Adult Social Care Privacy Notice

Learn about personal data protection and the NHS Number - including how your information is collected, why it's collected, who it may be shared with and how to opt out.

1. Privacy notice - Westminster City Council Adult Social Care

Adult Social Care aims to help residents stay independent and safe in the community for as long as possible and to improve their well-being. We do this by working with a number of agencies in the public, private and voluntary sector to organise the appropriate level of care.

Working with a range of agencies means we can personalise the care and support you receive, and offer you flexibility, choice, and control.

We keep records on you so we can:

  • plan and provide appropriate care and support
  • work with you and our colleagues to deliver high quality care
  • provide you with safe and effective care

Westminster City Council adult social care service collects and processes personal information about you. The council is registered as a data controller under the Data Protection Act 2018.

This privacy notice broadly explains what information we collect, the purpose for processing it, and the types of personal information and who we may share it with.

It applies to all personal information collected for or on behalf of the council whether by letter, email, face-to-face, telephone, online or any other method.

Purpose for processing your information

By processing we mean the organisation, retrieval, consultation, use and deletion or destruction of information and its disclosure to other agencies necessary for tasks to be carried out in the public interest or for the provision of health or social care services.

Your personal information is only used for a specified purpose(s) but if we intend to use it for any other new purposes we will normally ask you first. In some cases the Council may wish to use your information in an anonymised form which does not identify you for another purpose such as improving and developing services.

We will only share information where it is appropriate and legal to do so. We may also share information, for example, if there is a risk of serious harm or threat to life, for the prevention and detection of fraud or crime, assessment of any tax or duty or if we are required to do so by any court or law.  Where this is necessary, we are required to comply with all aspects of the data protection laws.

Where practicable and reasonable we will always seek to inform you of any significant proposed changes to how we process or intend to process your personal data.

The categories of personal information that we collect and use may include the following:

  • personal and family details
  • lifestyle and social circumstances
  • financial details
  • employment and education details
  • housing needs
  • visual images
  • details of personal appearance and behaviour
  • case file information

We may also collect and share additional information known as ‘special categories of personal data’ where appropriate including:

  • health assessment
  • professional’s referrals
  • mental capacity assessments
  • racial or ethnic origin
  • religion
  • sexual orientation
  • biometrics (where used for ID purposes)

How we collect your information

We may collect information about you in various formats, for example by letter, email, face-to-face meetings or visits to your home, telephone, or on-line forms. 

Who we may share the information with

To meet our statutory obligations under law, as well as to provide you with a service where appropriate, we may need to share the information you provide us with other professionals such as:

  • general practitioners and other health professionals (including hospitals and mental health trusts)
  • commissioned health care providers
  • other commissioned services such as home care, care home, day care and transport providers
  • internal departments within the Royal Borough of Kensington and Chelsea
  • government departments including the Department for Work and Pensions, the Department of Health and Social Care, the Ministry of Housing Communities and Local Government or the Ministry of Justice
  • the Metropolitan Police Service and other police services
  • the London Fire Brigade and other fire services
  • probation services
  • other local authorities (Children and Adults Social Care and Education departments)

Information may be shared with Health partners using the Whole Systems Integrated Care Record (WSIC), click here to find out more.

We will only share your information with internal departments and other service providers, contractors and/or partner bodies where it is necessary:

  • to comply with a legal obligation
  • to provide you with a service you have requested
  • where permitted under the Data Protection Act 2018
  • where the disclosure is necessary for the purposes of the prevention and/or detection of crime
  • where it is necessary to allow a third party working for or on behalf of the council

We will strive to ensure that any personal data in our care will be kept safe and that where your information is disclosed to a third party, we will seek to ensure that the third party has sufficient systems and procedures in place to prevent the loss or damage of personal data.

We will not use your personal data for third party marketing purposes without your prior express consent.

How long do we keep your information?

We will only keep your information for as long as is required by law and to provide you with the necessary services in line with our stated retention policy. 

Your rights and access to your information

You have the right to request a copy of the information that we hold about you. 

The Data Protection Act 2018 also gives you additional rights that refer to how the Council holds and uses your information.

