Our privacy notice explains how we look after the information we hold about you. 

If you are a staff member or volunteer at The Clatterbridge Cancer Centre, read our Staff Privacy Notice.

If you want a child friendly copy or a copy in a different format, just email our Data Protection Officer.

Click here for an audio version. 

How we use your personal information

The Clatterbridge Cancer Centre NHS Foundation Trust is one of the UK’s leading cancer centres providing highly specialist cancer care to a population of 2.3m people across Merseyside, Cheshire and the surrounding areas, including the Isle of Man. 

We are based in Wirral, Liverpool and Aintree, and have a number of satellite sites. 

Out Trust is registered with the Information Commissioner’s Office (ICO) to process personal information under the Data Protection Act 2018, and our registration number is Z7367711.

  • Your name, address, contact details and date of birth – we need this to send you letters or telephone you about your care, and to identify you when you visit us. It also helps us to receive your information from other hospitals if needed.
  • Your health information including any scans and test results.
  • Information about your family or carers or next of kin. This lets us know who to contact in an emergency. Your next of kin does not have a legal right to view your medical records or access any confidential information about you.
  • Information about your religion to provide patients with a chaplaincy service and meet your spiritual needs.
  • What language you speak to make sure we can provide an interpreter if needed.
  • Whether you have a disability so we can make sure we can meet any needs you have.
  • Your GP details to let them know what care and treatment you receive from us.

We collect information from you, from your GP or other hospitals who care for you. When you receive care from us, staff will collect information for your health records. We might also receive information from anyone else involved in your care, like a care home or social services.

Direct care

We use your information to provide you with care and treatment. This might include sharing your information with other NHS organisations that provide care to you. 

Complaints, feedback, legal claims and incidents

If you have made a complaint, staff investigating the complaints will need to access your health records and might need to share information with third parties such as solicitors. The same applies if you have made a legal claim against The Clatterbridge Cancer Centre.

If you have provided feedback on a service, we may need to share your information about your care with us with relevant staff, in order to look into your feedback.

If you have been involved in a serious incident, staff investigating the incident will need to access your health records.

Clinical audits

We have to monitor the services and treatment we provide. This means our clinical staff have to use patient information to look at the quality of care we provide. 


We might use anonymised information for research – this means you cannot be identified from the information. If identifiable information is needed, you will be asked for consent first. 


We have CCTV at our sites in order to protect patients, staff and visitors, and to prevent crime. CCTV is also used to monitor safety incidents. We do not have CCTV in any areas where patients receive treatment or that would be considered private. 

Health service planning and management

Information about how our patients are cared for is collected, such as appointment waiting times. This is used to monitor the service we are providing and to help us make sure our services continue to meet patient needs.

The Clatterbridge Cancer Centre NHS Foundation Trust works closely with other organisations to support patient care. This means that information will be shared between the hospital and other organisations who may be caring for you or involved in your care or who have a responsibility for management of the whole NHS. 

These may include:

  • NHS England
  • NHS Digital
  • NHS Business Services Authority
  • NHS Counter Fraud Authority
  • UK Health Security Agency and Office for Health Improvement and Disparities
  • Other NHS trusts
  • Your GP
  • Ambulance services
  • Cancer registries
  • Local authorities such as social services

We are part of a regional sharing agreement across Cheshire and Merseyside, ensuring records can be shared by other care providers involved in your treatment and care. More information can be found at Cheshire and Merseyside's website

We also have to share data for monitoring our performance, such as analysis of cancer waiting times. This looks at whether we are seeing patients in a timely manner.

Where information is to be shared across organisational boundaries on a regular basis, we put in place information sharing agreements between all of the sharing parties involved. 

The law (Section 251, NHS Act 2006) says we must share some patient information with NHS England, for national registers. This includes the Cancer Registry* and the National Disease Registration Service**.

* Information about National Cancer Registration and Analysis Service (NCRAS)
** Information about the National Disease Registration Service

By law, we have to share some information, such as to the police to prevent a crime or to notify of infectious diseases. We will also share information for this purpose securely and in line with the law.

  • All staff at The Clatterbridge Cancer Centre must abide by the Common Law Duty of Confidentiality and have a confidentiality clause in their contract of employment.
  • All staff at The Clatterbridge Cancer Centre undertake annual training (Data Security Awareness) on keeping your information safe, secure and confidential.
  • Every year we must meet certain standards (Data Security and Protection Toolkit) to make sure we are keeping information secure and to make sure our computer security meets high standards.
  • We only collect, use and share the minimum information necessary about you.

