Patient Privacy Notice 

Last updated: 12 October 2026 

​

Fen Response Medical respects your privacy and is committed to protecting your personal information. When you receive assessment, first aid or medical care from us, we need to collect and record certain information to support your care and maintain an accurate record of what happened. 

​

This notice explains what information we collect, why we use it, who we may share it with and your rights. It applies to patients receiving our event medical and prehospital care services, including people who decline treatment or are referred to another healthcare provider. 

​

1. Who is responsible for your information? 

​

Fen Response Medical, is the data controller for the patient records we create and manage. This means we decide how and why those records are used. 

​

For questions about your information or to exercise your rights, contact: 

​

Email: info@Fenresponsemedical.co.uk 

​

Postal address: 205 New Barns Avenue, Ely, Cambridgeshire, CB7 4RE 

​

For the attention of: Data Protection Lead 

​

Where another healthcare organisation takes over your care, it will normally be responsible for the records it creates and will have its own privacy notice. 

​

2. What information do we collect? 

​

We collect information relevant to your assessment, treatment and the circumstances of your attendance. This may include: 

• Your name, date of birth, address and contact details. 

• Your NHS number, where available and necessary. 

• Parent, guardian, next of kin or emergency contact details. 

• Details of the event or location where you received care. 

• Your symptoms, injuries, medical history, allergies and medicines. 

• Observations, assessment findings, treatment and medicines administered. 

• Advice provided, referrals, handovers and the outcome of your care. 

• Records of consent, refusal of treatment and relevant mental capacity assessments. 

• Safeguarding concerns or information about risks to you or others. 

• Correspondence relating to your care, a complaint or an incident. 

​

We only collect information that is relevant and necessary for the purpose concerned.

 

3. Where does your information come from? 

​

Most information comes directly from you and from our assessment of your condition. 

​

Where necessary, we may also receive information from: 

• A parent, guardian, relative, carer or person accompanying you. 

• Witnesses, event staff or security personnel. 

• Ambulance services, NHS 111, hospitals or other healthcare professionals. 

• Other organisations involved in your care or safeguarding. 

​

If you are unconscious, seriously unwell or unable to communicate, we may need to obtain information from others to help provide safe care. 

​

4. Why do we use your information? 

​

We use your information to: 

• Assess your condition and provide appropriate care. 

• Record treatment, advice and decisions accurately. 

• Arrange referrals and transfer information to the professionals taking over your care. 

• Contact you when necessary about your attendance or care. 

• Protect children and adults at risk of harm. 

• Review incidents, investigate complaints and improve patient safety. 

• Check the quality of our services through clinical audit and governance. 

• Meet applicable legal obligations and handle legal or insurance claims. 

​

Where practical, we use anonymised information for service statistics, event reports and learning. Information is only anonymised where you can no longer be identified from it. 

​

We do not sell your patient information or use your clinical records for marketing. 

​

5. Our legal grounds for using your information 

​

We process personal information under the UK General Data Protection Regulation and the Data Protection Act 2018, as amended. 

​

For routine patient care and associated record keeping, our lawful basis is legitimate interests — Article 6(1)(f). These interests include providing safe care, supporting continuity of care, maintaining reliable records and managing the quality and safety of our services. We consider these interests alongside your rights and reasonable expectations. 

​

Other lawful bases may apply in particular circumstances: 

• Legal obligation — Article 6(1)(c): where a specific law requires us to process or disclose information. 

• Vital interests — Article 6(1)(d): where processing is necessary to protect someone’s life. 

• Consent — Article 6(1)(a): where we ask you to agree to a genuinely optional use of your information. 

​

Health information requires an additional legal condition. For providing and managing healthcare, we rely on Article 9(2)(h) and the relevant provisions of the Data Protection Act 2018, where the required duty of confidentiality applies. 

​

Different conditions may apply to particular activities, including Article 9(2)(f) for legal claims, or relevant safeguarding conditions under Article 9(2)(g) and Schedule 1 of the Data Protection Act 2018. In an emergency, Article 9(2)(c) may apply where processing is necessary to protect vital interests and the person is physically or legally unable to consent. 

​

Consent to treatment is separate from consent under data protection law. We do not normally rely on data protection consent to create and retain the records needed for your care. 

​

6. Who may we share your information with? 

​

We only share identifiable information when there is an appropriate reason and lawful basis. Recipients may include: 

• Healthcare professionals and services: such as ambulance crews, hospitals, GPs or NHS 111, where necessary for your care. 

• Safeguarding services: such as local authority safeguarding teams, children’s services or police, where necessary to protect someone from harm. 

