Client Privacy Notice

Your data, your rights

1.Introduction

The Bridge Sexual Assault Referral Centre (“The Bridge SARC”, “we”, “our”, “the Service”) provides specialist medical, forensic, and support services to adults, young people, and children who have experienced rape or sexual assault. The service is operated by University Hospitals Bristol and Weston NHS Foundation Trust (UHBW).

We are committed to protecting your privacy and ensuring that your personal information is used lawfully, fairly, and transparently in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• NHS Act 2006
• Health and Social Care Act 2012
• Safeguarding legislation
• Police and Criminal Evidence Act 1984 (PACE)
• Forensic Science Regulator Act 2021 (incl. Forensic Science Regulator Code of Practice)

This Privacy Policy explains:

• What information we collect
• How and why we use it
• Who we share it with
• Your rights
• How long we keep information
• How we protect your information

This document supplements the UHBW Trust Privacy Notice, which can be found here: https://www.uhbw.nhs.uk/p/how-we-use-your-data/what-we-do-with-your-information

2. Who We Are

The Bridge Sexual Assault Referral Centre (SARC)

We are part of University Hospitals Bristol and Weston NHS Foundation Trust (UHBW), this means UHBW act as the data controller.

Trust Data Protection Officer: InformationGovernance@UHBW.nhs.uk

The Bridge SARC email: TheBridge@UHBW.nhs.uk

The Bridge SARC telephone: 0117 342 6999

3. What Information We Collect

We collect and record personal and sensitive information that is necessary for providing clinical care, forensic examination, safeguarding, and support.

3.1 Personal and demographic details

• Name, address, date of birth
• Contact details
• NHS number (if known/provided)
• Protected characteristics (e.g., sex, ethnicity, religion)

3.2 Information you disclose about the incident

This may include:

• Details of the assault (only if you choose to disclose)
• Time, date, location (if known)
• Whether a police report has been made
• Information needed for risk assessments and care planning

3.3 Medical and healthcare information

• Medical history
• Medications, allergies
• Sexual health history (where relevant)
• Mental health information
• Any treatment offered or provided

3.4 Forensic information

If you choose to complete a forensic medical examination, we may collect:

• Forensic medical examination findings
• Injury documentation
• Body maps
• Toxicology samples
• DNA samples
• Clothing or physical evidence

3.5 Images and recordings

The Bridge SARC uses a forensic colposcope. This may be used if you choose to complete a forensic medical examination and provide consent for the use of the colposcope.

• Images and videos are stored on secure, encrypted, offline hard drives
• These devices are not connected to the internet or cloud services
• Only trained authorised clinicians have access

3.6 Safeguarding information

For adults, children, and young people:

• Risk assessments
• Safeguarding referrals
• Multi‑agency information (e.g., social care, police, health professionals)

3.7 Referral information

We may receive information from:

• Police
• Social care
• Other NHS services
• Schools or colleges
• Other professional referrers

4. How We Collect Information

We collect information:

• Directly from you
• From police if they refer you
• From social care if they refer you
• From parents/carers (for paediatric cases)
• From other professionals involved in your care

5. Why We Use Your Information

5.1 To provide medical and forensic care

We use your information to:

• Assess your needs
• Provide emergency and follow‑up healthcare
• Conduct forensic medical examinations
• Document injuries
• Prevent, detect, or manage health concerns
• Provide sexual health care and safeguarding

5.2 To support a police investigation (if you choose to report)

If you consent, we may share:

• Forensic findings
• Notes and reports
• Witness statements or clinical statements (if relevant)

We only share what is necessary and proportionate.

5.3 To support safeguarding

We have legal duties to protect children and adults at risk.

We may share information with:

• Children’s Social Care
• Adult Social Care

5.4 To coordinate your aftercare

With your consent, we may share information with:

• Independent Sexual Violence Advisors (ISVAs)
• GPs
• Counselling services
• Domestic abuse / domestic violence agencies
• Mental health services
• Sexual health services
• Advocacy organisations
• Education providers

5.5 To manage the service

We may use anonymised or minimal data for:

• Audit
• Service improvement
• Performance monitoring

6. Legal Basis for Processing

We rely on the following legal bases under UK GDPR:

6.1 Article 6 – Lawful basis

• 6(1)(e): Public task (primary basis)
• 6(1)(c): Legal obligation
• 6(1)(d): Vital interests (safeguarding or risk of serious harm)

6.2 Article 9 – Special category data

• 9(2)(h): Medical diagnosis and healthcare
• 9(2)(g): Substantial public interest (safeguarding, prevention of crime)
• 9(2)(f): Establishment or defence of legal claims (police/CPS)
• 9(2)(j): Scientific or historical research (if applicable & appropriate approvals obtained)

6.3 Data Protection Act 2018 – Part 3 (law enforcement processing)

Used when sharing with the police for law enforcement purposes.

