Privacy Policy

This website collects some personal data from users, as stated in our website provider’s Privacy Policy.

Our Practice aims to ensure the highest standard of medical care for our patients and we are committed to protecting and respecting your privacy. To do this we keep records about you, your health and the care we have provided, or plan to provide, to you. This Privacy Policy does not provide exhaustive details of all aspect of the collection and use of personal information by the practice. However, we are happy to provide any additional information or explanation needed.

  • This is a notice to inform you of our Policy about all information that we record about you. It sets out the conditions under which we may process any information that we collect from you, or that you provide to us. It covers information that could identify you (personal information) and information that could not. In the context of the law and this notice, ‘process’ means collect, store, transfer, use or otherwise act on information
  • We regret that if there are one or more points below with which you are not happy, your only recourse is to leave our website immediately
  • We take seriously the protection of your privacy and confidentiality. We understand that all visitors to our website are entitled to know that their personal data will not be used for any purpose unintended by them, and will not accidentally fall into the hands of a third party.
  • We undertake to preserve the confidentiality of all information you provide to us, and hope that you reciprocate
  • Our Policy complies with UK law accordingly implemented, including that required by the UK General Data Protection Regulation (GDPR)
  • The Law requires us to tell you about your rights and our obligations to you with regards to the processing and control of your personal data. We do this now, by requesting that you read the information provided at Know Your Privacy Rights
  • Except as set out below, we do not share, sell or disclose to a third party, any information collected through our website.
  • The UK General Data Protection Regulation (UKGDPR) and the Data Protection Act 2018 (DPA 2018) became law on 25th May 2018, and 1st January 2021 when the UK exited the EU. For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (UK) 2016/679) (the “UKGDPR”), and the Data Protection Act 2018 the practice is responsible for your personal data.
Caldicott Guardian

The Caldicott Guardian/IG Lead is responsible for;

  • Ensuring implementation of the Caldicott Principles and Data Security Standards with respect to Patient Confidential Data
  • Ensuring that the Practice processes satisfy the highest practical standards for handling patient information and provide advice and support to Practice staff as required
  • Ensuring that patient identifiable information is shared appropriately and in a secure manner. The Caldicott Guardian will liaise where there are reported incidents of person identifiable data loss or identified threats and vulnerabilities in Practice information systems to mitigate the risk.

The aim of the Caldicott Guardian is to ensure the organisation implements the Caldicott principles and data security standards; there is no need to appoint a Caldicott Guardian, but there is a need to have an Information Governance lead (sometimes referred to as a Caldicott lead) who, if they are not a clinician, will need support from a clinically qualified individual.

Care Quality Commission (CQC)
The Care Quality Commission (CQC) is an organisation established in English law by the Health and Social Care Act. The CQC is the regulator for English health and social care services to ensure that safe care is provided. They inspect and produce reports on all English general practices in a rolling 5 year program.   The law allows the Practice to share identifiable patient information with CQC as well as requiring this Practice to share certain types of data with them in certain circumstances, for instance following a significant safety incident.   For more information about the CQC see: http://www.cqc.org.uk/  
Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]  
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingTo meet the legal obligation to provide the Department of Health with information and reports on the status, activity and performance of NHS GP practices. This may include identifiable patient data.
4) Lawful basis for processingThe legal basis will be Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” And Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;”
5) Recipient or categories of recipients of the shared dataThe data will be shared with the Care Quality Commission, its officers and staff and members of the inspection teams that visit us from time to time.
6) Rights to objectYou have the right to object to some or all the information being shared with NHS Digital. Contact the Controller or the practice.
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention periodThe data will be retained for active use during the processing and thereafter according to NHS Policies and the law.
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)/

Information about the Care Quality Care Commission (CQC)

CCTV

Please note this policy is only applicable if CCTV has been installed.

Closed circuit TV is installed at our premises. This is for the purposes of staff, patient and premises security. Cameras are located at various places on the premises and images from the cameras are recorded. The use of CCTV falls within the scope of the Data Protection Act. Images from cameras and recordings are held on a computer system and held in secure storage with controlled access for the required statutory period.

