[Skip to content]


Reporting and Learning System (RLS) | privacy policy

Your Privacy

The NPSA is committed to protecting the personal information provided when you report an incident and take our responsibilities regarding the privacy of your information very seriously. This policy explains how we use your information, how we protect it, and your associated rights and responsibilities.


Use and protection of your Information 

The NPSA does not collect personal information intentionally.


The NPSA does not seek to collect identifiable information relating to staff and patients involved in an incident such as names, addresses, etc.  The personal information we do collect is only for the purposes of contacting the reporter in case we need further clarification about the patient safety incident.


Any personal information you provide is protected by logical security measures, as well as strict confidentiality procedures and contract clauses for NPSA staff and contractors to ensure your privacy. We use industry-standard SSL (Secure Socket Layer) encryption technology to protect the security of the information you provide us with over the network.


Sharing of Information 

Names of reporters are NOT shared outside NPSA, and are kept very confidentially as outlined above. However, specialist expertise is sometimes needed to understand patient safety issues. For this reason, we may allow third party organisations such as the Medicines and Healthcare Regulatory Authority or a Royal College access to incident data under strict conditions. As far as possible, data has been cleansed of any personal identifiable information. Third parties sign our Data Sharing protocol beforehand, which ensures your privacy.


In a criminal investigation we may be required to share information to be compliant with the law or to cooperate with legal authorities.


How long will we keep your Information? 

We will not retain your personal contact information any longer than necessary to follow up and clarify the incident with the reporter for investigation of the incident, with a maximum of 3 years.


Freedom of Information Act rules 

Under the Freedom of Information Act (FOIA) 2000, you can make explicit requests for non-personal information that the NPSA may hold. Any such written requests for information will be handled in accordance with our Freedom of Information policy.