Patient Advice and Support Service: Privacy policy

When you contact us, we collect personal information about you so we can help you with your feedback, comment, concern or complaint about the NHS.

We'll get your permission by asking you:

  • To sign a paper consent form;
  • To tick a box online; or
  • Directly by post, electronically (email or webchat) or over the phone.

If you call us, we may record the conversation for training and monitoring purposes.  If you leave a voicemail on our helpline (0800 917 2127), the information will be stored on our internal system and will be accessed by management and administration staff at Citizens Advice Scotland and specialist Patient Advisers in Citizens Advice Bureaux.

If you email us, your email will be accessed by management and administration staff at Citizens Advice Scotland and if appropriate, forwarded to specialist Patient Advisers in Citizens Advice Bureaux for advice.

We record this information on the legal basis of ‘public task’ under the Patient Rights (Scotland) Act 2011, sections 17 to 19. We may also ask you for information such as your ethnicity, health, political and philosophical beliefs, religion, trade union membership, genetics, mental and physical health, sexual life or gender. This is called ‘special category data’. We will ask for your explicit consent to record this.

What information we ask for

We only record and use information that will help us support you with your NHS issues. This may include your:

  • Name, address and date of birth
  • Contact details

We will ask for your consent where we need to record and use information that will help us

support you with your NHS issues. This may include your:

  • Medical history
  • Health records
  • State of health

How we use your information

The main reason we need your information is to help solve your problem.

We'll also access your information in order to review your situation if required - we'll contact you when we do this to check if your circumstances or details have changed.

We may access copies of your Health Records, in line with the guidance on the NHS Inform website (  This would be done with your agreement.  If you give us these, we will keep these in a locked cabinet until you ask for them to be returned to you or destroyed.  If these are attached to a client record they will be kept for a minimum of 7 years.

We'll only access your information for other reasons if we really need to - for example:

  • for training and quality purposes
  • to investigate complaints
  • to help us improve our services

We might use your contact details to get in touch about your experience of our service or ask you to take part in surveys or research - we'll only do this if you give us permission.

We use some information to create statistics about who we're helping and what issues they face. This information is always anonymised - you can't be identified. We share these with funders, regulators, government departments and publicly on our blogs, reports, social media and press releases. The statistics also inform our policy research, campaigns, or media work.

When we share your information 

Sometimes we share your personal information with other organisations - we only do this to help you deal with the NHS, or to monitor the quality of our services. We'll get your permission before doing this.

Organisations we share your data with must store and use it in line with data protection law - they can't pass it on or sell it without your permission.

Who we share your information with

If you decide to raise your complaint with the NHS or take it to the Scottish Public Services Ombudsman (SPSO), we will share your information with them.  We will always discuss this with you.  [The SPSO’s privacy notice is available on their website at and their document Your Information Rights and the SPSO is available on their website at info rights.pdf ]

We may sometimes suggest that you go to other organisations as they may be able to help you with all or part of your issue. We will only make a referral and share your information with your consent. Organisations we share your information with must store and use it in line with data protection law.

We might choose to use your information for research purposes on the basis of 'legitimate interest'. This means it will help us carry out our aims and goals as an organisation - for example, to create case studies and statistics for our national research. If we use it in this way, your personal details will be anonymised or pseudonymised.  We will always ask for your permission to create a case study.

If we're concerned about yours or someone else's safety

If something you've told us makes us think you or someone you know might be at serious risk of harm, we could tell the police or social services - for example if we think you might hurt yourself or someone else. Our lawful basis for this is called “vital interest”.

Storing your information

Whether you get advice face to face, over the phone, by email or webchat, our adviser will log all your information, correspondence, and notes about your problem on our case recording system.  Some of your information might also be kept within our secure email and IT systems.

We keep your information for 7 years. If your case has been subject to a serious complaint, insurance claim or other dispute we keep the data for 16 years.

Contact us

Call us on 0800 917 2127