Quality Review Service (QRS)

This Privacy Notice explains what you can expect from us when we collect and use your personal information.

1. Your personal data – what is it?

Personal data includes any identifiers such as your name, title, date of birth, postal address, email address or telephone number that can be used to identify an individual. 

The processing of personal data is governed by the General Data Protection Regulations (the “GDPR”) and, as a data processor, QRS is required to ensure that it collects, stores and shares this information in line with Data Protection law. 

2. What and why do we collect personal information?

We collect personal information (name, job title, role, organisation, telephone number and email address) in order to keep you informed of QRS news and events. We also communicate with you, if you are a member of review teams, in relation to the agreement of report content and include your name, as a member of the review team, in the final report.

3. What is the legal basis for processing your personal data? 

  • Your explicit consent (as the ‘data subject’) so that we can keep you informed about the items listed above.
  • The law also requires us to share personal information, without consent, where there is a legitimate public interest for example the prevention or detection of crime, apprehension of offenders or to protect members of the public from serious harm.

4. Sharing your personal data

Your personal data will be treated as strictly confidential and will not be shared by us with any third parties.

5. How long do we keep your personal data?

We retain and dispose of data in accordance with the Records Management Code of Practice for Health and Social Care 2016. 

6. Your rights and your personal data 

Subject to any exemptions under the GDPR, you have the following rights with respect to your personal data: 

  • The right to request a copy of your personal data which QRS holds about you;
  • The right to request that we correct any personal data if it is found to be inaccurate or out of date;
  • The right to request your personal data is erased;
  • The right to withdraw your consent to the processing at any time;
  • The right to request that we provide you, as the data subject, with your personal data;
  • The right, where there is a dispute in relation to the accuracy or processing of your personal data, to
    request a restriction is placed on further processing;
  • The right to lodge a complaint with the Information Commissioners Office. 

7. Further processing 

If we wish to use your personal data for a new purpose, not covered by this Privacy Notice, then we will provide you with a new notice explaining this new use prior to commencing the processing and setting out the relevant purposes and processing conditions. Where and whenever necessary, we will seek your prior consent to the implementation of any new processing. 

8. Contact Details

To exercise all relevant rights, address any queries or complaints please in the first instance contact the
QRS office at: qrs@nhs.net

9. Review and Monitoring

This Privacy Notice will be reviewed annually by the QRS Board, or when there is a change to an existing data process or change in the law.


September 2019