Patient Level Information and Costing Systems (PLICS)
FDP Product Privacy Notice
Product Description
The care organisations who make sure care is provided in the right way, use this Product to support and improve the NHS services provided to you and all patients across the nation. The Product enables care organisations to assess the effectiveness of their services, supporting them to plan and deliver care.
What are the purposes for processing my personal data in this Product?
The Product enables the NHS to better understand how NHS monies are being used. This is through the use of personal information (called ‘personal data’ under data protection laws) about patients who are receiving treatment. This information is only accessible by the care organisations providing you with treatment.
What personal data about me is processed in this Product?
Personal data which directly identifies you (we call this directly identifiable data) will be processed by the Trust about patients who have received treatment, for the purposes above. Data that is processed by hospitals that use this Product may include your;
- Name
- Address and postcode
- Date of birth and age
- Sex and gender
- General Identifier e.g. NHS Number
- Physical / Mental Health or Condition, Diagnosis / Treatment
Personal data about members of staff involved in the delivery of care may also be processed when using this Product, including the names of staff involved in providing care, and their email addresses.
Who is my personal data shared with?
Any identifiable personal data will not be shared with organisations and remains with the care organisations providing you with treatment.
Where identifiable information relating to you is shared with NHS England, more information can be found here;
NHS England » National Identifiable Data Collections Instance Acute Dashboard
De-identified data is securely analysed by a small number of data analysts in NHS England for the purposes of creating anonymous aggregated data to display in dashboards. This is statistical counts of data that doesn’t identify you. It is therefore not personal data. Your personal data will not be shared with any other organisation as part of this Product.
Authorised users from NHS England, care organisations and Integrated Care Boards can access the anonymous data in the dashboards for the purposes described above.
UK GDPR Information
Controllers of your personal data
Under data protection law the Trust using the Product are the legal controllers of your personal data under data protection laws. The specific Trust using the Product are listed on the Product Description page of the NHS England website here.
Legal grounds for processing your personal data
Under data protection law the Trust using the Product are the legal controllers of your personal data under data protection laws. The specific Trust using the Product are listed on the Product Description page of the NHS England website here.
- Public Task – Article 6(1)(e) of UK GDPR ‘necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.
- Health Care – Article 9(2)(h) of UK GDPR ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…” In addition, the legal grounds under paragraph 2 of Part 1 of the DPA 2018 apply (health care purposes).
The personal data processed about patients by the Trust for the purposes above is also confidential data. As the care organisation is processing your confidential data to provide you with individual care, it is relying on your implied consent to do this, as you would reasonably expect the hospital to process your personal information this way to provide you with care. The care organisation will keep your personal data confidential and only use and share it with other members of the care team to provide you with care, where you would reasonably expect them to, and subject to strict confidentiality controls to ensure your information remains confidential.
Processor acting on behalf of care organisations and the Trust
The data platform contractor, Palantir Technologies UK LTD is a processor acting on behalf of the NHS England who are using this Product. They provide the data platform and the technology that the Product uses and only act on the instructions of the NHS England and the care organisations.
Your rights under UK GDPR
You have the following rights under UK GDPR in relation to the processing of your personal data by the care organisations for the purposes above:
- Right to be informed
- Right of access
- Right to rectify
- Right to object
Further information about these rights is in the NHS Federated Data Platform Privacy Notice here. Your Trust will also have a Privacy Notice on its own website which will explain more about how the Trust processes your personal data, your rights and how to exercise them.
Contact details for data protection officers in the Trust using this Product are here.
Does the National Data Opt Out or any other opt out apply to this Product?
The National Data Opt Out by the care organisation for the purposes explained above. This is because the care organisations is processing your personal data to provide you with individual care and treatment. Type 1 Opt Outs by the care organisations do not apply to the processing of your personal data the data used is not received from your GP Practice, this opt-outs don’t apply in these circumstances.
More information
For more information about how personal data is processed within the Federated Data Platform please see the NHS Federated Data Platform Privacy Notice here.
| Last updated date | 26th June 2025 |