This programme and your personal data: survey and deliberative workshops

This programme has been commissioned by the Department of Health and Social Care (DHSC) and NHS England (NHSE), as part of the joint NHS Transformation Directorate. Its purpose is to understand your experiences and perspectives on the use of health data for individual patient care, NHS planning, and health research. Ipsos has been commissioned by DHSC and NHSE to design and deliver this programme, and we are working in partnership with Kaleidoscope Health and Care (hereafter Kaleidoscope).

This privacy notice explains who we are, the personal data we collect, how we use it, who we share it with, and what your legal rights are.

About us

About the Department of Health and Social Care

The Department of Health and Social Care (DHSC) is the UK government department responsible for setting health and social care policy, funding, and overseeing the NHS in England. The DHSC privacy notice provides more information about your rights as well as how and why your personal data may be processed.

About Ipsos UK

Ipsos MORI UK Limited and Ipsos (market research) Limited are a specialist research agency, commonly known as Ipsos and referred to in this privacy notice as “Ipsos UK”. Ipsos UK is part of the Ipsos worldwide group of companies, and a member of the Market Research Society. As such we abide by the Market Research Society Code of Conduct and associated regulations and guidelines.

About Kaleidoscope

Kaleidoscope is a social enterprise consultancy specialising in research, engagement, organisational development and strategy with healthcare systems and professionals. Ipsos UK and Kaleidoscope are jointly delivering surveys, online events and in-depth workshops with GPs and practice managers who have registered interest in this programme.

Data Controller and Data Processor

DHSC is the data controller for this survey. A data controller is an organisation that decides how people’s personal data is handled.

A data processor is an organisation which processes personal data on the data controller's behalf. For this project, Ipsos is the data processor. Ipsos will be using the following sub-processors, to assist us in gathering the evidence we need:

• Kaleidoscope who will process the data you provide in the survey.
• Sophie Reid – who will be delivering an independent evaluation of the project. Sophie may observe workshops and be provided with access to survey results.

What is our legal basis for processing your personal data?

We require a legal basis to process your personal data. Our legal basis for processing is your consent to take part in this research study. If you wish to withdraw your consent at any time, please see the section below covering ‘Your Rights’.

How will we use any personal data including study responses you provide?

Firstly, participating in this research is entirely voluntary and any answers are given with your consent.

We will keep your personal data and responses in strict confidence in accordance with this privacy notice and you will only be identifiable to the client if you consent.

We will only share study responses and recorded material(s) within the Ipsos UK and Kaleidoscope Project Team.

We will use your personal data and responses for research analysis and compatible purposes.

Who we share your data with

Ipsos UK will be using certain supplier organisations to assist us in running this project and we will need to disclose your personal data to these supplier organisations for that purpose. These supplier organisations include:

• Rackspace UK who hosts Ipsos' servers in the UK.
• Sophie Reid who will observe workshops and be provided with access to survey results, to support the delivery of an independent evaluation of the project.

Kaleidoscope will deliver the survey through the Alchemer EU platform and all survey data will be securely held within Kaleidoscope's Google Workspace cloud-based data storage system. All applications and data are managed by Kaleidoscope and no one at Alchemer or Google Workspace will have access to your personal data.

Artificial Intelligence “AI” technologies are incorporated into third party systems that Ipsos uses as part of its IT infrastructure, for security and fraud prevention purposes and may use internal systems that use AI to support efficient processing and insight analysis in line with its internal policies and procedures (which includes human oversight where applicable) to maintain data integrity. Any use of AI technologies by Ipsos will be in accordance with technical and operational safeguards appropriate for the data types.

How will we ensure your personal information is secure?

We take our information security responsibilities seriously and apply various precautions to ensure your information is protected from loss, theft or misuse. Security precautions include appropriate physical security of offices and controlled and limited access to computer systems.

Ipsos UK has regular internal and external audits of its information security controls and working practices and is accredited to the International Standard for Information Security, ISO 27001.

How long will we retain your personal data and identifiable responses?

We will only retain your data in a way that can identify you for as long as is necessary to support the research project and findings.

Your personal details used to invite you to take part in this research study will be securely deleted from our systems once the study and any quality control checks are complete.

For this project we will securely remove your personal data from our systems and from online hosting platforms by December 2026.

Where will your personal data be held and processed?

All of your personal data used and collected for this study will be stored and processed in the United Kingdom and the European Union.

Your rights

You have the right to access your personal data within the limited period that we hold it.

If you want to contact the client about data they hold about you, please see the client’s contact details below.

Providing responses to this study is entirely voluntary and is done with your consent. You have the right to withdraw your consent at any time whilst we hold your personal data at an identifiable level.

You also have the right to request from us the deletion or erasure of the personal information we hold about you.

You also have the right to rectify any incorrect or out-of-date personal data about you which we may hold.

If you want to exercise your rights, please contact us at the below Ipsos UK address.

If you have any complaints, we will appreciate if you give us an opportunity to resolve any issue first, by contacting us as set out below. You have the right to lodge a complaint with the UK’s Information Commissioner’s Office (ICO) if you have concerns on how we have processed your personal data. You can find details about how to contact the Information Commissioner’s Office at ico.org.uk/make-a-complaint.

How can you contact Ipsos UK and the client about this study and/or your personal data?

Contact Ipsos UK

Email: UK-PA-DataEngagement@ipsos.com with “26-017952-01 - National GP Engagement” in the email subject line.

Post: 26-017952-01 - National GP Engagement
Data Protection Officer
Compliance Department
Ipsos UK
3 Thomas More Square
London E1W 1YW
United Kingdom

Contact Kaleidoscope

Email: DataEngagement@kscopehealth.org.uk with “26-017952-01 - National GP Engagement” in the email subject line.

Post: 26-017952-01 - National GP Engagement
Jess Tudor Williams
Kaleidoscope Health and Care
604 Cannon Wharf Business Centre
Pell Street
London SE8 5EN

Contact DHSC

Email: b.morris9@nhs.net

Post: National GP Engagement
Data Protection Officer
Department of Health & Social Care
1st Floor North
39 Victoria Street
London
SW1H 0EU