Clinical Audit & Research

This practice participates in research. We will only agree to participate in any project if there is an agreed clearly defined reason for the research that is likely to benefit healthcare and patients. Such proposals will normally have a consent process, ethics committee approval, and will be in line with the principles of Article 89(1) of UK GDPR.   Research organisations do not usually approach patients directly but will ask us to contact suitable patients to seek their consent. Occasionally research can be authorised under law without the need to obtain consent. This is known as the section 251 arrangement1. We may also use your medical records to carry out research within the practice. We share information with the following medical research organisations with your explicit consent or when the law allows: CPRD approved research. You have the right to object to your identifiable information being used or shared for medical research purposes. Please speak to the practice if you wish to object.  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]  
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the sharingMedical research.  
4) Lawful basis for processing or sharingIdentifiable data will be shared with researchers either with explicit consent or, where the law allows, without consent. The lawful justifications are.   Article 6(1)(a)the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.   or   Article 6(1)(e) may apply “necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.”   And in addition, there are three possible Article 9 justifications.   Article 9(2)(a) – ‘the data subject has given explicit consent…’   or   Article 9(2)(j) – ‘processing is necessary for… scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member States law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and interests of the data subject’.   or   Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services…’  
5) Recipient or categories of recipients of the shared dataThe data will be shared with Clinical Practice Research Datalink organizations.
6) Rights to objectYou do not have to consent to your data being used for research. You can change your mind and withdraw your consent at any time. Contact the Controller or the practice. You can also register a National Data Opt-out, which removes your data from certain research and planning. You can find out more here: https://www.nhs.uk/using-the-nhs/about-the-nhs/opt-out-of-sharing-your-health-records/
7) Right to access and correctYou have the right to access any identifiable data that is being shared and have any inaccuracies corrected.
8) Retention periodThe data will be retained for the period as specified in the specific research protocol(s).

9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
Complaints, Subject Access Requests and Freedom of Information

When we receive a complaint, we record all the information you have given to us.

We use that information to resolve your complaint.

If your complaint reasonably requires us to contact some other person, we may decide to give to that other person some of the information contained in your complaint. We do this as infrequently as possible, but it is a matter for our sole discretion as to whether we do give information, and if we do, what that information is.

We may also compile statistics showing information obtained from this source to assess the level of service we provide, but not in a way that could identify you or any other person.

How you can complain

If you are happy for your data to be extracted and used for the purposes described in this privacy notice then you do not need to do anything.  If you have any concerns about how your data is shared then please contact the Practice.

  • If you are not happy with our Privacy Policy or if have a complaint then you should tell us by writing to us
  • If a dispute is not settled then we hope you will agree to attempt to resolve it by engaging in good faith with us in a process of mediation or arbitration
  • If you are in any way dissatisfied about how we process your personal information, you have a right to lodge a complaint with the Information Commissioner’s Office. This can be done at ICO concerns
  • The Information Commissioner
    Wycliffe House
    Water Lane
    Wilmslow
    Cheshire
    SK9 5AF
    Phone: 0303 123 1113
This Practice holds and uses patient data for the purposes of Complaints, Subject Access Requests and Freedom of Information Requests. We collect and store information about your health and care that has been received directly from you or organisations such as Local Authorities, other GP Practices, NHS Trusts and NHS Integrated Care Systems.   Under UK GDPR and the Data Protection Act 2018, you have the right to see or be given a copy of any personal data we hold about you. To gain access to a copy of your information, you will need to make a Subject Access Request (SAR) to the Practice. You can do so by emailing or contacting us.   Under the Freedom of Information Act 2000, you have the right to request copies of non-personal information held by the Practice. To gain access to a copy of your information, you will need to make a Freedom of Information (FOI) Request to the Practice.   Should you wish to make a complaint to the Practice, then there may be a need for them to view and access your patient data or request some from you directly. This will allow the Practice to investigate your complaint. Information on our complaints process can be found here:  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingLegal Obligations of the Practice to manage, investigate and respond to requests for copies of personal data, FOI requests and complaints.
4) The Lawfulness Conditions and Special CategoriesThe lawful justifications for the processing and possible sharing of this data are;-   Article 6(1)(c) “the processing is necessary for compliance with any legal obligation to which the controller is subject”   Where your complaint or SAR involves processing of special category data the relevant condition for processing that data will be Article 9(2)(g) “substantial public interest” as defined by Data Protection Act 2018, Schedule 1, Part 2, Section 6(2)(a) “the exercise of a function conferred on a person by an enactment or rule of law”
5) Recipient or categories of recipients of the shared dataWhere a complaint you make is about another organisation, we may share details of your complaint with that organisation. We would only do so after informing you of this.
6) Rights to objectYou have the right under Article 21 of the UK GDPR to object to your personal information being processed. Please contact the Practice if you wish to object to the processing of your data. You should be aware that this is a right to raise an objection which is not the same as having an absolute right to have your wishes granted in every circumstance. GP Practices process personal data under Article 6(1)(c) on a lawful and legitimate basis where the organisation is obliged under law to comply with The UK General Data Protection Regulations (GDPR) The Data Protection Act 2018 The Freedom of Information Act The NHS Constitution The Local Authority Social Services and National Health Service Complaints (England) Regulations 2009 By complying with these laws, the Practice has compelling legitimate grounds for the processing which override the interests, rights and freedoms in the right to object.
7) Right to access and correctYou have the right to access any identifiable personal data that is being processed or shared and to have any inaccuracies corrected.

