Privacy Notice

01Who we are

Decision Data Ltd (“DDL”, “we”, “us”, “our”) is a data science company working with the NHS. We are registered in England and Wales, company number 15255015, with our registered office at Lane End, Edward Road, Winchester, SO23 9RB. We are registered with the Information Commissioner’s Office (ICO), registration number ZB628078. This notice applies to our website at www.decisiondata.org.uk and to our correspondence with you by email, phone, letter or any other means.

02The two roles we act in

For personal data about visitors to our website and the people and organisations we correspond with, DDL is the data controller.

For the AST service, DDL acts as a data processor on behalf of the NHS Trust using the AST, which is the controller. Patient data is anonymised in the browser, at source, before it leaves the Trust, so no patient-identifiable data ever reaches us. The only personal data we process through the AST is a limited set of NHS staff data, and we do so only on the Trust’s documented instructions.

03The personal data we collect, and why

Website visitors and enquiries (DDL as controller). When you contact us or ask about our services, we collect your name, work email address, phone number, organisation and the content of your message. Our lawful basis is our legitimate interests in responding to you and running our business. We use limited technical data only to keep the website secure.

NHS staff, through the AST (DDL as processor). We process a clinician’s name, place of work, work email address and growth-scan accuracy scores. The NHS Trust is the controller and determines the lawful basis for this processing under its public task. We process the data only to produce the AST’s accuracy and quality-improvement reports, and only on the Trust’s instructions.

We do not process special category data, and we do not carry out automated decision-making that produces legal or similarly significant effects on individuals.

04Anonymised and research data

We retain fully anonymised, non-personal data for service improvement and for research and audit that helps improve the assessment of fetal growth. Because this data is anonymised and cannot identify anyone, it is not personal data, and data protection law does not restrict its use.

05How we keep data secure

Our systems are hosted on Amazon Web Services in the United Kingdom. Patient data is anonymised in the browser at source; personal data is encrypted in transit and at rest; and access is limited to those who need it. We hold Cyber Essentials certification, maintain “Standards Met” on the NHS Data Security and Protection Toolkit, and have signed the NHS Cyber Security Charter for Suppliers.

06Who we share data with

We share personal data only with service providers acting as our processors, such as our UK cloud hosting provider, and with professional advisers such as accountants, insurers and legal advisers where necessary. We require them to protect your data and to use it only on our instructions. We do not sell your personal data, and we do not share it for third-party marketing.

07Where your data is held

All personal data we process is stored and processed in the United Kingdom. We do not transfer personal data outside the UK.

08How long we keep it

• Enquiry and business-contact data: only as long as needed for the purpose, and to meet legal and accounting requirements.
• NHS staff data processed through the AST: deleted within one month of completion of the project, on the Trust’s instructions. Audit logs are retained for twelve months.
• Anonymised data: may be retained indefinitely, as it is not personal data.

09Your rights

Under UK data protection law you have the right to be informed; the right of access; the right to rectification; the right to erasure; the right to restrict processing; the right to data portability; the right to object; and rights relating to automated decision-making. For staff data processed through the AST, the NHS Trust is the controller, so please exercise these rights with the Trust, and we will support the Trust in responding. For all other data, contact us using the details below. There is normally no fee, and we aim to respond within one month.

10Cookies

Our website uses a single first-party cookie that is needed to keep the site secure (anti-forgery protection). We do not use cookies to track visitors or for advertising. You can control cookies through your browser settings, although some parts of the site may not work properly if you disable them.

11How to complain

If you are unhappy with how we handle your personal data, please contact us first so we can try to put it right. You also have the right to complain to the ICO at ico.org.uk/make-a-complaint, helpline 0303 123 1113, or Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF.

12Contact us

We may update this notice from time to time. The current version is always published at www.decisiondata.org.uk.

Download the signed PDF (v3.0)