Privacy Policy

Wigan Borough Federated Healthcare CIC (WBFH)
Last Updated: 30.09.2026

1. Introduction

Wigan Borough Federated Healthcare CIC ("WBFH", "we", "our", or "us") is committed to protecting the privacy and security of your personal information.

This Privacy Notice explains how we collect, use, store, and protect personal information when you visit our website, contact us, use our services, or otherwise interact with us.

We process personal data in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and other applicable data protection legislation.

2. Who We Are

Wigan Borough Federated Healthcare CIC is responsible for determining how your personal information is used and protected.

Data Controller: Wigan Borough Federated Healthcare CIC

Address: Robin Park First Floor Offices, Robin Park Leisure Centre, Loire Drive, Wigan WN5 0UL
Email: wbfh.fed@nhs.net

Telephone: 01942 367438

3. Information We Collect

Depending on how you interact with us, we may collect and process the following categories of information:

Personal Information

Name
Job title
Organisation
Email address
Postal address
Telephone number

Website Information

When you visit our website, we may automatically collect:

IP address
Browser type and version
Device information
Operating system
Website usage information
Pages viewed and time spent on the website
Referring websites

Correspondence Information

When you contact us, we may retain records of:

Emails
Contact form submissions
Enquiries and feedback
Telephone conversations where appropriate

Special Category Data

As a healthcare organisation, we may process health-related information where necessary for the provision of healthcare services or where permitted by law.

Where special category data is processed, additional safeguards will be applied to protect your information.

4. How We Use Your Information

We may use your personal information to:

Respond to enquiries and requests
Manage our relationship with stakeholders and partners
Provide and improve our services
Monitor and maintain website performance and security
Comply with legal and regulatory obligations
Prevent fraud and misuse of our systems
Administer contracts and business operations
Communicate important updates and information

We will only process your information where we have a lawful basis for doing so.

5. Lawful Bases for Processing

Under the UK General Data Protection Regulation (UK GDPR), WBFH must have a lawful basis for processing personal information. Depending on the nature of our relationship with you and the services being provided, we may rely on one or more of the following lawful bases:

Consent

Where you have given us clear permission to process your personal information for a specific purpose.

Examples include:

Signing up to receive newsletters or updates from WBFH.
Completing a website form and agreeing to be contacted.
Providing consent to participate in surveys, events, or consultations.
Accepting non-essential website cookies.

You have the right to withdraw your consent at any time.

Contract

Where processing is necessary for the performance of a contract or to take steps before entering into a contract.

Examples include:

Managing contracts with suppliers and service providers.
Processing employment applications.
Delivering services agreed between WBFH and partner organisations.
Arranging training or consultancy services.

Legal Obligation

Where processing is necessary for compliance with a legal or regulatory requirement.

Examples include:

Maintaining financial and tax records.
Responding to requests from regulatory bodies.
Meeting NHS contractual and reporting requirements.
Processing information required by employment law.
Cooperating with law enforcement or safeguarding authorities where legally required.

Legitimate Interests

Where processing is necessary for our legitimate organisational interests and those interests do not override your rights and freedoms.

Examples include:

Managing and improving our website.
Maintaining network and information security.
Responding to enquiries from stakeholders and members of the public.
Conducting service evaluations and business planning.
Monitoring website usage through analytics tools.
Preventing fraud, cyber threats, and misuse of our systems.

When relying on legitimate interests, we consider and balance any potential impact on your rights and freedoms.

Provision of Health or Social Care

As a healthcare organisation, WBFH may process health information where necessary for the provision, management, and administration of health and care services.

Examples include:

Supporting the delivery of primary care services.
Coordinating care between healthcare providers.
Managing clinical services and patient pathways.
Ensuring continuity and quality of care.
Reviewing clinical outcomes and service effectiveness.

Public Task

Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Examples include:

Supporting NHS healthcare delivery.
Planning and commissioning healthcare services.
Managing healthcare resources effectively.
Contributing to population health management initiatives.
Supporting integrated care programmes across the local health system.

Public Health Purposes

In some circumstances, health information may be processed in the public interest in the area of public health.

Examples include:

Monitoring healthcare demand and service usage.
Supporting disease prevention and health improvement initiatives.
Reporting information required by public health authorities.
Assisting with healthcare planning and emergency preparedness.

6. Sharing Your Information

We may share information with:

NHS organisations
General practices and healthcare providers
Professional advisers and auditors
Regulatory authorities
IT service providers and website hosting providers
Government bodies where required by law

We will only share information where there is a lawful basis to do so and appropriate safeguards are in place.

We do not sell personal information to third parties.

7. International Transfers

We primarily process and store information within the United Kingdom.

Where personal information is transferred outside the UK, we will ensure appropriate safeguards are in place to protect the information in accordance with UK data protection laws.

8. Data Security

We take the security of your information seriously and have implemented appropriate technical and organisational measures to protect personal data against:

Unauthorised access
Unlawful processing
Loss
Destruction
Damage
Accidental disclosure

These measures include secure systems, access controls, encryption where appropriate, and staff training.

9. Data Retention

We will retain personal information only for as long as necessary to fulfil the purposes for which it was collected or as required by law.

Retention periods are determined by:

Legal requirements
NHS records management requirements
Regulatory guidance
Business and operational needs

Once information is no longer required, it will be securely deleted or anonymised.

10. Your Rights

Under data protection legislation, you have the right to:

Be informed about how your information is used
Access your personal information
Request correction of inaccurate information
Request erasure of information in certain circumstances
Restrict processing in certain circumstances
Object to processing
Request transfer of your information to another organisation where applicable
Withdraw consent where processing is based on consent

Not all rights apply in every circumstance, particularly where information is processed as part of healthcare services or legal obligations.