8) Retention periodThe data will be retained for the period as specified in the national records retention schedule.

9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/   or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
Confidentiality

Confidentiality Statement

We are committed to maintaining confidentiality and protecting the information we hold about you. We adhere to the General Data Protection Regulation (GDPR), the NHS Codes of Confidentiality and Security, as well as guidance issued by the Information Commissioner’s Office (ICO). You have a right to access the information we hold about you, and if you would like to access this information, you will need to write to the practice requesting the information. Furthermore, should you identify any inaccuracies; you have a right to have the inaccurate data corrected.

Anyone who receives information from us also has a legal duty to keep it confidential and secure.

All staff in the Practice sign a Confidentiality Agreement that explicitly makes clear their duties in relation to personal health information and the consequences of breaching that duty.

Please be aware that your information will be accessed by non-clinical Practice staff in order to perform tasks enabling the functioning of the Practice. These include, but not limited to:

  • typing referral letters to Hospital Consultants or allied Healthcare Professionals
  • opening letters from Hospitals and Consultants
  • scanning clinical letters, radiology reports and any other documents not available in electronic format
  • photocopying or printing documents for referral to Consultants
  • handling, printing, photocopying and postage of medical legal and insurance reports and of associated documents.

How we keep your information confidential and safe 

Everyone working for our organisation is subject to the Common Law Duty of Confidence. Information provided in confidence will only be used for specific purposes in accordance with the law. The NHS Digital Code of Practice on Confidential Information  applies to all NHS staff and they are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared. All our staff are expected to make sure information is kept confidential and receive regular training on how to do this. 

The health records we use may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Your records are backed up securely in line with NHS standard procedures. We ensure that the information we hold is kept in secure locations, is protected by appropriate security and access is restricted to authorised personnel. We also make sure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could or does identify a person are processed. We are committed to protecting your privacy and will only use information collected lawfully in accordance with: 

  • Data Protection Act 2018 
  • Human Rights Act 
  • Common Law Duty of Confidentiality 
  • NHS Codes of Confidentiality and Information Security 
  • Health and Social Care Act 2015 
  • And all applicable legislation 

We have a senior person responsible for protecting the confidentiality of patient information and enabling appropriate information sharing. This person is called the Caldicott Guardian.

We are registered with the Information Commissioner’s Office (ICO) as a data controller which describes the purposes for which we process personal data. A copy of the registration is available from the ICO’s web site by searching on our name.

We maintain our duty of confidentiality to you at all times. We will only ever use or pass on information about you if we reasonably believe that others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (such as a risk of serious harm to yourself or others) or where the law requires information to be passed on.

COVID-19 supplementary notice

The health and social care system is facing significant pressures due to the coronavirus outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency, it has become even more important to share health and care information across relevant organisations.

This notice describes how GPs and other health and social care organisations may use your information within the health and social care system to protect you and others during the Coronavirus (COVID-19) outbreak with regard to your Summary Care Record.

Coroner

Personal confidential information may be shared with the Police authority for certain purposes. The level of sharing and purpose for sharing may vary. Where there is a legal basis for this information to be shared no consent will be required.

The Police will require the correct documentation in order to make a request. This could be but not limited to, DS 2, Court order, s137, the prevention and detection of a crime.

In some cases consent may be required.

Legal Basis – UK GDPR – Article 6 1 (f) legitimate interest 6 1 (c) Legal Obligation.

Article 9 2 (f) requests for legal reasons

Data Controller

The Data Protection Act 2018 requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information.
We are registered as the data controller and our registration can be viewed online in the public register at: Register of fee payers.

Any changes to this notice will be published on our website and in a prominent area at the Practice.

Data Processor

Data processors are responsible for the processing of personal data on behalf of the data controller. Processors must ensure that processing is lawful and that at least one of the following applies:

  • The data subject has given consent to the processing of his/her personal data for one or more specific purposes
  • Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract
  • Processing is necessary for compliance with a legal obligation to which the controller is subject
  • Processing is necessary in order to protect the vital interests of the data subject or another natural person
  • Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
  • Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child

At our Practice all staff are classed as data processors as their individual roles will require them to access and process personal data.

