Alcura Patient Privacy Notice
Version date: 01 AUGUST 2022
Alcura is committed to respecting and protecting your privacy. Therefore, we want to be fully transparent about the ways we will use information we collect about you.
This privacy notice only applies to Alcura Homecare patients. If you work for an organisation which has a commercial relationship with Alcura or are a healthcare provider or other member of the public (not a homecare patient), please see here for the privacy notice which applies to you. Employees of Alcura can find our colleague privacy notice on the intranet.
Important information and who we are
Alcura UK Limited is the ‘data controller’ and is responsible for personal data collected in the course of providing our services to you.
If you have any questions about this privacy notice or our data protection practices please contact alcuraserviceincidents@alcura-health.co.uk. If your question is not satisfactorily answered, you may also contact Privacy@alliance-healthcare.co.uk and ask that the matter be referred to our Data Protection Officer.
What information will we collect and hold about you?
Alcura may receive the following information from your referring clinician or from you directly:
Your name and contact details (including email, phone numbers and preferred contact method).
Your address and option of an alternative delivery/treatment address.
Details of your medical condition and what treatment (medication) you are receiving.
The name of your specialist team and GP.
Your NHS number and/or your hospital number.
Alcura also assign you a unique ID number (which we refer to as an Alcura or Patient ID) which enables us to keep all of your records together.
During the course of providing our services to you, Alcura may also collect the following information about you:
Your availability and location for receiving deliveries.
Details of deliveries of medication made to you.
Details of treatments given to you by our nurses.
Details of adverse events or complications that you may suffer as a result of taking your medication or medication being administered.
Correspondence with you in relation to our services.
Information contained in recordings of telephone calls you make to us.
Patient satisfaction surveys that you complete (where you put your name on your response).
Your login credentials (either chosen by you or allocated by us) for any online portal, app or other tool which we make available to you to manage our service.
Information about how you use and interact with our website.
Why does Alcura collect and use this information?
We collect and use this information in order to:
Provide medication and healthcare services on behalf of NHS and manufacturers of medicines.
Arrange clinical waste collections.
Undertake satisfaction surveys to ensure that our services meet your needs.
Monitor the quality of our service and comply with our regulatory obligations (including our obligation to maintain patient records and report adverse events).
Manage access to online tools which we make available to you.
Demonstrate to the NHS and manufacturers of medicines (on whose behalf we provide medication and healthcare services) that we are complying with our contractual obligations to them.
Administer our business.
We will do these things on the basis that there is a legitimate interest to do so and/or because of a legal obligation that we are subject to.
What are the key groups we might share this information with?
Alcura may need to share your contact and identity information with our delivery providers to ensure your medicines arrive safely at your chosen address or that your clinical waste is collected as arranged. Our delivery and collection providers are never given any information about the contents of the parcels they deliver or collect.
We share your medical information with others involved in your treatment, such as your hospital team or GP, as appropriate.
We share information with the manufacturers of drugs you receive in order to report adverse events relating to their drugs and to provide them with information about where and how their drugs are being used. When we do this, we do not share your name or contact details. We will not share your name or contact details with any manufacturer without your express consent.
We may need to share your personal data with regulatory bodies (such as the Care Quality Commission and the Medicines and Healthcare products Regulatory Agency) in response to an audit, inspection or formal request for information.
We may give other companies within the Amerisourcebergen group and third party service providers who provide services to us (for example, finance, HR and IT services) access to your data in order to provide us with those services. We always take appropriate steps to ensure that your data is adequately protected (including having appropriate contracts in place) and that access is restricted to individuals who genuinely need it to provide the relevant services to Alcura.
For how long does Alcura keep your information?
Alcura will only keep your personal data as long as this is necessary to fulfil the purposes we collected it for and in order to comply with any legal, tax, regulatory, accounting or reporting requirements.
To determine the appropriate retention period for personal data, we consider: the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your personal data, the purposes for which we process your personal data, and whether we can achieve those purposes through other means, and any legal obligations to keep data for minimum periods of time.
The period for which we keep your data will depend on the nature of the treatment that you receive and the type of the data. For example, we are obliged to keep data relating to clinical trials and blood products for a minimum of thirty (30) years. We may also have regulatory and other obligations requiring us to keep details of drug adverse events you have suffered for a period related to the duration of the marketing authorisation for the relevant drug.
We may retain your personal data longer than our default retention period if there is a good reason for doing so. For example, if you have made a complaint or we reasonably believe that there is a chance of legal action being taken against us in relation to the services we have provided to you, then we will retain the relevant data beyond the retention period until such complaint or legal action is conclusively resolved.
If you would like more information about our retention periods for a specific category of personal data which we process about you, please contact us.
International transfers
Some of the service providers that we use and which process your personal data on our behalf may access your personal data from outside of the European Economic Area.
Where we work with a third party processing data outside of the European Economic Area (EEA), we are conscious that the laws of other countries may not provide the same level of protection for your data as the laws of the UK and the EEA. Therefore, when working with these service providers, we ensure that your data is appropriately protected by ensuring that one of the following measures is in place:
the country where the processing is occurring has been deemed to have a legal system which provides adequate levels of protection for personal data by the European Commission.
specific contracts approved by the UK or European Commission which ensure that your data has the same protection as it has in Europe.
Please contact us if you would like further information on the specific measures we use when transferring your personal data outside of the EEA.
Your rights
Under certain circumstances, you have rights under data protection laws in relation to your personal data:
Request access to your personal data (commonly known as a subject access request). You can request a copy of the personal data we hold about you, to check that we are lawfully processing it.
Request correction of the personal data that we hold about you. You can ask for any incomplete or inaccurate data we hold about you to be corrected. We may need to verify the accuracy of the new data you provide to us.
Request erasure of your personal data. You can ask us to delete or remove personal data where there is no good reason for us continuing to process it. Note that we may not always be able to comply with your request if there is a lawful reason for us to continue to process it. If this is the case, we will notify you of this when responding to your request.
Object to processing of your personal data where we are relying on a legitimate interest and there is something about your particular situation which makes you believe that the impact on your fundamental rights and freedoms outweighs that legitimate interest. In some cases, we may demonstrate that we have compelling legitimate grounds to process your information which override your rights and freedoms.
Request restriction of processing of your personal data. This enables you to ask us to suspend the processing of your personal data if: (a) you want us to establish the data’s accuracy; (b) our use of the data is unlawful but you do not want us to erase it; (c) you need us to hold the data even if we no longer require it as you need it to establish, exercise or defend legal claims; or (d) you have objected to our use of your data but we need to verify whether we have overriding legitimate grounds to use it.
Withdraw consent. You can withdraw your consent to processing at any time where we are relying on consent to process your personal data. However, this will not affect the lawfulness of any processing carried out before you withdraw your consent. If you withdraw your consent, we may not be able to provide certain services to you. We will advise you if this is the case at the time you withdraw your consent.
Complain to the ICO. Although we hope it never comes to this, you do have the right to complain to the ICO about any of Alcura processing activities at casework@ico.org.uk
If you wish to exercise any of these rights, please contact us.
Changes to this Privacy Notice
This Privacy Policy was updated in August 2022. A copy of it is available on our website. We may update it from time to time so we recommend that you check our website occasionally. If we make changes we think may affect you significantly, we will inform you in an appropriate manner so you know about the changes before they happen.