GM Digital Platform Privacy Notice

This privacy policy explains the following:

The services the Early Years Application (App) provides and who was involved in its development
Who the controller is for the personal data processed when using the App
What information is collected about you
Where your data is stored, and how long it is retained for
Your information rights
Points of contacts for queries, objections and complaints.

About Greater Manchester Combined Authority

The Greater Manchester Combined Authority (GMCA) is an organisation run jointly by the leaders of the ten councils within Greater Manchester, and the Mayor of Greater Manchester, Andy Burnham. GMCA gives local people more control over issues that affect their area and it means the region can speak with one voice, making a strong case for resources and investment.

About the Early Years App

The Early Years App provides digital access to the assessment models used by Early Years professionals . The service aims to promote good health and wellbeing by working with parents and carers of children from birth to 2 ½ years old and their family. Parents and carers are supported by the Early Years services to talk about their child’s development at different milestones using the Ages and Stages Questionnaires (ASQ3 and ASQSE), along with other assessment forms such as WellComm and those tracking maternal mental health. This application allows for the questionnaires to be completed by parents / carers electronically prior to meeting with the health visitor at the relevant stages.

There is an extension of the Early Years App for older children, called Early Education. Early Education enables data to be shared between professionals to help support children and their families better up to statutory school age. It is also used to develop lessons, increase learning and to provide a WellComm reporting tool to support children and identify communication and speech needs earlier. This functionality helps support the wider Greater Manchester ambition of improving school readiness across the region and having consistent data collection across the localities.

There are two levels of authentication in the Early Years application which provide parent/carers with different levels of system access. In order to access Early Years, parent/carers will initially create their NHS login using the ‘P5’ level of authentication which requires them to input their name, NHS number, date of birth and postcode. This gives access to current assessment forms which require completion, video content and guidance and limited child details within the application. Parent/carers then have the option to increase their level of access to ‘P9’ by submitting photo ID and recording a short 10 second video in order for the NHS to verify the person’s identity. This will enable parent/carers to additionally view historical child assessment forms, documents shared by health visitors and more detailed child demographic information.

Other parties involved in the Early Years Digitisation project include the Greater Manchester Health and Social Care Partnership, Salford Royal NHS Trust and the Bury and Rochdale Health Visiting Services.

How we use your personal information

This privacy policy relates to the services provided by the Greater Manchester Combined Authority (referred to in this notice as GMCA), regarding the Early Years App. Detailed information regarding how your personal data is processed can be found on the website of the service you are working with.

Our commitment to protecting your personal information

The information you provide will be subject to rigorous procedures to make sure it can’t be seen, accessed or shared with anyone who shouldn’t see it. We've set up security measures, policies and procedures to do this, they ensure the following:

All staff receive specific information security training
All staff comply with Information Security policies and procedures. These set out how your information is protected and what happens if the security of the information is breached
All the laptops used by staff are encrypted and need a unique logon password and ID to access the computer systems
All desktop computers need a unique logon password and ID to access the computer systems
Staff only have access to the information they need to do their job. This means if they are not the right person in the right team, they will not be able to see your information
Staff with access to the most sensitive information may need to have a Disclosure and Barring Service (DBS) check. This check will show any criminal convictions which may mean the staff member cannot be trusted with your information.

We also have responsibilities to keep our computer systems secure and take steps to stop outside malicious access also known as hacking. This requires us to comply with requirements specified by Central Government. Find out more about the Central Government requirements at https://www.gov.uk/guidance/public-services-network-psn-compliance.

Your personal data – who controls its use?

The data controller for your data will depend on the services you are accessing and the locality in which you live.

The organisation that is the controller or processor of your personal data will depend on the data that is captured. For clarity, these terms are defined as follows:

Controller - "The person or entity which alone or with others determines the purposes or means or processing of personal data"

Processor - "Any person or legal entity who processes personal data on behalf of the controller"

You can view the specific privacy policy for your area and service from the links below.

