominate a representative (such as a solicitor or relative) to make a request on their behalf, however when this happens the request must be explicitly authorised by the person (e.g., evidenced by a signed letter of consent).

Those who hold Lasting Power of Attorney for Health and Welfare for an individual can apply for that individual’s records.

You can also apply on behalf of your child, with your child’s consent. If the child is unable to understand, you can see the records providing the clinician in charge of the case decides it is in the child’s best interests.

You cannot make a request to access records of a deceased individual under the Data Protection Act 2018/ UK GDPR.  To see the records of a patient/service user who has died you must be acting as their personal representative or if you have a claim relating to their death. Requests are processed under the Access to Health Records Act 1990.

Further guidance and assistance can be obtained from the Subject Access Request Team.

Your Rights (drop down) 

Depending on the legal basis for processing, you have a set of individual rights.  These are:

• The right to be informed
• The right of access
• The right to rectification
• The right to erasure
• The right to restrict processing
• The right to data portability
• The right to object
• Rights in relation to automated decision making and profiling

What is the National Data Opt-Out?

The National Data Opt-Out (NDOO) is a policy introduced by NHS England in May 2018. It allows patients and service users to opt out of their confidential patient information (CPI) being used for purposes beyond their individual care – for example, for research or service planning – where that use relies on Section 251 of the NHS Act 2006 (formerly known as Regulation 5 support).

People can register or change their opt-out preference at any time by visiting the NHS Choose if data from your health records is shared for research and planning page or calling 0300 303 5678.

How to register or change your opt-out

You can opt out at any time. Your choice will be respected by all health and care organisations, including Sirona.

• Register or update your preference, visit the NHS Choose if data from your health records is shared for research and planning page.
• Phone: 0300 303 5678
• Opting out does not affect the care or treatment you receive from Sirona or any other health or care provider.

How Sirona uses confidential patient information

When you use Sirona services, we collect information about you to provide and coordinate your care. The primary purpose of this information is your individual care and treatment. This use is not affected by the National Data Opt-Out.

In some limited circumstances, confidential patient information may be used for purposes beyond your individual care. This might include:

• Service planning and improvement by NHS commissioners (e.g. BNSSG Integrated Care Board)
• Statutory reporting to NHS England or the Care Quality Commission
• Approved clinical audit or research activities

Where any such use or disclosure relies on Section 251 support (rather than consent, anonymisation, or another lawful basis), Sirona applies the National Data Opt-Out and will not include the data of patients who have registered an opt-out.

Our compliance statement

Sirona care & health CIC is compliant with the National Data Opt-Out policy, in accordance with information standard DCB3058.

We have reviewed our uses and disclosures of confidential patient information and assessed which, if any, are in scope of the opt-out policy. Our policies, procedures, and privacy notice reflect our obligations under the policy.

This statement was last reviewed in June 2026 and will be reviewed again by June 2027.

What is not covered by the opt-out

The National Data Opt-Out does not apply to:

• Information that has been fully anonymised in line with the ICO Anonymisation Code of Practice.
• Processing based on your explicit consent for a specific purpose.
• Disclosures required by law or court order.
• Activity where there is an overriding public interest (for example, during a public health emergency).
• Children’s social care services regulated by Ofsted or the Department for Education.

More information

For questions about how Sirona uses your information, please see our full Privacy Notice.

For more information about the National Data Opt-Out, visit NHS England’s National Data Opt Out guidance.

Personal data processed for any purpose or purposes shall not be kept for longer than is necessary for the specific purposes. All NHS records are kept in line with the NHS Records Management Code of Practice 2021 and the Retention Schedule.

Sirona will regularly review the length of time we keep your personal data and securely delete information that is no longer needed for the purposes it was originally intended.

This process will enable clear and accurate data, keeping it up to date, available and confidential.

We also have the following Privacy notices that are specific to services we provide:

• Apprentices
• Body Worn Cameras
• Chat Health
• Dr Doctor
• People’s Voice Volunteers
• Recruitment and Placements

If you would like to know more about how we use your information, require information in any accessible format or language or if (for any reason) you do not wish to have your information used in any of the ways described, please contact:

Data Protection Officer
Sirona care & health
Badminton Rd Office
2nd Floor
Badminton Road
Yate
BS37 5AF
Email: Sirona.dataprotection@nhs.net

How can you make a complaint?

You have the right to make a Data protection complaint if you feel unhappy about how we use your personal information. A data protection complaint can be made if you believe that we have not complied with data protection law in the way we have collected, used, shared, stored, or otherwise processed your personal information.

We would recommend contacting our Data Protection Officer (contact details above) in the first instance to talk through any concerns that you have.

How to make a complaint

You can raise a data protection complaint with us using the following contact details:

• Email: sirona.experienceandcomplaints@nhs.net
• Address: Sirona care & health, Badminton Rd Office, 2nd Floor, Badminton Road, Yate, BS37 5AF

We will:

• Acknowledge your complaint within 30 days of receipt
• Take appropriate steps to investigate your complaint without undue delay
• Keep you informed where appropriate
• Inform you of the outcome of your complaint without undue delay

If you remain dissatisfied following the outcome of your complaint, you may then wish to contact the Information Commissioner’s Office. Please note that the Information Commissioner will not normally consider an appeal until you have exhausted your right of complaint to us directly.

Mail: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF
Helpline: 0303 123 1113 (local rate) or 01625 545 745
Email: casework@ico.org.uk
Website: www.ico.org.uk

We take the handling of your information extremely seriously. This includes any information provided via this website. We will retain any information submitted online, in digital and/or hard copy form, in order to respond or deal with any request, enquiry, feedback or other submission you may have made.

While we take every precaution to protect the information supplied to us, we cannot guarantee the safety of emails sent in. All information sent via this website or email is done so at the owner’s risk, therefore you may wish to call us if you need to pass on sensitive or confidential information. Any personal information submitted in the form of a job application will be used only for the purpose of processing that application. You might find links to third party websites on our website. These websites should have their own privacy notices which you should check. We do not accept any responsibility or liability for their notices whatsoever as we have no control over them.

We will continually review and update this privacy notice to reflect changes in our services and feedback from service users, as well as to comply with changes in the law.

When such changes occur, we will revise the last updated date as documented in the version control (below).

We reserve the right to change this notice as we may deem necessary from time to time or as may be required by law. Any changes will be immediately posted on the website, and you are deemed to have accepted the terms of the notice on your first use of the website following the alterations.

If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current legislation.