Ascom Falls Prevention Privacy Notice

The Trust is the Data Controller for personal data processed through the Ascom Clinical Communication and Falls Prevention System. We determine the purposes and means of processing personal data for the delivery of safe and effective care, including falls prevention, real-time alerts, clinical review, audit and incident investigation.

The Trust works with Ascom (UK) Limited, which acts as a data processor by supporting the provision, implementation, maintenance and technical support of the Ascom Clinical Communication and Falls Prevention System.

 

Ascom is required to process personal data only on the Trust’s instructions and to apply appropriate technical and organisational measures to protect personal information, in line with UK data protection law and NHS information governance requirements. These measures include access controls, audit logging, encryption, vulnerability management, incident response arrangements and role-based permissions.

 

The Trust maintains appropriate contractual and information governance arrangements with Ascom, including data processing terms and security requirements.

We process the minimum amount of personal data required to support safe and effective falls prevention and patient monitoring. This may include:

• Identity data: name and date of birth, where this is manually entered during admission.
• Location data: bedroom or bed location information used to identify where an alert or activity event has occurred.
• Movement and alert data: movement patterns, bed or room activity status, sensor events and fall-risk alerts.
• Health data: relevant information about physical or mental health, mobility or falls risk, where needed to support safe care and clinical decision-making.
• Clinical review and audit information: notes or incident-related records linked to alerts, clinical review, audit, quality improvement or investigation.

The system may identify a patient through their name and date of birth if these details are manually entered. Where this is not entered, the system uses bedroom or location-based information with activity status updates, which may need to be cross-referenced with Trust records to identify the patient.

The Trust uses information from the Ascom Clinical Communication and Falls Prevention System for the following purposes:

• Monitoring patients who have been assessed as being at risk of falls.
• Detecting movement, activity or events that may indicate a fall or increased risk of falling.
• Sending real-time alerts to clinical staff so they can respond promptly.
• Supporting clinical review, care planning and staff decision-making.
• Supporting audit, incident investigation, quality improvement and patient safety monitoring.
• Helping the Trust meet its statutory duties to provide safe and effective care.

The technology supports clinical staff but does not replace clinical judgement. Final care decisions are made by trained members of staff.

The Trust processes personal data under:

• Article 6(1)(e) UK GDPR: processing is necessary for the performance of a task carried out in the public interest.
• Article 9(2)(h) UK GDPR: processing is necessary for health or social care purposes and the management of health or social care systems.
• Schedule 1, Part 1, paragraph 2 of the Data Protection Act 2018: health or social care purposes.

Where confidential patient information is used for direct care, the Trust relies on implied consent under the common law duty of confidentiality.

The Ascom Clinical Communication and Falls Prevention System is used primarily within the Trust for direct care, patient safety, clinical review, audit and incident investigation. Access is limited to authorised staff who require the information for their role, including nurses, healthcare assistants, allied health professionals, relevant clinical staff, audit and governance staff, and authorised technical support staff.

Where necessary, limited information may be made available to Ascom (UK) Limited for maintenance, support, testing or technical issue resolution. Ascom may only process information in accordance with the Trust’s instructions and relevant contractual requirements.
In exceptional circumstances, information may be shared with regulators or statutory bodies, such as the Care Quality Commission, NHS England or the Information Commissioner’s Office, where this is required by law or necessary for patient safety, audit, regulatory inspection or incident investigation.

The Trust does not use the information for unrelated purposes, and any proposed new use of the system or information would require appropriate clinical and information governance review.

All personal data is stored, accessed and shared in accordance with data protection law and NHS information governance standards. Data collected by the Ascom Clinical Communication and Falls Prevention System is stored on secure Trust premises and is not routinely stored in the cloud or on external servers outside the United Kingdom.

Access to the system is role-based and limited to authorised users. System access and activity are logged and auditable. Security measures include encryption, access controls, secure configuration, monitoring, vulnerability management, incident response procedures, backup and disaster recovery arrangements, and regular review of security controls.

Data processed by Ascom on behalf of the Trust is subject to ongoing information governance oversight and must be processed in accordance with the Trust’s instructions and agreed contractual requirements.

Personal data is not transferred outside the United Kingdom unless this has been approved by the Trust and appropriate safeguards are in place in accordance with data protection law.

Event logs, audit records and historical reports are generally retained for 6 to 12 months after collection to support clinical review, quality improvement, audit and compliance. Information linked to incidents, claims, investigations or statutory requirements may be retained for longer where necessary and authorised.

You have rights in relation to your personal data, including the right to access, rectify, restrict or object to processing in certain circumstances. More information is available in the Trust’s main Privacy Notice.

Requests to access information held about you are managed through the Trust’s standard Subject Access Request process, coordinated by the Information Governance Team. Where system-generated monitoring data is inaccurate or disputed, it may not always be deleted, but it can be reviewed and annotated where appropriate to support accuracy and clinical context.

The right to erasure and the right to object may be limited where the information is required to provide safe care, meet legal obligations, investigate incidents or protect patients from harm. Each request will be considered on a case-by-case basis.

If you would like more information about how we process your personal data, or if you wish to exercise your data protection rights, you can contact our Data Protection Officer (DPO):

Michael Morgan-Bullock,
Head of Legal Services and Information Governance

• Email: bchc.dpo@nhs.net
• Post: Data Protection Officer, Birmingham Community Healthcare NHS Foundation Trust, 3 Priestley Wharf, Holt St, Birmingham, B7 4BN.

You also have the right to raise concerns with the Information Commissioner’s Office (ICO):

• Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF.
• Helpline number: 0303 123 1113
• Website: https://ico.org.uk