How we keep your information safe
You can rest assured we will only allow your Shared Care Record (ShCR), also known as Collaborative Care Record (CCR), to be seen by health and social care professionals directly involved in your care.
There are strict rules around how we use your information. All partner organisations must keep your information confidential and follow the law, including the Data Protection Act 2018 and UK General Data Protection Regulation (GDPR).
Partner organisations must keep your information safe and confidential by making sure that:
- only authorised staff can view your information
- staff can only view information when they need it for your care
- staff are trained to handle personal information safely
- systems are protected by security controls, such as passwords and access checks
- access is monitored and recorded
- any inappropriate access can be investigated
- partner organisations follow NHS information governance and security requirements
The CCR does not allow staff to change your records. It only allows authorised staff to view information that is needed to support your care.
Each organisation is:
- registered with the Information Commissioner’s Office (ICO)
- responsible for the information it shares and views through the CCR.
Together, the organisations act as joint data controllers for information used through the CCR.
How long we keep your information
Each partner organisation keeps its own records in line with the Records Management Code of Practice for Health and Social Care.
The CCR does not keep your full health or social care record.
It only makes information available for professionals to view when needed for your care.
If you choose to object to your information being shared through the CCR, a small amount of information will still be kept, such as your name, date of birth and NHS number. This is only so your objection can be recorded and followed.
If you have objected, professionals using the CCR will not be able to see your shared record. They will only be able to see the information held on their own organisation’s system.
Page last updated: 26 May 2026
