Privacy Notice
Cardiff and Vale University Health Board Weight Management Service in Partnership with Oviva
This privacy notice explains how Cardiff and Vale University Health Board (as data controllers) will process your personal data, specifically with regards to the weight management service provided in partnership with Oviva.
How and why will your personal data be processed?
Your personal data will be processed to allow Cardiff and Vale University Health Board to provide you with support via its tier 2 weight management service, delivered in partnership with Oviva. If you choose to enrol in Oviva’s virtual weight management service, Oviva UK Ltd will be the responsible data controller for the information you submit via the self-referral form. Information on how Oviva will process your data is available on the referral form itself.
Oviva will also provide information directly to the Cardiff and Vale Adult Specialist Weight Management Service in the following circumstances:
- Following completion of your care with Oviva, Cardiff and Vale University Health Board will receive an end-of-care report which will be retained securely as part of your health record.
- If in the event that Oviva feel it is necessary to share information to safeguard your health, this will be also provided to Cardiff and Vale University Health Board.
What is the legal basis for our use of your personal information?
The lawful basis that the UHB relies upon to process your personal data is:
- GDPR Article 6 (e) we need it to perform our public task
As extra protection is provided for certain classes of information called ‘special category personal data’ such as health information, an additional lawful basis must be identified in order to process these classes of information, as outlined below:
- GDPR Article 9(h) – processing is necessary for provision of health and social care
How will we store your personal information?
Your information will be stored securely and kept in accordance with the Records Management Code of Practice for Health and Social Care 2022
Your rights
Under data protection law, you have rights including:
- Your right of access – You have the right to ask us for copies of your personal information.
- Your right to rectification – You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
- Your right to restriction of processing – You have the right to ask us to restrict the processing of your information in certain circumstances.
- Your right to object to processing – You have the right to object to the processing of your personal data in certain circumstances.
- You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.
How to complain if you are unhappy about how your data has been processed
For further information regarding how Cardiff and Vale University Health Board processes your data can be found via the
Cardiff and Vale University Health Board’s Privacy Policy.
You can complain directly to Cardiff & Vale University Health Board’s Data Protection Officer at: Uhb.Dpo@wales.nhs.uk
You also have the right to complain to the Information Commissioner’s Office using the following details:
- Information Commissioner’s Office (ICO) website
- By post: The Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
- Telephone: 0330 414 6421
Further advice and guidance from the ICO on this issue can be found on the ICO website