Consequently, under certain circumstances, by law you have the right to:

  • the right to object and restrict further processing of your data; however, this may affect service delivery to you.
  • request to have your data deleted where there is no compelling reason for its continued processing and provided that there are no legitimate grounds for retaining it.
  • request your data to be rectified if it is inaccurate or incomplete
  • have your data transferred or copied should you move to another authority
  • not be subject to automated decision-making including profiling

For more information about how to submit a Subject Access Request please contact:

post: Data Protection Team Information Services, Westminster City Council, 64 Victoria Street, London, SW1E 6QP


If you have any concerns or queries about data protection

Please send an email to this address for further details:

Royal Borough of Kensington and Chelsea:
Westminster City Council:

You have the right to comment or complain to us if you think we have not complied with our obligation for handling your personal information. Please contact us at:

post: Customer Engagement Team, Westminster City Hall, 64 Victoria Street, London, SW1E 6QP

phone: 0800 587 0072


The Information Commissioner is the UK's independent body set up to uphold information rights. If you have any concerns regarding our privacy practices or about exercising your Data Protection rights, you may contact them:

post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

phone: 0303 123 1113 or 0162 554 5745


Changes in your circumstances

You must notify us immediately if there are any changes in your circumstances and personal details so we can maintain an accurate and up to date record of your information.

Your records: your rights

You can read more about how we use your information and about your rights in this leaflet available on the People First website.

2. Privacy notice - Whole Systems Integrated Care (WSIC)

The Adults Social Care Department in Westminster City Council is a participant in WSIC. The Fair Processing Notice set out below is produced by the North West London Collaboration Partners, of which Westminster City Council is a member.


WSIC refers to the Whole Systems Integrated Care Programme, and is sometimes referred to as WSIC, WSIC Dashboard, WSIC Integrated Care Record. It is an electronic record used by health and care professionals to record key information about your care. It’s different from previous records as all the health and social care teams involved in your care can share a summary of relevant information from your health and social care records, providing a joined-up history of your care. The record holds your contact details, your date of birth and your NHS number, as well as details about your health and treatment.

Who are we?

WSIC has been established by health and social care providers (e.g. GPs, hospitals, mental health and community providers, and social services) from across North West London. For the purposes of the Data Protection Act, these partners collectively form the North West London Collaboration Partners and are the data controllers for WSIC. More information on the North West London Collaboration Partners, who they are and what they do can be found at the following links on their website:

You can contact the Data Protection Officer at or via our postal address. Please mark your correspondence with ‘Data Protection Officer’. You can find more information about the role of the DPO here.

How we collect your data

If your health or care organisation is part of the WSIC programme then data will be automatically extracted from your health and/or care records, and processed to create an ‘integrated record’. Any organisation who participates in the programme will have agreed, and be bound by the terms of the North West London Digital Information Sharing Agreement and data will be processed according to the North West London Information Sharing Protocol.

You don’t need to do anything for this to happen. This is because your health and/or care organisation have legal responsibilities when delivering their services, to share information where this will facilitate care for an individual. It is on this basis that data is collected and processed. You do have a choice whether you want this to continue or you would like to opt out. Details on this are provided in the ‘Can I Opt-out?’ section below.

What data do we collect?

The information collected includes your name, address, postcode, your date of birth and your NHS number, as well as details of your health and treatment.

How we use your information

This information is collected to produce an electronic record or dashboard of key information about your care. It provides a joined-up view of your care and allows your health and care team to access a complete picture of your care wherever they are, making the treatment you receive safer and more accurate. Medication history, diagnosis, alerts and allergies are among key information shared among all your care organisations and means that:

  • you won’t have to explain your medical history over and over again to different people
  • you won’t need to repeat details about your medications, treatments or medical history every time you see a new health or care professional; and
  • you can be more involved in decisions about your care to support your health and well- being.

Click here to hear our patient stories and to find out more about why integrated care is so important to people and their families.

Your data is also used to support the improvement of health and care services across North West London. Researchers, doctors and people running health services use small amounts of information which doesn’t directly identify you to understand how our health is changing and the best ways to plan services, monitor safety and evaluate NHS policy. This information is called ‘de-personalised data’. They won’t be able to identify you from this information. De-personalised data is information about your care. It doesn’t include:

  • name
  • date of birth
  • phone number
  • email
  • address
  • NHS Number

You can find out more about de-personalised data and how data is used in the NHS at the following website.