7. Consent and Confidentiality

7.1 Self‑referral

If you do not wish to involve the police:

• Your information is confidential
• Forensic samples are stored securely
• Nothing is shared without your consent
• Exceptions apply only if required by law or safeguarding duties

7.2 Police referral

If you attend with the police:

• Police provide initial referral information
• You may still decline a forensic exam
• You may decline the release of some information
• Certain information may be required by law for criminal proceedings

7.3 Children & young people

Safeguarding law requires us to act in the best interests of the child. This means we are usually required to share information with children’s social care about any contact we have with children and young people. We will always try to tell you when we need to discuss your case with the safeguarding team, unless it is not to safe to do so.

8. Who We Share Information With

We only share information when necessary and lawful.

8.1 With your consent

• Police forces
• ISVA services
• Sexual health services
• GPs
• Counselling agencies
• Mental health teams
• Social care
• Specialist support organisations
• Education providers
• Youth support services
• Community child health services

8.2 Without your consent (rare situations)

We may share information without consent only when:

• You or someone else is at risk of serious harm
• A child or vulnerable adult requires safeguarding
• We are required by a Court Order
• A serious crime must be prevented or investigated

We will explain this to you unless it puts someone at risk.

9. Forensic Samples

9.1 Police samples

If you are referred for an examination by the police, they will usually take the forensic samples after the examination has been completed. At this point, the forensic samples become the property of the police.

9.2 Self-referral samples

If you attend for an examination without police involvement (a ‘self-referral’), the samples are stored at The Bridge for a specified period and then destroyed, unless you provide consent for them to be released to the police during the retention period.

9.2.1 Legal basis for sample storage

Section 39(1) of the Human Tissue Act 2004 provides an exemption from licensing by the Human Tissue Act 2004 for ‘anything done for purposes related to:

• a) the prevention or detection of crime; or
• b) the conduct of a prosecution’.

Detecting crime is defined in section 39(4) as including ‘establishing by whom, for what purpose, by what means and generally in what circumstances any crime was committed, and the apprehension of the person by whom any crime was committed’.

This means SARCs are only able to store samples whilst the client decides whether or not they wish to make a report to the police.

9.2.2 Storage

• Stored in secure, monitored conditions
• Stored separately and labelled by unique SARC identifiers
• Access limited to trained personnel

9.2.3 Retention

Adults:

• Samples are kept for 26-months from the date of examination.

Children/young people:

• For clients under the age of 18 at the time of examination, samples are kept until the child or young person’s 25^th

Extension to retention period:

Adults and children/young people are able to make a request to the SARC for an extension to the retention period, so long as they are still deciding whether or not to make a report to the police (as per Section 39(1) of the Human Tissue Act 2004). Clients must contact the SARC to arrange this extension.

9.2.4 Disposal

Samples are destroyed securely when the retention period ends.

10. Images and Colposcopy Storage

• Stored on secure, encrypted, offline hard drives
• Not uploaded to the internet
• Not stored in cloud systems
• Only accessible by SARC staff with appropriate clearance
• May be shared with a medical expert involved in a criminal investigation / prosecution – this is usually with your consent but a request may be made by court order in exceptional circumstances

11. How Long We Keep Your Records

As per the NHS England Management Code of Practice (2023), SARC records are kept for:

• 30 years
• Or 10 years after death (if date of death is known)

Records may be held for longer in circumstances where it is deemed necessary – this includes where the records are linked to an ongoing investigation.

Self‑referral forensic samples:

• 26 months for adult clients (if aged 18 or over at time of examination)
• Until age 25 for children and young people (if under 18 at time of examination)

12. Your Rights

Under UK GDPR, you have the right to:

• Access your information
• Request correction
• Request restriction of processing
• Object to processing (with limitations)
• Request deletion (not always possible due to legal requirements)
• Complain to the Information Commissioner’s Office (ICO)

Limitations:

Because forensic and medical records may be required for legal or safeguarding reasons, we may not be able to delete or restrict certain information.

13. How We Protect Your Information

• Secure IT systems
• Offline encrypted storage for images
• Role-based access controls
• Staff training in safeguarding and information governance

14. Subject Access Requests and other data subject requests

For information regarding subject access requests, please see: https://www.uhbw.nhs.uk/p/how-we-use-your-data/subject-access-requests-and-other-data-subject-rights

15. Contact Us

The Bridge SARC

TheBridge@UHBW.nhs.uk

0117 342 6999

University Hospitals Bristol and Weston NHS Foundation Trust

Data Protection Officer – UHBW NHS Foundation Trust

Email: InformationGovernance@UHBW.nhs.uk

 

 

Information Commissioner’s Office (ICO)

You also have a right to complain to the Information Commissioner if you are in any way unhappy with the way we have processed your personal information or allowed you to exercise your rights. Please see: www.ico.org.uk/concerns