Our privacy policy: What happens to the information you give us

We are continuing to respond to information rights requests during the pandemic. However, due to these unprecedented circumstances, it is likely to take us longer to resolve your request. We will try to respond as quickly as possible but may not be able to do so within statutory timescales.

We will keep you informed throughout. Thank you for your patience and understanding.

This privacy notice is intended to give anyone information about how we use and look after information about you, or that could identify you. 

This privacy notice is intended to give anyone information about how we use and look after information about you, or that could identify you. 

We manage this information in accordance with the General Data Protection Regulation (EU) 2016/679). 

If you have any further queries, please email the Data Protection Officer dpo@Ombudsman.org.uk.

We are registered with the Information Commissioner's Office (ICO) as a Data Controller. Our registration number is Z6520944. 

Download the EasyRead version of our Privacy Policy [.PDF, 3 MB]

What information do we collect about you?

When you first contact us, we will record your name, address, telephone number, email address and details of your complaint in a file that we hold:

  • on a computer
  • on paper
  • in the cloud
  • or all of the above.

Why we collect this information

  • Our role is to consider complaints about government departments, a range of other public organisations in the UK and the NHS in England, where you believe they have not acted properly or fairly or have provided a poor service. So that we can do this we need to collect and use information about you and your complaint.  
  • We are allowed to use your information for the purpose of handling your complaint under our legislation. This legislation also protects information obtained for the purposes of investigating your complaint.  

Sharing your information when you first contact us

  • We will treat your information considerately and confidentially. However, we will need to share some information about your complaint with the organisation you have complained about. By making your complaint, you agree that we can share information about you and your complaint.  

  • If you do not want us to share the information you have given us with the organisation you have complained about, please tell us straight away. Please be aware, however, that this is likely to limit our ability to investigate your complaint. 

Why do we share your information? 

  • We may talk to the organisation that you have complained about so we can learn more about what happened and how they responded to your complaint to them. As the Ombudsman is the final stage in the complaints process, we will want to understand the history of your complaint.  

  • This will help us decide how to handle your complaint.  

  • We might also ask for advice about your complaint from someone with specialist knowledge (for example, a psychologist, midwife or obstetrician). PHSO works with qualified medical professionals to provide expert and independent knowledge.  

Sharing your information if we do not investigate your complaint 

  • Sometimes we can help to put things right without an investigation. There might be other reasons why we cannot help you further with your complaint. If so, we will send you or your MP (if you have complained about a government body) a explaining our reasons for not investigating your complaint. 

  • We may send details of this final letter to the organisation or person you complained about. This is to help them learn from the complaint and to consider if they need to do things differently or better.  

Sharing your information so that we can investigate your complaint

  • If we decide to investigate your complaint, we must tell the organisation and any person complained about. We will therefore need to share your name and the details of your complaint.  

  • At the same time, we will usually ask the organisation for more information (including relevant papers and computer records). This can include very sensitive information such as your health records.  

  • We can also ask for information from anyone who we think can help us with your investigation. This could be someone with specialist knowledge (such as a psychologist, midwife or nurse) or someone who can tell us more about what happened and the impact it had on you (such as a relative or an employer). 

Investigating with the Local Government and Social Care Ombudsman 

  • Sometimes complaints are about both health and care. For example, complaints about older people whose care is being jointly provided by social care and health services. In these cases, we may carry out a joint investigation with the Local Government and Social Care Ombudsman (LGSCO). 

  • This will mean sharing your information with them. If we do need to work with the LGSCO we will ask for your consent first.  

  • If you consent to both organisations dealing with your complaint, you are also giving your consent to the organisations sharing your information if they need to. For specific details on how we and the LGSCO carry out a joint investigation and details of the Data Protection Officer please see our joint working agreement

Sharing draft and final reports on an investigation 

  • Towards the end of our investigation, we will send you and the organisation, and any person complained about, a copy of our initial view (which we call provisional view). This gives you both a chance to comment on our draft findings. 

  • Our draft report is confidential. It will contain all the information from you and others that we have contacted. You and the organisation may share the draft report with people who can help you comment on its accuracy and content (for example, a family member or professional adviser), but by law you and the organisation complained about must not make the contents public. 

  • After we receive comments on the draft report, we will send a final report to: 

    • you 

    •  your MP (if your complaint was referred to us by the MP) 

    • the organisation and any person complained about. 

  • Once you and the organisation have received the final report, it is up to you both how you use it. You both must, however, be aware of any information within the report that can identify you or any other person and handle it with care. 

  • If we think that your complaint provides insight into how services or organisations can improve or is in the public interest, we will share our findings with:  

  • regulatory organisations (such as the Care Quality Commission, General Medical Council or Monitor) if we have identified a problem that may affect others 

  •  any other appropriate organisation that may benefit from what has been learned from our report. 

