Urgent help

How we use your information

Learn how the ICB collects, uses, protects, and shares your personal data, as well as your rights and the safeguards in place around your health information.

The purpose of this page is to inform you of the type of information (including personal information) that the Integrated Care Board (ICB) collects and holds; how that information is used; who we may share that information with; and how we keep it secure and confidential. This includes information we collect directly from you or receive from other individuals or organisations.

Further supporting documents, such as the full privacy notice and an easy read version, can be found at the bottom of this page.

Information about you and why we have it

We hold information centrally; this information is provided to us by the health care services you use.  We use it for statistical purposes to allow us to design and plan the commissioning of healthcare services. We will only use Pseudonymised / anonymised data for this purpose which will mean you would not be able to be identified from that information.

Examples of this include:

  • Evaluation and review of services such as checking their quality and efficiency
  • Checking NHS accounts and services
  • Working out what illnesses people will have in the future so that we can work with the local primary care services, community services and hospital services to make sure that patient needs are met
  • Preparing performance reports about the services we commission
  • Reviewing the care we commission to make sure it is of the highest standard
  • help the NHS plan for the future.

We will only use information that may identify you (known also as personal confidential data) in accordance with the: Data Protection Act 2018 – The Data Protection Act requires us to have a legal basis if we wish to process any personal information. The can be information necessary to facilitate direct health care services or manage queries or complains.

Where do we get personal data from, what do we do with it, and who do we share it with?

NHS England

  • Link information to understand how services are used and performing to understand our population needs to enable the provision of services to meet those local needs
    • This data is shared securely with our data processors to enable us to deliver our services. Anonymised data is shared with partner organisations to support service planning/delivery. Pseudonymised/deidentified reports are shared with partnering organisations who are sub-licensees
  • Contact people, by letter, SMS or phone call, who may be eligible for support due to health conditions, or circumstance. To advise what support is available to them.

Participating GP practices

  • Link information to understand how services are used and performing to understand our population needs to enable the provision of services to meet those local needs
  • Contact people, by letter, SMS or phone call, who may be eligible for support due to health conditions, or circumstance. To advise what support is available to them.
  • Provide support services such as Care Navigators or Medicines Optimisation

Individuals

  • Provide support services such as Care Navigators or Medicines Optimisation
  • Deal with enquiries such as queries, complaints, research, communication and information requests

Employees

  • Process for payroll, HR, mandatory training etc. This data is shared with HR, Payroll Provider, Electronic Staff Record

ICS Employees

  • On applications for opportunities such as funding, training, apprenticeships, mentoring programmes, etc. This data is shared during training of funding providers, such as NHS England.

Storing your personal information

The ICB works with our data processors, to ensure that information is held in secure locations with restricted access for authorised personnel. We protect any personal information that is held on our systems with encryption so that it cannot be accessed by those who do not have access rights.

  • Your information will not be stored outside of the United Kingdom.
  • We will never sell any information about you.
  • We will never share your information with a third-party organisation for marketing purposes without your prior written consent. 
  • We will observe your right to opt-out of the use of your personal data, or more information on Opt Outs refer to our privacy notice.

Your information Rights

You have the right to see or be given a copy of the personal data an organisation holds about you. This is known as a Subject Access Request.

You can make a request to the ICB please email [email protected].

You have further rights under the UKGDPR

  • Your right to rectification – You have the right to ask us to correct your personal information you think is inaccurate or incomplete.
  • Your right to erasure – You have the right to ask us to erase your personal information in certain circumstances.
  • Your right to restriction of processing – You have the right to ask us to restrict the processing of your personal information in certain circumstances.
  • Your right to object to processing – You have the the right to object to the processing of your personal information in certain circumstances.
  • Your right to data portability – You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

To find out more visit the Information Commissioner’s Office website.

Information sharing

There must be a legal basis to share personal information.  We have signed sharing agreements and processing contracts with different partnering organisations in our Integrated Care System, to enable services to run. These are detailed in the privacy notice in the section labelled ‘what information we have and what we do with it’. 

Some examples of how information can be found below.

My Care Record is used throughout the East of England region and allows information to be shared for direct care purposes only.  NHS Norfolk and Suffolk Integrated Care Board is a signatory to My Care Record. My Care Record is an information sharing framework, to ensure that your data is processed in a consistent and secure manner. Further information can be found on the My Care Record website. You can also see the My Care Record privacy notice here.

The ICB receives de-identified (pseudonymised) information from NHS England for commissioning purposes only, within the Norfolk and Suffolk Health and Social Care System.  Under strict rules, the ICB can share this information with sub-licensees. A list of sub-licensees can be found here.  For further details, please see the privacy notice page and NHS England sub licensing information here.

The Data Hub is aimed at improving the wellbeing of people and communities. The Data Hub serves as a secure and centralised library, housing a wealth of information about people’s interactions with our health and care services. This data is meticulously anonymised to help us gain valuable insights into the journeys people undertake within our health and care system.

Coverage and previous organisations

This privacy statement covers NHS Norfolk and Suffolk Integrated Care Board (ICB) and does not cover other organisations that can be linked to from this site.  Information that has been previously held by both NHS Norfolk and Waveney ICB and Suffolk and North East Essex ICB was transferred to NHS Norfolk and Suffolk ICB on 01 April 2026. The ICB will become the new data controller.  Any questions about the use of data (including patient data) by the ICB should be directed to [email protected]

Norfolk and Suffolk ICB will continue to work closely with the new forms NHS Essex ICB during the coming months, and information about both ICBs and their services may be shared to ensure the continuity of services in this transitional time.

Data Protection Officer Service – GP Surgeries

The ICB’s Information Governance team offers a Data Protection Officer Service to general practices within the ICB area. The service offers support, advice and guidance around data protection legislation to participating General Practices in Suffolk currently which may expand to Norfolk in the coming months.

The team support the GPs in various different ways including:

  • Complying with data protection legislation
  • Sharing information correctly
  • Making sure that the GP and the providers they work with look after patient data securely
  • Helping them respond to requests from patients wanting to exercise their rights

Privacy notice documents and information

Privacy Notice Easy Read Privacy Notice Artificial Intelligence in Primary Care Local Analytical Hub (LAH) – Federated Data Platform (FDP) Product Privacy Notice Maternity and Neonatal Independent Senior Advocacy Service Privacy Notice