Privacy notice

Communications Team

This privacy notice explains how the Communications Team at The Royal Wolverhampton NHS Trust (RWT) and Walsall Healthcare NHS Trust (WHT) use personal data for communications purposes.

Both Trusts act as Data Controllers for the processing described in this notice. Where activities are carried out jointly, the Trusts work together to ensure compliance with data protection legislation. Individuals may contact either Trust’s Data Protection Officer for further information.

Who this privacy notice applied to:

Patients
Staff
Volunteers
Visitors and members of the public who choose to take part in communications activity involving the Trusts.

The Communications Team celebrates staff and patients through storytelling, while keeping local communities informed of key updates and service changes.

Part of this involves capturing information, ensuring it is both correct and relevant, before cascading it across a range of internal and external channels (depending on the specified purpose when consent is obtained).

The team will ensure all personal data is handled in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

Why are we collecting your data?

Data, which is collected directly from individual patients and/or staff members, will be used:

To raise awareness of health conditions
To promote events or services
For key internal/external announcements

Your information will only be used for the specific purpose explained to you at the time your consent is obtained. We will not use your information for unrelated purposes.

How your information may be shared:

Depending on the purpose you have agreed to, content may be shared through some or all of the following channels:

Social media – Facebook, Instagram, LinkedIn, TikTok, X and YouTube
Press releases (which can get picked up by media outlets)
Weekly staff email bulletin (which is sent to more than 17,000 staff members)
Public websites
Intranet sites
Screensavers
Printed publications such as the ‘Inside’ staff newsletter and posters/pull-ups
Via presentations on study days and in staff meetings (e.g. Board meetings).

Please note that content shared on external platforms may enter the public domain and could be viewed, shared, or retained by third parties outside the Trusts’ control.

We collect information by the following means:

In person
Over the telephone
Through social media platforms (note any content transmitted to us over the internet can never be guaranteed to be 100 per cent secure)
Via email.

Any content posted on our external channels, for example a photograph, will be visible in the public domain and may remain there, or be used or shared by third parties (e.g. media outlets).

For content shared via the internal staff bulletins, the content will remain in the staff member’s inbox for as long they choose not to delete it.

What Information will we process?

Personal data, which may include:

Name, age, location (where they work and live) and family details (e.g. pets and hobbies)
Contact details – email address and telephone number
Social media handles
Opinions.

Special categories of personal data:

Personal data revealing racial or ethnic origin
Personal data revealing religious or philosophical beliefs
Personal data revealing sexual orientation
Data concerning health.

This information may feature in the form of:

Video footage
Photographs
Audio recordings
Written quotes.

How we will use this data?

Photos and videos stored securely on the Trust’s Fotoweb system, and on the team’s shared drives (where necessary) and is accessed only by members of the Communications and Clinical Illustration Teams.

Consent is obtained via a paper copy, which will be uploaded to the Trust’s Fotoweb system with the original document destroyed thereafter.

We will seek individuals’ permission to use their data via our consent form, but for larger groups/events will give advance warning to attendees that photography/video/audio recording is taking place (verbally or via email/signage) and will ask for any issues to be made known in advance of publication.

The team will not transfer personal data outside of the organisation without consent.

The team will notify individuals promptly in the event of any breach of personal data.

What is the legal basis for processing the data?

Who will we share your data with outside of those in this programme?

How long will we process your data for?

We will use photographs, video and audio content for up to two years from the date it is captured, unless a shorter period is stated on the consent form.

If you have provided open publication consent and we wish to use your image or story for a purpose not originally specified, we will contact you to request further consent.

After the two‑year use period, some images may be transferred to our secure archive. Archived content may be retained for historical, heritage or commemorative purposes, such as marking Trust anniversaries or NHS celebrations. Archived images are not publicly accessible and may only be accessed by authorised Communications and Clinical Illustrations staff.

What are your rights and how to enforce them?

Individuals have the right to request from us that:

Any inaccurate information we hold about them is corrected
Information about them is deleted on Trust owned accounts
We stop using their personal information.

It is the responsibility of the relevant individual to let us know if they want to withdraw consent, this includes if you leave an organisation and no longer wish for your photo to be used.

This can be actioned by emailing rwh-tr.communicationsdept@nhs.net (RWT) or wht.communications@nhs.net (Walsall Healthcare).

Complaints can be submitted to:

The Data Protection Officer (DPO) for The Royal Wolverhampton NHS Trust is contactable via rwh-tr.IG-Enquiries@nhs.net

The Data Protection Officer (DPO) for Walsall Healthcare NHS Trust is contactable via: wht.dpo@nhs.net