Strategic Commissioning Tool

FDP Product Privacy Notice

Product Description

Your Integrated Care Board (ICB) is responsible for planning the delivery of NHS services in its area including deciding how resources are allocated. They use this Product to help decide what services to commission and to improve the NHS services provided to you. The Product enables care organisations to assess the effectiveness of their services, supporting them to plan and deliver care.

What are the purposes for processing my personal data in this Product?

The Product enables the ICB to better understand how NHS organisations in your area are providing care. It is a tool to: improve population health; enhance the patient experience; reduce unfairness in health outcomes, and support staff well-being.

What personal data about me is processed in this Product?

Personal data which has been de-identified (we call this de-identified data) will be processed by ICB in your area for the purposes above. De-identified data that is processed to create the Product and to create anonymous data that is shown in the dashboards may include data about a patient’s: 

• Postcode
• Date of birth and age
• Sex and Gender
• Living habits
• Professional Training / Awards / Education
• General Identifier e.g NHS Number
• Physical / Mental Health or Condition, Diagnosis / Treatment
• Racial or ethnic origin

This data is used to create dashboard where the information is ‘aggregate(grouped together) so that no individuals are identifiable.

Who is my personal data shared with?

De-identified data is securely analysed by a small number of data analysts in the ICB for the purposes of creating anonymous aggregated data to display in dashboards. This is data that doesn’t identify you. It is therefore not personal data. Your personal data will not be shared with any other organisation as part of this Product.

UK GDPR Information

Controllers of your personal data

Under data protection law the ICB is using the Product are the legal controllers of your personal data under data protection laws. The specific ICBs using the Product are listed on the Product Description page of the NHS England website here.

Legal grounds for processing your personal data

Under data protection law the ICB using the Product are the legal controllers of your personal data under data protection laws. The specific ICB using the Product are listed on the Product Description page of the NHS England website here.

• Public Task – Article 6(1)(e) of UK GDPR ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.
• Health Care – Article 9(2)(h) of UK GDPR ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”  In addition, the legal grounds under paragraph 2 of Part 1 of the DPA 2018 apply (health care purposes).

Processor acting on behalf of care organisations and the ICB

The data platform contractor, Palantir Technologies UK LTD is a processor acting on behalf of the NHS England who are using this Product. They provide the data platform and the technology that the Product uses and only act on the instructions of the NHS England and the ICB.

Accenture support Palantir Technologies UK LTD in their role as processor for the above purposes.

IQVIA will act as a data processor in relation to ‘treating data so that a person can no longer be identified. IQVIA teams will not have access to the identifiable data processed. 

Your rights under UK GDPR

You have the following rights under UK GDPR in relation to the processing of your personal data by the ICB for the purposes above:

• Right to be informed
• Right of access
• Right to rectify
• Right to object

Further information about these rights is in the NHS Federated Data Platform Privacy Notice here. Your ICB will also have a Privacy Notice on its own website which will explain more about how the ICB processes your personal data, your rights and how to exercise them.

Contact details for data protection officers in the ICB using this Product are here.

Does the National Data Opt Out or any other opt out apply to this Product?

The National Data Opt Out policy does not apply to this Product as the data shared with the ICB to create the Product has been collected and shared under a legal obligation (the Legal Direction) and therefore the National Data Opt out does not apply. 

More information about when the National Data Opt Out does not apply is available at When your choice about sharing data from your health records does not apply – NHS (www.nhs.uk)

Type 1 Opt Outs do not apply to this Product because the Datasets used to create the Product does not contain Confidential Patient Information that has been collected by the ICB from GP Practices. 

More information

For more information about how personal data is processed within the Federated Data Platform please see the NHS Federated Data Platform Privacy Notice here.