  • Before we send any information or reports about your complaint we will remove any information about you or information that may enable you to be identified.  

  • Unless we decide to publish the report, we will not normally discuss its contents with anyone other than those involved in the investigation. There is more information about our published reports later in this policy. We will ensure that people who make complaints cannot be identified from our published reports. 

Using your information for our wider functions of improving public service and for training and monitoring purposes 

  • We want to make sure that we provide a good service, so we might use your complaint for training, monitoring and evaluation purposes or invite you to meetings where we explain more about the Ombudsman’s roles and responsibilities, and ask for your feedback. We will only share any information you provide with our staff or people acting on our behalf. 

  • For example, we run surveys which ask for feedback so that you can tell us what we are doing well and what we could improve. To do this, we will share your contact details with a survey company, Opinion Research Services (ORS). ORS will get in touch with individuals on a randomly selected basis so, although not everyone will be contacted, you may be invited to provide feedback. 

  • We survey people at different points throughout our process and any feedback you give within these surveys will remain confidential. The survey company will keep the information for three months after the closure of that year’s survey. This could be up to fifteen months after you have given your feedback. We will then keep this information for up to one year.  

  • As you have the right to be forgotten (also known as the right to erasure), if at any time you want to withdraw your feedback, please contact the information rights team at informationrights@ombudsman.org.uk  

  • Your responses will only be shared in an anonymous format, unless you tell us otherwise. 

  • The law allows us to use your contact details in this way. This is known as legitimate interest. If you do not want to take part please tell your caseworker, call us on 0300 061 4222, or email customer.survey@ombudsman.org.uk  

  • You can change your mind at any time, and this will not have any impact on how we handle your complaint. 

  • If your complaint is handled by our Early Dispute Resolution (EDR) team, we will contact you at the closure of your case to request you to take part in a survey about your experience. We will use this feedback to help us improve our service. As with our standard survey, you do not have to take part and your decision to participate will have no bearing on how we handle your case. However, if you do participate, so that we can understand your experience, we will save your feedback to your case file. This means that this survey is not anonymous. 

Information for public sector organisations 

  • From time to time, we may invite people to take part in targeted surveys. This could be to understand the impact of our work on complaint handlers or clinicians. When we do this, we will only use your professional contact details such as your work email address. All surveys will either be stored within our UK hosted, secure survey software (Snap Surveys) or be conducted by a trusted survey company (Opinion Research Services). Participating is entirely voluntary and we will never ask you for personal information. 

Transfers of information overseas 

  • In exceptional circumstances it may be necessary to transfer personal information overseas. If we need to use an organisation or expert outside the United Kingdom, we will conduct a full privacy assessment and publish that here.   

How long will we keep your information? 

  • We will keep all information about you and your complaint for two years after making our decision. This is whether we investigate your case or not.  At that point, we will delete most of your information except the following, which we keep permanently: 

    • the final investigation report; 

    • information of historical significance; 

    • complaints subject to ongoing legal proceedings; 

    • enough information to be able to identify you if you re-open or decide to begin a second complaint. This includes your name, your address, the name of the organisation you complained about, what you complained about, and the outcome. This is so we do not answer the same complaint twice.  

  • If you use our online form to start the complaints process and submit it to us, we will save that information electronically. You can create an account to be able to save and view any forms you have created.  

  • If you start but don’t complete and send your complaint form to us, we will assume that you do not wish to continue with your complaint. If so, we will keep the information you submitted online for 1 month before deletion.  

Information we publish information about our work 

  • Our investigations resolve complaints on an individual basis, but they also provide an overview of issues other organisations can learn from.  

  • We share this learning by reports about particular subjects such as mental health or eating disorders. 

  • We present thematic reports to Parliament and publish them on our website. Other than in exceptional circumstances, we always remove any information that identifies you.  

  • We publish our casework decisions on our website. This includes:

    • when we make a decision not to take your complaint further 

    • the final report into the complaint. 

  • We publish our decisions to help people understand what we do, how we do it and what to expect from us. 

  • Being transparent enables individuals and organisations to see how we may remedy complaints and improves public service as organisations learn from others. It also helps people who are not sure if they can bring a complaint to be more confident to come forward. 

  • This is why we publish decisions we have upheld and those which we have not, as well as primary decisions when we decline to investigate. Publishing casework means telling our complainants' stories. In doing so we create learning opportunities for the organisations we investigate and inform the public about PHSO’s vital work.  

  • We started publishing our disclosure log in December 2021. This is so everyone can see responses to questions we have been asked by the public under the Freedom of Information Act (FOI).