Data Protection Officer (DPO)

The Data Protection Officer is responsible for ensuring the Practice remains compliant at all times with Data Protection, Privacy & Electronic Communications Regulations, Freedom of Information Act and the Environmental Information Regulations. The Data Protection Officer shall:

  • Lead on the provision of expert advice to the Practice on all matters concerning the Data Protection Act, compliance, best practice and setting and maintaining standards
  • Inform and advise the organisation and its employees of their data protection obligations under the GDPR
  • Monitor the organisation’s compliance with the GDPR and internal data protection policies and procedures. This will include monitoring the assignment of responsibilities, awareness training, and training of staff involved in processing operations and related audits
  • Advise on the necessity of data protection impact assessments (DPIAs), the manner of their implementation and outcomes
  • Serve as the contact point to the data protection authorities for all data protection issues, including data breach reporting.

The DPO will be independent and an expert in data protection. The DPO will be the Practice’s point of contact with the Information Commissioner’s Office. The DPO can be contacted via the contact details at the top of this notice. Please address your request for the attention of the Data Protection Officer (DPO).

Please contact the Data Protection Officer if:

  • You have any questions about how your information is being held
  • If you require access to your information or if you wish to make a change to your
  • information
  • If you wish to make a complaint about anything to do with the personal and healthcare
  • information we hold about you
  • Or any other query relating to this Policy and your rights as a patient.

Changes:

It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Practice Data Protection Officer.

Data Retention

We manage patient records in line with the Records Management NHS Code of Practice for Health and Social Care, which sets the required standards of practice in the management of records for those who work within or under contract to NHS organisations in England.This is based on current legal requirements and professional best practice. If you transfer to another GP and we are asked to transfer your records we will do this to ensure your care is continued. Currently the NHS is required to keep GP records for 10 years after a patient has died. Exceptions to these rules are detailed in the code of practice.

Data Subject Access Requests (DSAR)

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to
request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

  • Your request should be made to the Practice – for information from the hospital you should write direct to them
  • There is no charge to have a copy of the information held about you
  • We are required to respond to you within one month
  • You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.
Department for Work and Pensions and DVLA

Our Practice is legally required to provide anonymised data on patients who have been issued with a fit note under the Fit for Work scheme. The purpose is to provide the Department for Work and Pensions with information from Fit Notes to improve the monitoring of public health and commissioning and quality of health services.

The Driving and Licencing Authority (DVLA) are required to assess whether licence holders are fit to drive if a patient is recently diagnosed or has a condition which may affect their fitness.   The patient must inform the DVLA if this is the case however in certain circumstances, a GP may contact the DVLA with a Patient’s consent or, if a GP believes their patient will not report their condition, contact the DVLA without consent to protect the public. Please see the following link for further information: https://www.gov.uk/driving-medical-conditions  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]  
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingTo provide the Secretary of State and the Driving and Licencing Authority (DVLA) with information relating to fitness to drive. Although the primary obligation lies with the Patient, circumstances exist where a GP will need to contact DVLA to highlight a concern.
4) Lawful basis for processingThe legal basis for us sharing this data under UK GDPR will be. Article 6(1)(a) “the data subject has given consent to the processing of his or her personal data for one or more specific purposes”. or 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’. And Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”  
5) Recipient or categories of recipients of the shared dataThe data will be shared with the Driving and Licencing Authority (DVLA), its officers and staff and members to assess fitness to drive.
6) Rights to objectYou have the right to object to some or all of the information being shared with Driving and Licencing Authority (DVLA) in certain circumstances. Contact the Practice using the details above.
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention periodThe data will be retained for active use during the processing and thereafter according to NHS Policies and the law.
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website).
Direct Patient Care and Emergencies