• Authorised personnel: involved in clinical governance, patient safety reviews, incident investigations or complaints. 

• Service providers: supplying secure clinical record systems, IT support or records storage under appropriate contractual controls. 

• Insurers and legal advisers: where necessary to manage a claim or obtain advice. 

• Regulators, courts or public authorities: where disclosure is legally required or otherwise lawfully justified. 

​

We share only the information needed for the purpose and consider our duty of confidentiality as well as data protection law. 

​

Event organisers and employers 

​

Paying for our services does not automatically entitle an event organiser, venue or employer to see your clinical records. 

​

We normally provide anonymised attendance figures and service summaries. Identifiable information is only shared where there is a specific lawful and justified reason, such as your agreement, an immediate safety need, safeguarding or a legal requirement. 

​

Relatives and people accompanying you 

We do not automatically disclose your medical information to relatives, friends or next of kin. We consider your wishes, their authority to act and any relevant best interests or safeguarding considerations. 

​

7. How do we protect your information? 

​

We use appropriate organisational and technical measures to protect patient information against unauthorised access, loss, misuse or disclosure. 

​

These measures include restricted access, secure storage and transfer arrangements, confidentiality requirements and procedures for handling information securely. 

​

Patient information is accessed only by people who need it for an authorised purpose. 

​

8. How long do we keep your information? 

​

We retain records for as long as necessary for their purpose, using our records retention schedule. 

​

The retention period depends on the type of record and factors such as: 

• Your age at the time of treatment. 

• The nature of the care provided. 

• Relevant health records retention guidance. 

• Legal and professional requirements. 

• Safeguarding concerns. 

• Complaints, investigations or legal claims. 

​

Records may be kept longer where an investigation, claim or legal requirement prevents their disposal. When retention is no longer necessary, records are securely destroyed or irreversibly anonymised. 

​

You can contact us to ask which retention period applies to your records. 

​

9. Is your information transferred outside the UK? 

​

Where a transfer outside the UK occurs, we ensure that the applicable UK data protection requirements are met. 

​

10. Your rights 

​

Depending on the circumstances and legal basis, you may have the right to: 

• Ask for access to your personal information and a copy of your patient record. 

• Ask us to correct inaccurate information or complete missing information. 

• Ask us to restrict how we use your information. 

• Ask for information to be erased where the law allows. 

• Receive certain information in a portable format where that right applies. 

• Withdraw consent where a particular use relies on your consent. 

​

These rights are not absolute. For example, we may need to retain an accurate clinical record even if you ask for it to be deleted. Where a clinical entry is disputed, we may retain the original entry and add a correction or a record of your concerns. 

​

Withdrawing consent does not affect processing that was lawful before withdrawal or processing supported by another lawful basis. 

​

Your right to object 

​

You have the right to object to processing based on legitimate interests because of your particular circumstances. Contact us using the details above. We will consider your objection and explain whether we must continue processing for compelling legitimate grounds or legal claims. 

​

How to make a request 

​

Contact info@Fenresponsemedical.co.uk and explain what you would like us to do. 

​

We may need to verify your identity and check the authority of anyone acting on your behalf. Requests are normally free of charge, and we normally respond within one month. Where the law permits an extension or a different response, we will explain this. 

​

11. Children and young people 

​

We give children’s and young people’s information the same protection as other patient information. 

​

A parent or guardian does not automatically have unrestricted access to a young person’s record. We consider parental responsibility, the young person’s understanding and wishes, confidentiality and their best interests before releasing information. 

​

12. What if you do not provide information? 

​

You may choose not to answer a question. However, missing information could limit our ability to assess you, identify risks or provide appropriate care. 

​

We will explain why information is needed where practical. We may still need to record what we observe, the care offered and any decisions to decline treatment, even if you do not provide your name or other details. 

​

13. Automated decisions 

​

[Confirm before publication:] We do not make decisions about your care that have legal or similarly significant effects based solely on automated processing. Clinical decisions are made by the personnel assessing and treating you. 

​

14. Questions and complaints 

​

If you are concerned about how we have handled your information, please contact: 

​

info@Fenresponsemedical.co.uk 

​

For the attention of: Data Protection Lead 

​

You also have the right to complain to the Information Commissioner’s Office (ICO), the UK’s independent data protection regulator. 

​

Website: ico.org.uk/make-a-complaint 

​

15. Changes and accessible formats 

​

We review this notice when our services, information handling arrangements or legal requirements change. The latest version will be available on our website. 

​

If you need help understanding this notice or require an accessible format, please contact us.