Devon County Council (DCC) is collecting and or processing your personal data as a Data Controller under Data Protection Legislation and our ICO registration number is Z6475582.

This privacy notice concerns the processing of personal data that takes place by the Public Health Nursing Team which is responsible for the delivery of the following services:

Universal Health Visiting and School Nursing Services as described in the Healthy Child Programme 0–19.
Support for children in need, child protection, children in care as well of those receiving early help.
Targeted (additional needs led support) for children and families in schools, community clinics and homes
Partnership working with other services who support children and families
Safeguarding assessments, Section 17 and Section 47 contributions, multi‑agency meetings
National Child Measurement Programme (NCMP)
Immunisation support and health promotion campaigns

This notice explains what information we collect, why we collect it and how we keep it secure. It also explains your rights and our legal obligation. Should you wish to find out more about Devon County Council’s data protection policies please contact our Data Protection Officer.

We will notify you of any changes to this privacy notice

This privacy notice was last updated on 15 July 2026. If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current data protection legislation. Any queries relating to this privacy notice please contact the Data Protection Officer.

What information are we processing?

We will keep records about your family’s health and the care we provide. This helps us to make sure you get the best support from us. These records may be written down or held on a computer. If it is written down it will then be uploaded to the clinical system used by the Public Health Nursing Service.

If you are receiving support from us as a child or young person and this support is about you, information may be shared with your parents. If we have contact with you without your parents being present, we will discuss what information will be recorded and shared with your parents or other services.

We may collect, store or otherwise process information about you which may include:

the names, date of birth, NHS number, GP details and address of you or your child or children, and the names and contact details of their parents or primary carers
the names, date of birth, NHS number, GP details of parents
a record of the dates of all contacts with us and details of the content of those contacts
a record of correspondence with you or your parents (if under 19) and with other professionals about you and your child or children
personal data about you and/or your child or children in relation to accessibility requirements such as the need for an interpreter or literacy needs and information about religion and ethnicity
other personal data that will sometimes be recorded such as sexual orientation; this will be discussed with you at the time of recording
information provided by other services and professionals including information about safeguarding procedures
information extracted from Child Health Information Service – this may include vaccination records, hospital attendances, records of police reports (only where the police have had concerns for the welfare of a child), school details, address history, assessments by other health professionals

Purpose of collecting or processing your personal data

DCC may need to collect or otherwise process your personal data so that we can:

provide you with information and appointments to support the health and wellbeing of you and your child or children, this may include inviting you to routine reviews or sending you information relevant to the age of your child or children
provide you with support that is relevant and helpful, taking into account your or your child or children’s health and wellbeing history
deliver services to you without you having to repeat your story when you meet with a different member of the service
refer you to another service for support where this is required
investigate your concerns if you need to complain
work with other services who are supporting your family

We may also use your personal data to:

prepare statistical reports on our service performance to regulatory bodies – these reports will not include any identifying information
evidence compliance to regulatory bodies
prepare anonymised data to support health research and development
review the quality of our care to ensure it is of the highest standard and quality
develop and improve services
investigate complaints, legal claims and other incidents and may also help us to report any incidents when we are required to do so by law
understand the diverse needs of children and families

We will always anonymise your information before sharing it with other agencies for the purposes of research or service improvement, unless we have agreed with you that we can share identifiable information, for example, to enable you to be contacted by a research team, or if there is a legal requirement to share your information.

The legal basis for us collecting your personal data

The following legislation applies to any processing of personal data, including the sharing of personal data, that is needed to deliver the services outlined within this notice.

Health and Social Care Act 2012: Mandates local authorities in England to take steps to improve the health of their population, including commissioning 0–19 public health services (health visiting and school nursing).

Care Act 2014: Creates a legal duty to safeguard and promote the welfare of adults in Devon. It also creates obligations for DCC to work with NHS bodies to prevent the need for care and support.

Children Act 1989 & 2004: Sets out legal duties for local authorities and partners to safeguard and promote the welfare of children.

Children and Social Work Act 2017: Further strengthens safeguarding requirements for children.

DCC contends that if we are processing your personal data for the purposes of delivering any of the services outlined within this notice, this processing is lawful under the UK General Data Protection Regulation (UK GDPR) on the grounds that the following lawful conditions apply.

Article 6(1)(e) – performance of a task carried out in the public interest, or in the exercise of official authority vested in the controller.
Article 9(2)(h) – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.
Article 6(1)(c) – legal obligation (because safeguarding and statutory returns rely on legal duties).
Article 9(2)(b) – social protection and safeguarding functions (often included when referencing Children Act duties).

Personal data that is collected for any of the purposes outlined in this notice is never used for direct marketing purposes and is not sold on to any other third parties.

Recipients or categories of recipients that we may share your personal data with

When processing your personal data, it may be necessary for us to share personal data with third-party organisations such as;

other services and organisations who are working with you and your family such as Best Start Family Hubs, education settings, early years providers, health providers and social care.
other services who we are referring you to for support.

Please email your local Public Health Nursing hub. Some information held on our Clinical Records System may be accessed by your GP if they also use the same system through an Integrated Care Records process. This is a secure process which enables other health professionals working with you to access your health information. Your health information will only be shared to support any direct care that you or your family may need.

You have the right to request that information is not shared in this way. To request a right to restrict the sharing of your personal data, please contact your public health nursing hub who will be able to address your request.

If we feel that it is necessary to share your personal data with professionals to ensure you or someone you work with is safeguarded from harm, we rely upon the provisions of the Safeguarding Vulnerable Groups Act 2006 and Children Act 1989 & 2004. Where it is necessary to share medical or social care information for these purposes, we rely upon article 9(2)(h) of the UK General Data Protection Regulation (information necessary for medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems).

We may also need to share some personal data about you, so that we can support third party organisations to discharge their regulatory requirements. This includes organisations such as:

the data protection regulator (the Information Commissioner’s Office)
the Care Quality Commission

We may also share information to enable us to comply with court orders and other legal obligations. If this is necessary, we will only share the minimum amount of personal data needed for this purpose.

How long will we hold your personal data?

In accordance with the NHS England Records Management Code of Practice (2023) public health nursing clinical records will be held until the child’s 25th birthday (or 26th birthday if we were still working with the young person at the age of 17 years old). This includes any antenatal and postnatal records pertaining to that child.

For record keeping purposes, these are considered to be as much the child’s record as the parent, so the longer retention period remains in place.

Your data protection rights

Under Data Protection Legislation, you have the right to obtain a copy of your personal records held by us, this is called a Subject Access Request (SAR).

Details of how to make a request can be found here.

Further details on your rights under data protection legislation and how to exercise them.

Complaints

If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer.

Alternatively, if you are not happy with the way that DCC is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees compliance with the Data Protection Act 2018 and the UK GDPR.

Further details of how to contact the ICO are available from their website. Please see relevant details below: