--- title: "Data Protection" canonical: "https://wiki.patientsknowbest.com/space/IG/3826483254/Data%20Protection" format: markdown --- > Macro (toc) # Patients Know Best Governance ### **Registered Address**
Patients Know Best UK Patients Know Best, Ltd. Registered in England and Wales Number: 6517382. VAT Number: GB 944 9739 67. Registered Office: Patients Know Best St John's Innovation Centre, Cowley Road Milton, Cambridge, CB4 0WS
Patients Know Best EU Patients Know Best B.V. Handelsregister 76822613. Registered Office: Patients Know Best B.V., of Van Heuven Goedhartlaan, 935 A, 1181LD, Amstelveen, Amsterdam, The Netherlands
### **Leadership & Oversight**
Data Protection Officer UK David Grange Patients Know Best Address: St John's Innovation Centre, Cowley Road Milton, Cambridge, CB4 0WS Email: [dpo@patientsknowbest.com](mailto:dpo@patientsknowbest.com) Phone: 01223 790708 ICO Registration: Z2704931
Data Protection Officer EU David Grange Patients Know Best B.V., of Van Heuven Goedhartlaan, 935 A, 1181LD, Amstelveen, Amsterdam, The Netherlands Email: [dpo@patientsknowbest.com](mailto:dpo@patientsknowbest.com) Phone: +44 1223 790708 AP Registration: FG012552
Caldicott Guardian Mohammad Al-Ubaydli Chief Executive Officer Patients Know Best St John's Innovation Centre, Cowley Road Milton, Cambridge, CB4 0WS [Contact](mailto:help@patientsknowbest.com)
SIRO and CISO Mate Varga Chief Technology Officer Patients Know Best St John's Innovation Centre, Cowley Road Milton, Cambridge, CB4 0WS [Contact](mailto:help@patientsknowbest.com)
--- # Data Protection Principles
Lawfulness, fairness and transparency PKB follows the law to handle data fairly and legally. Most of the time, PKB acts as a "[Data Processor,](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3826483254/Data+Protection#What-are-Data-Controllers-and-Data-Processors%3F)" which means it provides the secure platform for hospitals or GPs to show patients their records. If a patient adds their own information, PKB acts as a "[Data Controller](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3826483254/Data+Protection#What-are-Data-Controllers-and-Data-Processors%3F)," meaning it is responsible for looking after it. PKB gives individuals a [Privacy Notice](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/4062576855) when they sign up so they know exactly how their data is used.
Purpose limitation The organisation only uses information to manage health records and provide the service. PKB does not use data for commercial purposes and does not sell it to others.
Data minimisation PKB holds the information sent by healthcare providers and only asks for the basic details needed to set up a patient's account. Patients have complete choice over what extra information they want to add to their record.
Accuracy Healthcare teams are responsible for keeping the records they send up to date, Providers ensure data accuracy by regularly updating data from their platforms via API interfaces. Data accuracy and requests for data erasure within the patient record are handled in accordance with the Provider's local information rights policies. Patients can update or amend any information that they have contributed to PKB themselves.
Storage Limitation In most cases, personal data within the patient record is retained for 8 years after last access, aligned with the NHS Records Management Code of Practice. Patient-inputted data that has not been shared with the provider, will be deleted at the patient’s request. Exceptions apply in specialties where retention periods are different. Retention terms are stipulated in the Data Processing Contract (DPC) at the Provider's request, PKB is able to adopt any schedule the controller specifies.
Integrity and confidentiality (security) PKB maintains a high level of [security](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3827073045) through technical and organisational measures, including annual penetration testing, adherence to the Data Security and Protection Toolkit, Cyber Essentials Plus, and role-based training for employees. Personal data is encrypted, preventing access except for authorised access to manage the healthcare record and service provision. Patients have some control e.g. over who may access their health record and amending privacy labels.
Accountabillty Patients Know Best (PKB) ensures accountability through its Data Protection Officer and maintaining accurate Records of Processing Activities specifying data processing purpose and duration. PKB proactively addresses data protection concerns by implementing [Data Protection by Design](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3603922997) principles in information system development and incident response.
--- # Data Subject Rights
The Right to be Informed PKB ensures that data subjects are informed about how their data is processed through transparent and clear communication. This includes information about data collection, processing purposes, and data subject rights. - *[Privacy Notice](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/4062576855)**: Our Privacy Notice explains how data is collected, used and protected.* - *[User Agreement](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/4062576855)**: Our User Agreement outlines an individual’s rights and responsibilities when using our services.* - *[PKB Platform (Access Log)](https://wiki.hub.patientsknowbest.com/wiki/spaces/MAN/pages/3624599588)**: Access logs in our web application allow individuals to track interactions with their data.* - *[Blog and Video Segments](https://blog.patientsknowbest.com/)**: We regularly share informative content to keep individuals updated on best practices and relevant information regarding their data and privacy.* - *PKB **[Patient Manual ](https://wiki.hub.patientsknowbest.com/wiki/spaces/MAN)**and **[Trust Centre:](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG)** Our patient manual and Trust Centre provide detailed information about data handling, security and privacy practices.* - The Provider, as Data Controller, is responsible for ensuring adherence to the Right to be Informed where PKB is the Data Processor.