Locality	Health Visiting Services (provided by health visitors to your child from birth to 2 ½ years)	Early Education Services (provided by practitioners to your child from 2 ½ years old to statutory school age)
Salford	Under Review	Starting Life Well legal notices • Salford City Council
Rochdale	https://www.northerncarealliance.nhs.uk/patient-information/northern-care-alliance-nhs-foundation-trust-privacy-notice	http://www.rochdale.gov.uk/council-and-democracy/privacy-cookies-and-data-protection/Pages/privacy-notice.asp
Bury	https://www.northerncarealliance.nhs.uk/patient-information/northern-care-alliance-nhs-foundation-trust-privacy-notice	Under Review

Please also note that if you access our service using your NHS login details, the identity verification services are managed by NHS Digital. NHS Digital is the controller for any personal information you provided to NHS Digital to get an NHS login account and verify your identity, and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS Digital (as the “controller”) when verifying your identity. To see NHS Digital’s Privacy Notice and Terms and Conditions, click here. This restriction does not apply to the personal information you provide to us separately.

What information we collect about you and how it is used

For reference to the data inputted into the Early Years App, please refer to the privacy notices by the health providers. This section only refers to information captured by the back end of the Early Years App

We may collect several different types of information for various purposes to provide and improve our Service to you, this may include the following:

Usage data

This data may include information such as your computer's Internet Protocol address (e.g. IP address), browser type, browser version, the pages of our Service that you visit, the time and date of your visit, the time spent on those pages, unique device identifiers and other diagnostic data

Tracking and Cookies data

We use cookies and similar tracking technologies to track the activity on our service and hold certain information. The necessary cookies make the Early Years App work and enable core functionality such as security, network management, and accessibility. You may disable these by changing your browser settings, but this may affect how the website functions.

Cookies are files with small amount of data which may include an anonymous unique identifier. Cookies are sent to your browser from an app and stored on your device. Tracking technologies also used are beacons, tags, and scripts to collect and track information and to improve and analyse our service.

Where your data is stored

We only store and process your personal data within the UK.

Your information rights

We must comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018. These Data Protection laws provide a number of rights to you.

These rights are listed below:

Your right of access - You have the right to ask us for copies of your personal information.
Your right to rectification - You have the right to ask us to rectify information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
Your right to restriction of processing - You have the right to ask us to restrict the processing of your information in certain circumstances.
Your right to object to processing - You have the right to object to the processing of your personal data in certain circumstances.
Your right to data portability - You have the right to ask that we transfer the information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you wish to make a request to exercise one of your rights in relation to the information held in the Early Years App, then please view your locality privacy notice

If you wish to make a request to exercise one of your rights in relation to the information stored within the Early Years App, then please contact the relevant data controller. More information around this will be on the health provider’s privacy notice.

Objections and complaints about the Digital Platform

If you are not satisfied with how your service provider is using the information we hold about you please contact the service provider’s Data Protection Officer. The contact details will be in the organisation’s privacy notice

If you are still not satisfied with the response to any request to exercise your individual rights or if you believe that your personal data is not being processed in accordance with the law, you can contact the Information Commissioners’ Office (ICO) via their website: https://www.ico.org.uk.

Post: Information Commissioner’s Office, Wycliffe House, Water Lane, Wilmslow, SK9 5AF. Telephone: 0303 123 1113.

If you have a complaint about how the health providers are using your data, please refer to their privacy notice to obtain details of how to make a complaint.

NHS Login

In order to access the Early Years application you will be required to set up an NHS login. Privacy information for NHS login is below:

Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS Digital. NHS Digital is the controller for any personal information you provided to NHS Digital to get an NHS login account and verify your identity, and uses that personal information solely for that single purpose. For this personal information, our role is a “processor” only and we must act under the instructions provided by NHS Digital (as the “controller”) when verifying your identity. To see NHS Digital’s Privacy Notice and Terms and Conditions, please click here. This restriction does not apply to the personal information you provide to us separately.