Overview

We use and protect your personal information in line with UK data protection law, NHS confidentiality requirements and other relevant legislation, including the:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• Data (Use and Access) Act 2025

These laws help make sure we:

• use your information fairly and lawfully
• only use information for clear and appropriate purposes
• keep information accurate and up to date
• keep information safe and secure
• only keep information for as long as necessary

Guy's and St Thomas' NHS Foundation Trust is registered with the Information Commissioner’s Office (ICO), the UK's independent authority for data protection.

ICO registration number: Z7034208

Data protection law requires us to have a lawful reason for collecting, using and sharing your personal information.

In most cases, we use your information because we are providing healthcare and carrying out our duties as an NHS organisation. This includes providing care and treatment, keeping patients safe, improving services, training staff and supporting approved research.

We may also use or share information:

• to meet legal obligations, such as safeguarding responsibilities or responding to court orders
• to protect someone's life in an emergency
• where we have a contract with you, such as for employment or certain services
• for limited administrative purposes, such as fraud prevention or managing our services
• where you have given your consent, for example for some optional services or communications

Consent for your care and treatment is different from consent under data protection law.

In most cases, we do not rely on data protection consent to use information needed for your care. This means you cannot usually withdraw consent where information is needed for your care, to keep you safe, or for us to carry out our NHS responsibilities.

When we ask for your consent for a specific purpose, we will explain how your information will be used and any choices available to you.

Much of the information we hold about you relates to your health and care. This is known as special category data under data protection law and is given extra protection.

Data protection law allows us to use this information to:

• provide health and care services
• manage and improve NHS services
• protect public health

We only use this information where there is a lawful reason to do so and appropriate safeguards are in place to protect it.