We only keep your data for as long as is necessary. This is required by law. We follow the NHS Records Management Code of Practice.

For cancer patient records, this is usually 30 years after you last had contact with us, or 8 years after a patient passes away. 

  1. We must tell you what information we collect about you, why we collect it and how we use it.
  2. You can request a copy of information we hold about you. This is free of charge (unless repeated copies are asked for).
  3. You can let us know if your information needs updating or if it’s incorrect.
  4. You can ask for your information to be deleted or removed (this does not apply to your individual health or care record, or for public health or scientific research reasons).
  5. You can ask us to restrict how we use your information.
  6. You can ask us to securely send a copy of your information to another organisation.
  7. If you are not happy with how we use your information, you can let us know.
  8. If any decision is made about you without human intervention – this does not routinely happen at The Clatterbridge Cancer Centre – you can challenge the decision.

There may be some activities we use artificial intelligence for. For example, we may use artificial intelligence to do something that would otherwise be a manual task which is quite painful for a patient. The result of the artificial intelligence output is then thoroughly checked by a relevant member of staff. 

We also may use something called 'Robotic Process Automation'. This is where an online robot (known as a digital worker) undertakes administrative tasks that would usually be carried out by a person.

Your information will only be sent outside of the UK where the country has laws in place that meet the standards of data protection similar to those in the UK. We perform a number of checks to ensure this. 

We will never sell any information about you to other organisations for profit.

You have a choice about how you want your confidential patient information to be used. 

If you’re happy for us to use your information, you do not need to do anything.

If you choose to opt out, your confidential patient information will still be used to support your individual care.

There are now a number of different data sharing opt outs you can choose:

1. Stop your GP surgery from sharing your data (Type 1 Opt-Out)

2. Opt out of sharing your information for purposes other than your care and treatment (National Data Opt Out)

3. Opt out of sharing with the Federated Data Platform

Cheshire and Meseyside ICB have created a leaflet explaining how your data may be used in the local Secure Data Environment for research purposes.

If you are happy with this use of information you do not need to do anything. You can change your choice at any time.

If you have any questions or concerns about how we use your information, please contact our Data Protection Officer by post or email. 

Information Governance Manager (Data Protection Officer)
The Clatterbridge Cancer Centre NHS Foundation Trust
Clatterbridge Road
CH63 4JY

Email our Data Protection Officer

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law, you can complain to the Information Commissioner’s Office (ICO).

Find out how to make a complaint to the ICO

Information Commissioner’s Office
Wycliffe House
Water Lane

0303 123 1113
01625 545 745

Email the Information Commissioner’s Office.

Some of the key purposes we collect and use your data, and the law we rely on are provided below.


We need your consent to deal with your complaint. We rely on UK GDPR Article 6(1)(a) and 9(2)(a) to deal with complaint information. 

Direct patient care

The Health and Social Care Act 2012 allows us to collect and use data to provide healthcare services to you. We rely on UK GDPR Article 6(1)(e) and 9(2)(h) to process information for direct care.

For other organisations to provide support services for us

We enter into contracts for other organisations to provide services on our behalf. 

They are subject to the same legal rules and conditions for keeping personal information secure. The organisations can only use your information for the service we have contracted for them and not for any other purposes. 

We rely on UK GDPR Article 6(1)(e) and 9(2)(h). 

Patient and public involvement

We will ask for your consent before sharing any information you provide us with for engagement (e.g. patient stories). We rely on UK GDPR Article 6(1)(a) and 9(2)(a). 

National registries

We have a requirement to provide information to certain national registries. We rely on UK GDPR Article 6(1)(e) and 9(2)(h). 


Consent to participate in research is not the same as consent as a legal basis for processing under data protection legislation. We do not use consent to process for research purposes. We rely on UK GDPR Article 6(1)(e) and 9(2)(j). 


We use CCTV at our sites for public safety and crime prevention and detection. Signs are displayed notifying visitors of the fact CCTV is in operation and who to contact for further information. We rely on UK GDPR Article 6(1)(e). 

Analysis to improve the services provided to our patients

In order to make sure we continue to provide services and care to meet your needs, we use information to monitor how we are meeting these needs. We rely on UK GDPR 6(1)(e) and 9(2)(h).