The Right of Access The Provider, through their contract with the PKB platform, grants data subjects the right to access their personal data. Where PKB is the Data Controller, PKB is only processing data which has been supplied by the patient. Patients may access their data through the Patients Know Best (PKB) platform, and providers can always access data they have entered.
The Right to Rectification The Data Controller is responsible for rectification of their data and the patient has the functionality within the PKB platform for rectification of data they have entered. Data subjects can request data rectification through the PKB portal. PKB does not modify data without the Data Controller's specific instructions, ensuring data accuracy and integrity.
The Right of Erasure While data subjects may have the Right to Erasure in certain circumstances, given PKB is considered a healthcare record this right may not apply. The Data Controller is the sole determining party for evaluating how this right is upheld. Where PKB is a Data Controller, and where that data has not been shared with a Controller, the patient is the sole determining party for the erasure of that data.
The Right to Restrict Processing Patients have the Right to Restrict Data Processing, which can be facilitated in PKB through mechanisms such as ["Stop Sharing", "Disable Sharing" or by changing privacy labels](https://wiki.hub.patientsknowbest.com/wiki/spaces/MAN/pages/3624730683). Where the patient wishes to restrict processing by the Provider (Data Controller), the patient must contact the Controller directly.
The Right to Data Portability Patients Know Best supports data portability by enabling patients to grant access to their health records directly through the platform, ensuring secure and seamless sharing with others.
The Right of Objection The patient can object to processing and enable mechanisms through the PKB Portal that restrict the processing. They cannot, however, object to the processing where PKB is a Data Processor, the objection must be handled by the Data Controller.
Rights Relating to Automated Decision Making and Profiling Patients Know Best do not use any automated decision making or profiling.
--- # Lawful Basis ### [What are Data Controllers and Data Processors?](https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/controllers-and-processors/controllers-and-processors/what-are-controllers-and-processors/) ### **UK GDPR**
Where Patients Know Best (PKB) are a Processor #### For Provider-contributed data to the PKB Patient Record. - **Providers are the Data Controllers **- Their lawful bases for processing must be determined by the Providers. For example, in the case of NHS Trusts, the lawful bases for processing personal data is generally, but not exclusively, ***Article 6(1)(e) Public Task**** and ****Article 9(2)(h) Health & Social Care***, UK GDPR. *PKB are the Data Processor operating under the explicit instruction and authority of the Data Controller, under their lawful bases.*
Where Patients Know Best (PKB) are Joint Controllers #### PKB and the Provider are Joint Controllers for data points that are contributed to the PKB Record by a patient-user and accessed by Provider teams. - **Providers are Joint Controller **– Their lawful bases for processing must be determined by the Providers. For example, in the case of NHS Trusts, the lawful bases for processing personal data is generally, but not exclusively, ***Article 6(1)(e) Public Task**** and ****Article 9(2)(h) Health & Social Care***, UK GDPR. - **Patients Know Best are Joint Controller **- PKB operates under ***Article 6(1)(e) Public task*** (in assisting the NHS Provider to deliver their statutory function) and ***Article 9(2)(g) Public Interest*** ***and*** ***(h)*** ***Health & Social Care, ***UK GDPR.
Where Patients Know Best are a Sole Controller #### For patient-contributed data through a registered PKB Account. - **Patients Know Best are Sole Controller** - PKB operates under ***Article 6(1)(f) Legitimate Interests*** *and ****Article 9(2)(h) Health & Social Care***, UK GDPR. *Learn more about when PKB’s Lawful basis changed on 02/02/2022**** ****from **[Consent to Legitimate Interest](https://wiki.hub.patientsknowbest.com/wiki/spaces/IG/pages/3510141095)**.*
Where Patients Know Best are an Independent Controller #### For any data they originate e.g metadata, stats etc. - **Patients Know Best are Independent Controller** - PKB operates under ***Article 6(1)(f) Legitimate Interests*** *and ****Article 9(2)(h) Health & Social Care***, UK GDPR.
Where Patients Know Best are a Limited Independent Controller #### For retrieved copies of GP records retrieved under the Explicit Consent of a patient-user through the IM1 PFS service. - **Patients Know Best are a limited Independent Controller** - PKB operates under ***Article 6(1)(a) Consent*** *and ****Article 9(2)(a) Explicit Consent***, UK GDPR.