11. Making a Subject Access Request

You have the right to request a copy of the personal information we hold about you.

Requests should be submitted using the contact details provided below.

We may request proof of identity before releasing information.

12. Cookies and Website Technologies

Our website uses cookies and similar technologies to enhance user experience and analyse website performance.

For detailed information, please refer to our Cookie Policy.

13. Links to Other Websites

Our website may contain links to external websites. We are not responsible for the privacy practices or content of third-party websites and encourage you to read their privacy notices when visiting them.

14. Complaints

If you have concerns about how we process your personal information, please contact us first Wigan Borough Federated Healthcare CIC:

Email: FAO: Jayne Fitzpatrick, Complaints Manager: wbfh.fed@nhs.net

Address: Robin Park First Floor Offices, Robin Park Leisure Centre, Loire Drive, Wigan WN5 0UL, Telephone: 01942 367438 so we can investigate and resolve the matter.

You also have the right to complain to the Information Commissioner's Office (ICO):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://www.ico.org.uk

Telephone: 0303 123 1113

15. Contact Us

If you have any questions regarding this Privacy Notice or how your personal information is handled, please contact:

Wigan Borough Federated Healthcare CIC
Email: FAO: Jayne Fitzpatrick, Complaints Manager: wbfh.fed@nhs.net
Address: Robin Park First Floor Offices, Robin Park Leisure Centre, Loire Drive, Wigan WN5 0UL
Telephone: 01942 367438

16. Changes to This Privacy Notice

We may update this Privacy Notice periodically to reflect changes in legislation, regulatory guidance, or our practices.

The most current version will always be available on our website, and the date of the latest revision will be shown at the top of this notice.

Privacy Policy

1. Introduction

​

2. Who We Are

​

​Wigan Borough Federated Healthcare CIC is responsible for determining how your personal information is used and protected.

3. Information We Collect

​

​Depending on how you interact with us, we may collect and process the following categories of information:

Personal Information

​

​Name

Website Information

​

Correspondence Information

Special Category Data

​

4. How We Use Your Information

​

5. Lawful Bases for Processing

​

​Under the UK General Data Protection Regulation (UK GDPR), WBFH must have a lawful basis for processing personal information. Depending on the nature of our relationship with you and the services being provided, we may rely on one or more of the following lawful bases:

Consent

​

Contract

​

​Where processing is necessary for the performance of a contract or to take steps before entering into a contract.

Legal Obligation

​

​Where processing is necessary for compliance with a legal or regulatory requirement.

Examples include:

Legitimate Interests

​

​Where processing is necessary for our legitimate organisational interests and those interests do not override your rights and freedoms.

Examples include:

Provision of Health or Social Care

​

​As a healthcare organisation, WBFH may process health information where necessary for the provision, management, and administration of health and care services.

Examples include:

Public Task

​

​Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

Examples include:

Public Health Purposes

​

​In some circumstances, health information may be processed in the public interest in the area of public health.

6. Sharing Your Information

​

​We may share information with:

7. International Transfers

​

​We primarily process and store information within the United Kingdom.

​

8. Data Security

​

​​We take the security of your information seriously and have implemented appropriate technical and organisational measures to protect personal data against:

​

9. Data Retention

​

​We will retain personal information only for as long as necessary to fulfil the purposes for which it was collected or as required by law.

Retention periods are determined by:

10. Your Rights

​

​Under data protection legislation, you have the right to:

11. Making a Subject Access Request

​

​You have the right to request a copy of the personal information we hold about you.

12. Cookies and Website Technologies

​Our website uses cookies and similar technologies to enhance user experience and analyse website performance.

13. Links to Other Websites

​

​Our website may contain links to external websites. We are not responsible for the privacy practices or content of third-party websites and encourage you to read their privacy notices when visiting them.

14. Complaints

​

​

15. Contact Us

​

​If you have any questions regarding this Privacy Notice or how your personal information is handled, please contact:

16. Changes to This Privacy Notice

​

Wigan Borough Federated Healthcare CIC is responsible for determining how your personal information is used and protected.

Depending on how you interact with us, we may collect and process the following categories of information:

Name

Under the UK General Data Protection Regulation (UK GDPR), WBFH must have a lawful basis for processing personal information. Depending on the nature of our relationship with you and the services being provided, we may rely on one or more of the following lawful bases:

Where processing is necessary for the performance of a contract or to take steps before entering into a contract.

Where processing is necessary for compliance with a legal or regulatory requirement.

Where processing is necessary for our legitimate organisational interests and those interests do not override your rights and freedoms.

As a healthcare organisation, WBFH may process health information where necessary for the provision, management, and administration of health and care services.

Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.

In some circumstances, health information may be processed in the public interest in the area of public health.

We may share information with:

We primarily process and store information within the United Kingdom.

We take the security of your information seriously and have implemented appropriate technical and organisational measures to protect personal data against:

We will retain personal information only for as long as necessary to fulfil the purposes for which it was collected or as required by law.

Under data protection legislation, you have the right to:

You have the right to request a copy of the personal information we hold about you.

Our website uses cookies and similar technologies to enhance user experience and analyse website performance.

Our website may contain links to external websites. We are not responsible for the privacy practices or content of third-party websites and encourage you to read their privacy notices when visiting them.

If you have any questions regarding this Privacy Notice or how your personal information is handled, please contact:

We may update this Privacy Notice periodically to reflect changes in legislation, regulatory guidance, or our practices.