Norfolk and Waveney University Hospitals Group Strategic Ambitions Programme Privacy Notice

Norfolk and Waveney University Hospitals Group Strategic Ambitions Programme Privacy Notice

Privacy notice

  1. Background – The Norwich University Hospitals Group (NWUHG), formed in May 2025, is launching a strategic programme to create a clinically – led, evidence-based blueprint for future acute clinical services and workforce planning.
  2. Who are we? – The Norfolk and Waveney University Hospital Group Trusts are:
    • The Queen Elizabeth Hospital King’s Lynn NHS Foundation Trust
    • James Paget University Hospitals NHS Foundation Trust
    • Norfolk & Norwich University Hospitals NHS Foundation Trust

    The three Trusts will be acting as joint data controllers for the purposes of the programme.

  3. Why is the programme being conducted?
    • Phase 1 – A diagnostic and design exercise to inform the development of clinical services, estates and infrastructure, and our workforce
  4. What is the basis in law for the programme to be conducted?
    Personal Data

    • Article 6(1)(c) – Processing is necessary for compliance with a legal obligation to which the controller is subject
    • Article 6(1)(e) – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

    Special Category Data

    • Article 9(2)(h) – Processing is necessary for the provision of health or social care or treatment or the management of health or social care systems and services
  5. Whose data will be used?
    • Patients and staff
  6. What data will be used?
    • Personal data and special category data
  7. How long will we keep data after the activity concludes?
    • Six (6 months)
  8. Who will be the recipient of the information?
    • The Norfolk and Waveney ICB Data Hub, who will pseudonymise (make it less identifiable) data before transferring to Strasys
    • Strasys, the contracted supplier who will perform the analysis to inform the strategy
  9. What are the data subject rights exercisable?
    • The rights to be informed, access to information and rectify (correct) information
  10. Who to contact if you have a complaint, or wish to exercice your data protection rights or require further assistance with how your information is being used:

Patient Privacy Notice

View the Patient Privacy Notice

Staff and Employee Privacy Notice

View the Staff and Employee Privacy Notice