Dear Manchester Mental Health and Social Care Trust,

I would like to make a request under the FOI Act.

For the purposes of the Act, please take the date of your receipt of this request as 10th March 2016.

I am interested in the relationship between your organisation and the Manchester Care Record clinical data repository (Graphnet 3rd party database), which I will refer to as "MCR" in this FOI request, and as mentioned in this article:
http://www.graphnethealth.com/news/2015/...

• Please could you tell me whether your organisation is currently extracting and uploading personal confidential data about patients/clients to the MCR database?

• If not commenced already, do you have plans to commence feeds into the MCR database at anytime between now and 31st March 2017?

If the answer to both of the above is no, then thank you very much, ignore the remainder of this request, and please consider my request closed.

However, if your organisation is already uploading, or is planning to before March 31st 2017, then please can you provide me with the following:

• Any and all fair processing information (posters/leaflets/handouts) made available, or planning to be made available, to patients/clients informing them of this use of their data

• Any and all policies on the implementation of MCR feeds by your organisation

• The types/nature of information that you are, or will be, extracting and uploading to the MCR database

I am aware of the opt-out arrangements available at contributing GP surgeries. However, I am interested in how patients can (or if they cannot) prohibit your organisation from extracting and uploading information to the MCR database in the first place (processing of their data which would have no purpose or justification if they have already opted-out at their GP surgery).

• Please could you tell me process available to patients to express dissent to *you*, for this type of processing of their data, and so block extraction uploading of all their personal confidential data to the MCR database by your organisation (in line with the DPA and NHS Constitution)

• Please could you tell me whether the data controller for the MCR database informs you when patients have opted out of having a shared record (e.g. having opted out at their GP surgery), which would in theory allow you to switch of the feed to the MCR database for that patient's information

I would be grateful if you would be kind enough to send me the requested information promptly and in any event not later than the twentieth working day following the date of receipt of my request.

I would be grateful if you would kindly acknowledge receipt of this request as recommended by the ICO (“It would be good practice to acknowledge receipt of requests and to refer to the 20 working day time limit, so that applicants know their request is being dealt with”).

Thank you once again.

Kind regards,

Dr Neil Bhatia