  • We will always remove any information that identifies you before we publish. 

Your rights

You have rights under the General Data Protection Regulation (GDPR):  

  • You have the right to be informed about how we use your information. This is called a privacy notice and you’re reading an example  

  • You have the right to request a copy of information we hold about you and this is free of charge.  

  • We may however not be able to give you the information you are after if, for example, if it contains personal information about other people, we are in the middle of an investigation, or if the information has been given to us in confidence.  

  • If you would like a copy of some or all of the personal information we hold about you, you can ask the person handling your complaint, or contact our Freedom of Information and Data Protection Team by emailing informationrights@ombudsman.org.uk or writing to:

    Information Rights
    Office of the Parliamentary and Health Service Ombudsman 
    47-51 Mosley Street 
    M2 3HQ 

  • If you think we have got your details wrong, please let us know and we will update them within one month. 

  • You have the right to ask us to delete your personal data. This is sometimes known as the right to be forgotten or the right to erasure. 

  • If the data you are asking us to delete was information to investigate and resolve your complaint, we may not be obliged to erase this information. This is because the right to erasure does not apply information which we hold to fulfil our official functions as detailed in our legislation (also known as public task). 

  • If we do agree to your request to delete your information,  may need to keep enough information to make sure that we honour your request. In some cases, we need to keep your information even though you have made a deletion request, also known as the right, to be forgotten. This is when we are bound by law to keep information for longer.  

  • If you want to request the deletion of your personal data you can email informationrights@ombudsman.org.uk or write to: 

    Information Rights
    Office of the Parliamentary and Health Service Ombudsman 
    47-51 Mosley Street 
    M2 3HQ 

  • You have the right to ask us to not use your personal information for certain purposes. You may, for example, not want your information to be shared with the LGSCO, the final report or decision statement about your complaint to be published or to take part in feedback. We will retain just enough information about you to make sure your wishes are respected in the future.   

  • If you want to object to how your personal data is used, you can email informationrights@ombudsman.org.uk or write to: 

    Information Rights
    Office of the Parliamentary and Health Service Ombudsman 
    47-51 Mosley Street 
    M2 3HQ 

  • We will not sell your information or use it for commercial purposes.

Freedom of information

  • We are a public authority under the Freedom of Information Act 2000 (the FOI Act). We will not release information we hold about you to other people under this Act. This is because we cannot release any information we obtain about a complaint unless we need to do so to carry out our work. 

  • Under the Freedom of Information Act 2000 and the Environmental Information Regulations 2004 you have a right to request any recorded official information held by us. The information you require may already be publicly available and we have a duty to make official recorded information available. 

  • We make information available via a publication scheme. Before you make  a request please check the publication scheme.  

  • If you need to make a request, it must be done in writing.  You can email: InformationRights@Ombudsman.org.uk or write to:  

    Information Rights
    Office of the Parliamentary and Health Service Ombudsman 
    47-51 Mosley Street 
    M2 3HQ 

  • You do not need to say why you want the information. Your request must include your name, and an address for correspondence (email address is fine). Please make it clear what information you require. With certain exceptions, you are entitled to a response within 20 working days. There is no charge for making a Freedom of Information request.  

  • However, we can refuse to deal with your request if: 

  • We do not hold the information you have requested  

  • The information is exempt from disclosure  

Changes to our privacy notice

  • We keep our privacy notice under regular review. This notice was last updated in January 2022.

Complaints, comments and compliments 

  • If you wish to make a compliment, comment or complaint about how the PHSO are processing your data, then please  contact the Data Protection Officer at dpo@Ombudsman.org.uk  

  • If you are still unhappy with how we have handled your complaint, you may contact the Information Commissioner's Office. The Information Commissioner Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Phone: 08456 30 60 60 Website: www.ico.org.uk 

  • If this privacy notice changes in any way, we will place an updated version on this page.  

  • For information on how our website uses cookies please see https://www.ombudsman.org.uk/cookies

How to contact us

Please get in touch if you have any questions about our privacy policy or information we hold about you. Please email: dpo@ombudsman.org.uk

Contact details for the PHSO Data Protection Officer:

Angharad Jackson 
Data Protection Officer
Office of the Parliamentary and Health Service Ombudsman
47-51 Mosley Street
M2 3HQ

Further information

  • If you want to know more about our commitment to keeping your information safe, read our Information Promise

  • For more information about your rights under the Freedom of Information Act 2000 and the General Data Protection Regulation, see the Information Commissioner's website at www.ico.org.uk 

  • If you want to make a request for information, please contact: informationrights@ombudsman.org.uk 

  • Our publication scheme gives details of all the information we make freely available to the public. It includes our records management policy and casework retention schedule.