Privacy policy
The ESCAPE-pain programme is committed to protecting your privacy. This policy is made in the light of the requirements of the UK GDPR and the Data Protection Act 2018, which we take very seriously.
We have appointed a Data Protection Officer (DPO) who can be contacted by email here.
Please note that ESCAPE-pain itself is not a legal entity and does not hold a legal standing as a data controller or as a data processor. ESCAPE-pain is maintained by Health Innovation Network South London, who are hosted by Guy’s and St. Thomas’ Hospital NHS Foundation Trust. Guy’s and St Thomas’ Hospital NHS Foundation Trust is the Data Controller for all ESCAPE-pain data.
You can find more about Guy’s and St. Thomas’ Hospital NHS Foundation Trust here.
All references to “we”, can be interpreted as staff working for Guy’s and St Thomas’ NHS Foundation Trust, within the Health Innovation Network South London.
We will store your data securely, with appropriate safeguards in place to protect your information against unauthorised or unlawful processing. If you have any questions about the policy, please write to us at Information Governance, St Thomas’ Hospital, Westminster Bridge Road, London SE1 7EH or email us.
How do we collect information?
We will obtain personal information from you when you visit our website, download ESCAPE-pain facilitator training materials or otherwise provide us with personal information through correspondence or engagement with us.
What information do we collect?
The types of information collected will differ depending on your engagement with ESCAPE-pain. The information collected may include: cookies, name, e-mail address, gender, job title, organisation affiliation, and telephone number and IP address.
How do we use this information?
We will use your personal information to provide you with the services, products or information you have requested, and for administration purposes.
Where your information has been provided for the purposes of the ESCAPE-pain programme, we will use your personal data to allow the proper function and facilitation of the programme, by providing all the relevant information to our partners and trainers as well as retaining certain patient data to properly analyse and manage the effectiveness of the programme.
We will not sell or swap your details with any third parties but we may share your information with our service providers, agents and associated organisations authorised to act on our behalf to provide the services you have requested. All such processors are bound by contract to meet UK GDPR security and confidentiality standards.
We will not share your personal information with third parties or used in any other way other than described in this policy, unless required by law.
Where your personal information has been captured by consent, you can withdraw your consent at any time by contacting ESCAPE-pain, Health Innovation Network South London by email.
Our Data Retention Policy
We retain your personal data only for as long as it is necessary for the purposes for which it was provided.
- Website visitor data (cookies, IP) is kept for up to 12 months.
- Facilitator training registration data is kept for up to 5 years.
If you withdraw your consent at any point, we will stop processing your information immediately.
How do we protect personal information?
When you give us personal information, we take steps to ensure that it’s treated securely. We use a secure server to host the data we process. Moreover, all our programmes and tools are accessible only by authorised personnel and protected by passwords. We also take appropriate measures to ensure that all the information disclosed to us is kept secure, accurate and up to date and kept only for so long as is necessary for the purposes for which it is given. Particularly, we store data and information in Microsoft 365 environment, which ensure regular backups and owns the most recent information security certification, ISO 27001.
Unfortunately, no data transmission over the Internet is 100% secure. While we make every reasonable effort to ensure that information sent to us is done so securely, we cannot warrant the security of information transmitted to us through the internet. When you transmit information to us via the internet, you do so at your own risk. However, when we transmit data to our stakeholders, we apply all reasonable measures to ensure that data are shared securely and with all the appropriate safeguards, such as pseudonymisation, de-identification and end-to-end encryption.
Use of ‘cookies’
The ESCAPE-pain website uses cookies. ‘Cookies’ are small pieces of information sent by an organisation to your computer and stored on your hard drive to allow that website to recognise you when you visit. They collect statistical data about your browsing actions and patterns and do not identify you as an individual.
Your cookies will be used for strictly necessary purposes in order for our website to run effectively and for you (as the viewer) to be able to access the website.
ESCAPE-pain also uses analytical cookies (or statistical cookies) to collect information about how a viewer uses a website, such as which pages you visit, and which links a viewer clicked on. Analytical cookies track when a viewer visits a site for the first time, as well as when they are a return viewer to the site. These cookies also track how long a viewer spends on a site at a given time. These cookies also track what link a viewer clicked on to access the site, and what keywords (if any) were used to generate the search. However, none of this information can be used to identify a person. It is all aggregated and, therefore, anonymised. We rely on our legitimate interests (improving user experience) as the lawful basis for these cookies.
