Data input and sharing; data controllership(s)

A data controller determines the purposes and means of processing personal data, while a data processor is responsible for processing personal data on behalf of a controller.

Data input into the SBPP by SBUHB

• SBUHB is the originating data controller for all the personal data it inputs into your SBUHB Patient Record within the SBPP.
• Should you decide to share this information with another organisation (such as another Health Board) via SBPP, that organisation becomes a separate data controller for that information and that information will form part of your Patient Record managed by that organisation.  SBUHB remains a data controller for the original data input.
• Should you decide to share this information with an induvial acting outside of an organisational context (such as a family member), SBUHB remains the sole data controller in these instances.
• PKB does not take on data controllership of this information in relation to its contract with SBUHB. PKB acts as a data processor for this information.

Data input into the SBPP by yourself

You enter data following direction or encouragement from SBUHB

• If you enter information into the SBPP after direction or encouragement from SBUHB, such as we ask you to complete a survey, then SBUHB becomes the data controller for this information.
• Should you decide to share this information with another organisation (such as another Health Board) via SBPP, that organisation becomes a separate data controller for that information and that information will form part of your Patient Record managed by that organisation.  SBUHB remains a data controller for the original data input.
• Should you decide to share this information with an induvial acting outside of an organisational context (such as a family member), SBUHB remains the sole data controller in these instances.
• PKB does not take on data controllership of this information in relation to its contract with SBUHB. PKB acts as a data processor for this information.

You enter data without direction or encouragement from SBUHB, and SBUHB has access to this information (excluding direct messaging functionality where available)

• SBUHB and PKB are separate data controllers for this information
• Should you decide to share this information with another organisation (such as another Health Board) via SBPP, that organisation becomes a separate data controller for that information and that information will form part of your Patient Record managed by that organisation.  SBUHB and PKB also remain data controllers for the original data input.
• Should you decide to share this information with an induvial acting outside of an organisational context (such as a family member), SBUHB and PKB remain the sole data controllers in these instances.

You enter data within direct messaging functions without direction or encouragement from SBUHB, and SBUHB has access to this information

• If you enter information into the SBPP after direction or encouragement from SBUHB, such as we ask you to complete a survey, then SBUHB becomes the data controller for this information.
• Should you decide to share this information with another organisation (such as another Health Board) via SBPP, that organisation becomes a separate data controller for that information and that information will form part of your Patient Record managed by that organisation.  SBUHB remains a data controller for the original data input.
• Should you decide to share this information with an induvial acting outside of an organisational context (such as a family member), SBUHB remains the sole data controller in these instances.
• PKB does not take on data controllership of this information in relation to its contract with SBUHB. PKB acts as a data processor for this information.

You enter data without direction or encouragement from SBUHB, and SBUHB does not have access to this information*

• PKB is the data controller for this information.
• Should you decide to share this information with another organisation (such as another Health Board) via SBPP, that organisation becomes a separate data controller for that information and that information will form part of your Patient Record managed by that organisation.  PKB remains a data controller for the original data input.
• Should you decide to share this information with an induvial acting outside of an organisational context (such as a family member), PKB remains the sole data controller in these instances.
• SBUHB does not take on data controllership of this information.

*For instances where you later decide to share this data with SBUHB, SBUHB becomes a sperate data controller for this information and it will form part of your SBUHB Patient Record. PKB remains a data controller for the original data input.

Data input into your Account by another organisation, which you then share with SBUHB.

• SBUHB and the sharing organisation are separate data controllers for this information
• Should you decide to share this information with another organisation (such as another Health Board) via SBPP, that organisation also becomes a separate data controller for that information and that information will form part of your Patient Record managed by that organisation.  SBUHB and the original organisation who shared the information with SBUHB also remain as separate data controllers.
• Should you decide to share this information with an induvial acting outside of an organisational context (such as a family member), SBUHB and the organisation who shared the information with SBUHB remain the sole data controllers in these instances.
• PKB does not take on data controllership of this information in relation to its contract with SBUHB. PKB acts as a data processor for this information.

Flowchart of data input and sharing; data controllership(s)

The below provides a visual summary of the data controllership flow

Data input by the Health Board

Data input or shared with SBUHB by the patient