CAIRN Project Privacy Notice
Privacy Notice – CAIRN Project (Collaborative Assessment of Innovation for Remote Monitoring in the North)
Who we are
NHS Shetland provides health and care services to people living in Shetland.
For the purposes of data protection law, NHS Shetland is the data controller for personal information processed as part of the CAIRN project.
NHS Shetland works in partnership with other NHS Boards as part of the CAIRN programme. Each NHS Board is responsible for the personal information of patients under its care. Where necessary for the delivery of care, relevant information may be shared between NHS Boards involved in the programme in line with national information sharing agreements and data protection law.
About the CAIRN project
The CAIRN project supports Hospital at Home services, allowing patients to receive hospital-level care in their own home using digital technology and remote monitoring.
The project uses the Feebris platform and connected medical devices to:
- Monitor patients’ health remotely
- Support clinical decision-making
- Help reduce hospital admissions and enable earlier discharge
This service is typically used to support patients with ongoing or complex health conditions who require closer monitoring outside of a hospital setting.
What information we collect
We collect and use personal information to deliver your care safely and effectively.
Patient information
This may include:
- Personal details such as your name, date of birth, address and contact details
- Your CHI number, GP details and next of kin information
- Health information such as:
- Vital signs (e.g. heart rate, blood pressure, oxygen levels, temperature)
- Symptoms and clinical observations
- Clinical risk scores and alerts
- Notes, care plans and decisions
- Images where clinically necessary
This information may be collected:
- Directly from you
- From NHS systems (for example CHI and other national NHS systems)
- From monitoring devices provided as part of your care
- From information entered by healthcare professionals involved in your care
Staff information
We also process limited information about NHS staff using the system, such as:
- Name, role and contact details
- System access and activity logs
How we use your information
We use your information to:
- Provide and manage your care at home
- Monitor your condition and identify changes in your health
- Support healthcare professionals in making clinical decisions
- Deliver and evaluate Hospital at Home services
Legal basis for processing
We process your information under the following legal bases:
- Article 6(1)(e) – necessary for a task carried out in the public interest
- Article 9(2)(h) – provision of health or social care
This means we do not rely on consent as the legal basis for processing, although your care team will discuss the service with you before you take part.
How your information is used and stored
Your information is:
- Entered by clinicians or obtained from NHS systems when you join the service
- Collected from medical devices during your monitoring
- Transmitted securely to the Feebris system
- Accessed by authorised healthcare professionals through a secure system
No personal data is stored on monitoring devices after it has been uploaded.
Who has access to your information
Access to your information is strictly controlled and limited to:
- NHS staff involved in your care
- Authorised support staff where necessary
- Feebris Ltd, acting as a data processor on behalf of NHS Shetland
Access is controlled using:
- Role-based permissions
- Secure log-in systems with multi-factor authentication
Sharing your information
Your information will primarily be used within the NHS.
Where necessary for your care, relevant information may be shared with NHS organisations involved in delivering the CAIRN service, including other NHS Boards participating in the programme.
The Feebris system operates as a separate clinical system for this project. Limited information (such as CHI data) may be shared with national NHS systems to support patient identification and safe care.
We do not share your information for marketing or commercial purposes.
Use of external service providers
We use Feebris Ltd to provide the digital platform. Feebris acts as a data processor on behalf of NHS Shetland and uses approved sub‑processors to support delivery of the service.
These sub‑processors provide services such as secure data hosting, user authentication and technical support. They may be based in the UK, the European Economic Area (EEA) or (in limited cases) the United States.
Where sub‑processors are based outside the UK, their role is limited to providing technical and support services. No patient health information is shared with these organisations and any data processed is restricted to the minimum necessary for system support (for example, technical or system log information).
All sub‑processors are subject to strict contractual controls and data protection requirements and may only process your information on our instructions.
International transfers
Some system support services involve organisations based outside the UK.
Where this happens, appropriate safeguards are in place to protect your information. This includes the use of recognised transfer mechanisms such as the UK extension to the EU‑US Data Privacy Framework.
We ensure that any such transfers are limited, proportionate and subject to strict contractual and security controls.
How we keep your information secure
We use a range of technical and organisational measures to protect your information, including:
- Secure UK-based cloud hosting
- Encryption of data in transit and at rest
- Access controls and authentication measures
- System monitoring and audit logs
How long we keep your information
We keep your information in line with the:
- Scottish Government Records Management Code of Practice for Health and Social Care (Scotland)
When the project ends:
- Your data will either be returned to NHS Shetland or securely deleted
- Feebris will securely delete any remaining copies in line with contractual requirements
Your rights
You have rights in relation to your personal information, including:
- The right to access your information
- The right to have inaccurate information corrected
- The right to object to processing in certain circumstances
- The right to request restriction or deletion where applicable
Some of these rights may be limited where the information is required for healthcare purposes.
If you no longer wish to take part in the service, please speak to your clinical team.
Please refer to the main NHS Shetland Privacy Notice for details of how to exercise these rights: https://www.nhsshetland.scot/rights/privacy-notices
Automated decision-making
No decisions about your care are made solely by automated systems. All clinical decisions are made by healthcare professionals.
Contact details
If you have any questions about how your information is used, please contact:
Sam Collier-Sewell
Head of Information Governance and Data Protection Officer
NHS Shetland
Email: shet.dpo@nhs.scot
Address:
NHS Shetland
Upper Floor Montfield
Burgh Road
Lerwick
Shetland
ZE1 0LA
You also have the right to make a complaint to the Information Commissioner’s Office (ICO):
Visit the ICO website
Further information
For more information about how NHS Shetland uses personal information, please see our main Privacy Notice:
Privacy Notices – NHS Shetland