It is possible for you to opt-out of having any analytical and advertisement cookies being collected when you visit our website, and you can do so by utilising our cookie banner.
If you wish to change your cookie preferences, you can do so at anytime by clicking on the following hyperlinked text: Change Cookie Preferences.
What is our lawful basis for processing your personal data?
The lawful basis we rely upon differ according to the different category of data processed and its related purposes.
Consequently, we have listed the different lawful bases we rely upon according to the above-mentioned variables:
Article 6(1)(e) – public interest
We rely on public interest to process data for the purpose of providing clinical support within the ESCAPE-pain programme.
The purpose of the ESCAPE-pain programme is a rehabilitation programme for individuals suffering with osteoarthritis. Healthcare is one of the core public interest activities, and any activities which fundamentally improve patient outcomes is carried out in the public interest.
The data will be carried out in the interest of service improvement and quality assurance of the ESCAPE-pain programme which will in turn be of benefit to the public interest.
Article 6(1)(a) – consent
We rely on data subjects’ consent to collect your data when you request access to the ESCAPE-pain programme facilitator training materials.
ESCAPE-pain training materials
What information we collect when you sign up to access these materials
If you request access to the ESCAPE-pain training materials, we may collect the following information about you: name, surname, email address, organisation you belong to and professional role.
How we use your information
We will use this information to provide you with the information you have requested. We may also contact you about future opportunities to receive ESCAPE-pain training, or to communicate any changes to the ESCAPE-pain programme.
It is worth highlighting that it is your right to withdraw consent just as freely as you have granted it at any time. You can do it by sending an email to hin.southlondon@nhs.net.
Will we share/disclose the information we collect with third parties?
The only third parties whom your personal data may be shared with will be third parties which Guy’s and St Thomas’ NHS Foundation Trust has a contractual relationship with in respect to ESCAPE-pain, for example organisations which may offer ESCAPE-pain training.
These third parties will act as the Data Processor and handle the data on explicit contractual and legal obligations on behalf of us. We share data with different categories of third parties based on each sharing purpose.
For the purpose of internal organisation, administration and communication, we use Google, and Microsoft 365 as our processors.
It is important to note that any information we share with third party organisations will be the absolute minimum personal data required in order for them to provide the relevant service. All associated organisations are to satisfy our criteria for information security and data protection.
How can I access and update my information?
If your personal details change, please help us to keep your information up to date by notifying us at:
ESCAPE-pain, Health Innovation Network, Guy’s and St Thomas’ NHS Foundation Trust, 10th Floor, Becket House 1 Lambeth Palace Road, London SE1 or by email at hin.southlondon@nhs.net.
The accuracy of your information is important to us. We will correct or remove information we hold about you which you tell us is inaccurate.
Under the UK GDPR you have the right to ask for a copy of the information we hold about you without charge and to have any inaccuracies in your information corrected. Such requests need to be made in writing to the address above. Kindly contact us to obtain the ‘Subject Access’ Form.
Your personal data rights and how to exercise them
Individuals have certain rights over their personal data and data controllers are responsible for fulfilling these rights. You can find out more information around your rights by visiting the Information Commissioner’s Office website at the following link: https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/individual-rights/.
In addition to your other rights, as mentioned in the transparency notice section, it is your right to withdraw consent just as freely as you have granted it at any time. You can exercise any of your personal data rights, including withdrawing consent, by sending an email to .
Changes to this privacy statement
Despite any changes we make to this privacy statement we will always use your personal data for the purposes we outline unless you give your express consent for us to do otherwise, and in accordance with the UK GDPR.
Raising a question or making a complaint
Should you have any queries about how your information is used, or if you have any questions or concerns on how your information is used, please contact hin.southlondon@nhs.net.
If we are unable to resolve a complaint you have with us, you also have the right to contact or make a complaint to the Information Commissioner’s Office:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire SK9 5AF
Phone: 0303 123 1113 (local rate) or 01625 545 745 if you prefer to use a national rate number.
Report a concern on the ICO website