Improving health and care services

De-personalised data will be shared with Clinical Commissioning Groups (CCGs) to help them understand what types of services the NHS should provide and where. This will help them to commission better health and care services for you.


The information from patient records is valuable to help understand more about disease and develop new treatments. The NHS may collaborate with academic researchers and industry partners to do this. To find out more about research work in North West London, please see the Imperial College Health Partners website.

Who will see my data?

Your WSIC dashboard/record will be seen only by health and care professionals directly involved in your care. This includes GPs, consultants, nurses and care co-ordinators. Authorised researchers will be able to view your de-personalised data, but this will not identify you.

How long is my data kept for?

Your data will be kept in line with NHS Guidance (see Records Management Code of Practice for Health and Social Care 2016), which sets out what people working with or in NHS organisations in England need to do to manage records correctly. It's based on current legal requirements and professional best practice. Appendix 3 of the Code contains detailed retention schedule and sets out how long records should be retained, either due to their ongoing administrative value or as a result of a statutory requirement. In the case of your WSIC record it is made up of many components therefore the longest retention period applies and they are kept until 10 years after death.

Please note that this retention period is being applied by the NHS, to include all of their data. Your social care record itself will be maintained in line with the council’s social care retention periods, which will differ and will depend on the nature of the services and support you received prior to your case being closed.

Where is my data stored?

Your data is processed and stored on servers based in the United Kingdom. These are secured by state of the art datacentre facilities, with robust technical and organisational controls in place. The facilities and services we use are audited annually to make sure the highest standards are maintained.

Can I access my information?

You have the right to access information we hold about you. You can do this at any time by contacting us through our contact page.

Can I request my information is updated if I think it is incorrect?

If you believe any of your information is inaccurate then you have the right to request that it is updated. You may also request that access to your information is restricted until the correction is made. Please use the contact page to get in touch.

Can I opt-out?

It’s your choice to share your information through the WSIC dashboard. If you don’t want to share your information, you can opt-out. Opt-out forms are available at your GP practice or online. If you can’t find a form in your GP reception, please ask the receptionist or your GP. Your GP will record your choice and your information will not be shared. Opting-out won’t affect your care in anyway. You’ll still be able to receive health services. However, you will not receive the benefits of having an WSIC Dashboard. Opting-out could mean that:

  • you will need to tell each professional providing your care about your medical history, treatment, allergies and medication
  • decisions about your care may take longer
  • appointments and tests may be repeated

If you change your mind and want your information shared, you can inform the GP practice or care professional treating you, and they will mark your record.

What can I do If I have any concerns?

If you have any concerns, or are unhappy about how your data is being used please get in touch through any of the contact methods below:

post: WSIC Dashboards Team, NWL CCCGs, 1st Floor, 15 Marylebone Road, London, NW1 5JD


Alternatively, you can raise a concern with the Information Commissioners Office (ICO) who are the UK data protection regulator who will investigate your complaint. Please see the Information Commissioner’s website for more details.

3. Privacy notice - NHS Number

Purpose for processing your information

If you are receiving support from adult social care then the NHS may share your NHS Number with Westminster City Council’s adult social care department. This is so that the NHS and adult social care are using the same number to identify you whilst providing your care. By using the same number, the NHS and Westminster City Council’s Adult Social Care Department can work together more closely to improve your care and support.

The use of joined-up information across health and social care brings many benefits. One specific example where this will be the case is the discharge of patients into social care. Delays in discharge (commonly known as bed blocking) can occur because details of social care involvement are not readily available to the staff on the hospital ward. The hospital does not know who to contact to discuss the ongoing care of a patient. The linking of social care and health information via the NHS Number will help hospital staff quickly identify if social care support is already in place and who the most appropriate contact is. Ongoing care can be planned earlier in the process, because hospital staff will know who to talk to.

