Privacy notice
Last reviewed: July 2026
1. Who we are
Stevyn is an internal stroke-therapy activity capture tool used within United Lincolnshire Hospitals NHS Trust (the Data Controller). The system is operated by the stroke therapy team for clinical-audit and service-improvement purposes.
2. What data we process
- Identifiable patient data (Admin role only): first name, surname, hospital number, NHS number.
- Pseudonymised clinical data (all clinical roles): first initial, anonymised patient label, ward, dates, therapy minutes, assessment scores, discharge destination.
- Staff data: work email, display name, role, sign-in audit timestamps.
3. Lawful basis
UK GDPR Article 6(1)(e) — public task — and Article 9(2)(h) — provision of health care — under the Health and Social Care Act 2012. Processing supports SSNAP audit submission and stroke unit governance.
4. Who can see what
Access is role-based and enforced server-side by row-level security:
- Therapy assistants — enter sessions only.
- Qualified therapists / team leads — full clinical record, no patient identifiers.
- Admin — full record including identifiers, audit log, user management.
5. Retention
See the retention schedule. Identifiable fields are removed at discharge + 8 years in line with the NHS Records Management Code of Practice.
6. Your rights
Patients and staff have the right of access, rectification, erasure (where applicable), restriction, and to complain to the ICO. Contact the Trust Data Protection Officer to exercise these rights.
7. Security
- TLS 1.2+ in transit, AES-256 at rest.
- Row-level security policies on every table.
- 15-minute idle session lock on shared NHS laptops.
- Leaked-password (HIBP) check at sign-in / password change.
- Full audit log of identifier reads and clinical writes.
8. Hosting
Data is held in the EU/UK region of the platform provider. No transfers outside the UK / adequacy-decision territory.
9. Contact
Data Protection Officer, United Lincolnshire Hospitals NHS Trust — dpo@ulh.nhs.uk (replace with confirmed address).