FOI2026/2101

I am writing to make Freedom of Information request. Please provide the information requested below regarding primary care IT systems, telephony solutions, and specific funding structures within your Integrated Care Board (ICB) footprint. 

1. Please provide the start dates, end dates, and total contract values for your ICB’s current Clinical Systems, Online Consultation Systems, and Cloud Telephony solutions, including the supplier and product names for each.
2. Additionally, please confirm if the ICB directly funds virtual care navigation for primary care; if so, please state the service provider name, the funding allocation amount, and the active contract dates.
3. Please also provide the names of the individuals in the Key Digital Leadership Roles and the structure as it currently stands.

1. Accurx £5,527,789.44 36-month term, 01/04/2026 – 31/03/2029. PATCHS £142,495.20 12-month term, 05/04/2026 – 05/04/2027. NHS Greater Manchester ICB has not procured/fund Cloud telephony solutions.

2. NHS Greater Manchester ICB has not procured/fund virtual care navigation solutions.

3. I can confirm that NHS GM holds this information, however we consider this to be exempt under section 40(2) of the Freedom of Information Act 2000 as the disclosure of this information may lead to the identification of those individuals. A formal refusal notice is appended to this response.

Refusal Notice – Section 40(2) Freedom of Information Act 2000

Section 40(2) of the Freedom of Information Act 2000 states:

“Any information to which a request for information relates is also exempt information if –

1. it constitutes personal data which does not fall within subsection (1), and

(b) the first, second or third condition below is satisfied.

(3A) The first condition is that the disclosure of the information to a member of the public otherwise than under this Act –

1. would contravene any of the data protection principles [as set out in (i) Article 5(1) of the GDPR and (ii) section 34(1) of the Data Protection Act 2018]…”

Article 4 of the GDPR states:

1. “‘personal data’ means any information relating to an identified or identifiable natural person (‘data subject’); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person;

1. “‘processing’ means any operation or set of operations which is performed on personal data or on sets of personal data, whether or not by automated means, such as collection, recording, organisation, structuring, storage, adaptation or alteration, retrieval, consultation, use, disclosure by transmission, dissemination or otherwise making available, alignment or combination, restriction, erasure or destruction…”

The information that you have requested constitutes personal data as it relates to identifiable natural persons. Furthermore, those persons could be identified from the information that you have requested, and other information in the possession of the data controller.

Article 6 of the GDPR states:

1. Processing shall be lawful only if and to the extent that at least one of the following applies:

1. the data subject has given consent to the processing of his or her personal data for one of more specific purposes;

1. processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract;
2. processing is necessary for compliance with a legal obligation to which the controller is subject;

1. processing is necessary in order to protect the vital interests of the data subject or of another natural person;

1. processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;

1. processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child.

We believe that the disclosure the information requested could lead to the identification of the individuals concerned and as a result, we are refusing this under section 40(2) of the Freedom of Information Act 2000.  

This exemption is not subject to the public interest test.