The addition of the NHS Number to social care data will bring additional benefits:

  • better coordination and safer care across health and social care enabled through the sharing of real-time information
  • better coordination of discharges from hospital into social care, as explained above
  • more time to spend on planning and coordinating social care because health staff can identify and involve social care staff earlier in the process
  • earlier intervention to maximise the opportunities or reablement services leading to greater independence for patients
  • less paperwork and more efficient use of social care resources

We collect the following information:

  • your NHS number

How we collect your information

We obtain your NHS Number through an NHS service called the Personal Demographic Service (PDS). Westminster City Council’s Adult Social Care Department sends basic information we collect from you, such as your name, address and date of birth to the PDS in order to find your NHS Number. Once retrieved from the PDS the NHS Number is stored in the council’s dedicated adult social care case management system, to ensure that security controls are in place, and access is controlled

The NHS Number then has 2 uses:

  • it provides a unique identifier for the information in the council’s adult social care case management system, for the provision of direct care.
  • it is also available for use in an integrated care record system across a number of support services including GPs, hospitals, community matrons, district nurses and social care practitioners

The council’s IT security and confidentiality policies ensure that your information is protected, and available only to staff directly involved in your care.  These policies are available by contacting the data protection officer. Find contact details and read the council’s privacy notice.                

Who the information is shared with

The council will share information only to provide health and social care professionals directly involved in your care access to the most up-to-date information about you.  It will do this by sharing appropriate information between health and social care services at the time of patient contact. Access to information is strictly controlled, based on the role of the professional. For example, social workers will only have access to information that is relevant to the execution of their care duties.

The council’s IT security and confidentiality policies ensure that your information is protected, and available only to staff directly involved in your care. These policies are available by contacting the Information Management team.

We may also anonymise  some personal data you provide to us, so that you cannot be identified, and then use this data to allow the council and the NHS to effectively target and plan the provision of services.

Details for transfers

We share this data by securely submitting details of the services that we may provide to you for inclusion in a shared system, which approved health and social care professionals may access. That system may also hold information such as your prescribed medicines or your hospital admissions, provided by your GP or by the hospital.

Along with social care departments, GPs, hospitals, community and mental health trusts across North West London are participating in this initiative.

How long do we keep your information?

We will only keep your information for as long as the law requires and to provide you with the necessary services in line with our stated retention policy.

In general, we retain information related to adult social care for 6 years after we have ceased to assess your needs or provide services to you. In mental health cases, this period rises to 20 years.

Your right to opt out from the use of your NHS Number

You have the right to object to the processing of your NHS Number in this way. This will not stop you from receiving care, but will result in the benefits outlined above not being realised.  To help you decide, we will discuss with you how this may affect our ability to provide you with care, and any other options you have.

If you wish to opt out from the use of your NHS Number for social care purposes, please talk with your social worker or contact us:

phone: 020 7641 2500


If you have any concerns

Please contact us using the contact details above if you would like to know more about the information we hold about you and how we use it.

You have a right to complain to us if you think we have not complied with our obligation for handling your personal information. Read more about our data protection policies.

If you are not satisfied with the council’s response you have a right to complain to the Information Commissioner’s Office (ICO).

Changes in your circumstances

You must notify us immediately if there are any changes in your circumstances and personal details so we can maintain an accurate and up to date record of your information.

4. Privacy Notice - NHS National Data opt-out

The information collected about you when you use our services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

  • improving the quality and standards of care provided
  • research into the development of new treatments
  • preventing illness and diseases 
  • monitoring safety
  • planning services

All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.

We only do this when there is a clear legal basis to use this information. Currently, we ensure that anonymised data is used so that you cannot be identified, in which case your confidential patient information isn’t needed.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. Otherwise, you have the right to opt out through the NHS national data opt-out. If you do choose to opt out your confidential patient information will still be used to support your individual care.

Should a situation arise where we did need to use or share confidential patient information for one of these purposes, and we had a lawful right to do so, we would first consult the NHS National Data Opt-Out information in order to determine whether we could or could not include your confidential patient information.

To find out more or to register your choice to opt out, please visit the NHS website

On this web page you will:

  • see what is meant by confidential patient information
  • find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
  • find out more about the benefits of sharing data
  • understand more about who uses the data
  • find out how your data is protected
  • be able to access the system to view, set or change your opt-out setting
  • find the contact telephone number if you want to know any more or to set/change your opt-out by phone
  • see the situations where the opt-out will not apply

You can also find out more about how patient information is used at NHS information about patients, which covers health and care research, and understanding patient data, which covers how and why patient information is used, the safeguards and how decisions are made.

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.


Last updated: 19 May 2020