There are occasions when intervention is necessary in order to save or protect a patient’s life or to prevent them from serious immediate harm, for instance during a collapse or diabetic coma or serious injury or accident. In many of these circumstances the patient may be unconscious or too ill to communicate. In these circumstances we have an overriding duty to try to protect and treat the patient. If necessary we will share your information and possibly sensitive confidential information with other emergency healthcare services, the police or fire brigade, so that you can receive the best treatment.   The law acknowledges this and provides supporting legal justifications.   Individuals have the right to make pre-determined decisions about the type and extend of care they will receive should they fall ill in the future; these are known as “Advance Directives”.  If logged in your records these will be honoured despite the observations in the first paragraph.  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingDoctors have a professional responsibility to share data in emergencies to protect their patients or other persons. Often in emergency situations the patient is unable to provide consent.
4) Lawful basis for processingThis is a Direct Care purpose. There is a specific legal justification; Article 6(1)(d) “processing is necessary to protect the vital interests of the data subject or of another natural person” And Article 9(2)(c) “processing is necessary to protect the vital interests of the data subject or of another natural person where the data subject is physically or legally incapable of giving consent” Or alternatively Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”    We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”*
5) Recipient or categories of recipients of the shared dataThe data will be shared with healthcare professionals and other workers in emergency and out of hours services and at local hospitals, diagnostic and treatment centres.  
6) Rights to objectYou have the right to object to some or all the information being shared with the recipients. Contact the Controller or the practice. You also have the right to have an “Advance Directive” placed in your records and brought to the attention of relevant healthcare workers or staff.   
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law. If we share or process your data in an emergency when you have not been able to consent, we will notify you at the earliest opportunity.
8) Retention periodThe data will be retained in line with the law and national guidance
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
* “Common Law Duty of Confidentiality”, common law is not written out in one document like an Act of Parliament. It is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case law. The law is applied by reference to those previous cases, so common law is also said to be based on precedent.
The general position is that if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent.
In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or held in the memory of the professional, must not normally be disclosed without the consent of the patient. It is irrelevant how old the patient is or what the state of their mental health is; the duty still applies.
Three circumstances making disclosure of confidential information lawful are:
where the individual to whom the information relates has consented;
where disclosure is in the public interest; and
where there is a legal duty to do so, for example a court order.
This practice keeps data on you relating to who you are, where you live, what you do, your family, possibly your friends, your employers, your habits, your problems and diagnoses, the reasons you seek help, your appointments, where you are seen and when you are seen, who by, referrals to specialists and other healthcare providers, tests carried out here and in other places, investigations and scans, treatments and outcomes of treatments, your treatment history, the observations and opinions of other healthcare workers, within and without the NHS as well as comments and aide memoires reasonably made by healthcare professionals in this practice who are appropriately involved in your health care.   When registering for NHS care, all patients who receive NHS care are registered on a national database, the database is held by NHS Digital, a national organisation which has legal responsibilities to collect this data.   NHS GPs have many patients for whom they are responsible and to facilitate efficient and accessible services your GP delegates tasks and responsibilities to others that work with them in their surgeries.  They will also share your care with other organisations, predominantly within the surgery but occasionally with outside organisations and particularly with local partner practices forming part of your GPs Primary Care Network (PCN) with whom your practice works closely and collaboratively to provide the most flexible and accessible services for patients.  This will mean that GPs from other local practices will at times have access to your full GP record but only when providing direct care to you.   If your health needs require care from others elsewhere outside this practice we will exchange with them whatever information about you that is necessary for them to provide that care. When you make contact with healthcare providers outside the practice but within the NHS it is usual for them to send us information relating to that encounter. We will retain part or all of those reports. Normally we will receive equivalent reports of contacts you have with non NHS services, but this is not always the case. The sharing of your data, within the practice and with those others outside the practice engaged in your direct care is allowed by Law.   People who have access to your information will only normally have access to that which they need to fulfil their roles, for instance admin staff will normally only see your name, address, contact details, appointment history and registration details in order to book appointments, the practice nurses will normally have access to your immunisation, treatment, significant active and important past histories, your allergies and relevant recent contacts whilst the GP you see or speak to will normally have access to everything in your record.   You have the right to object to our sharing your data in these circumstances, but we have an overriding responsibility to do what is in your best interests. Please see below.  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]  
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the  processingDirect Care is care delivered to the individual alone, most of which is provided in the surgery. After a patient agrees to a referral for direct care elsewhere, such as a referral to a specialist in a hospital, necessary and relevant information about the patient, their circumstances and their problem will need to be shared with the other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care.
4) Lawful basis for  processingThe processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR: Article 6(1)(e) ‘…The processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.   Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”    We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”*
5) Recipient or categories of recipients of the processed dataThe data will be shared with Health and care professionals and support staff in this surgery and at hospitals, diagnostic and treatment centres who contribute to your personal care.  [if possible list actual named sites such as local hospital)(s) name]
6) Rights to objectYou have the right to object to some or all the information being processed under Article 21. Please contact the Controller or the practice. You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention periodThe data will be retained in line with the law and national guidance. https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016 or speak to the practice.  
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
* “Common Law Duty of Confidentiality”, common law is not written out in one document like an Act of Parliament. It is a form of law based on previous court cases decided by judges; hence, it is also referred to as ‘judge-made’ or case law. The law is applied by reference to those previous cases, so common law is also said to be based on precedent.
The general position is that if information is given in circumstances where it is expected that a duty of confidence applies, that information cannot normally be disclosed without the information provider’s consent.
In practice, this means that all patient information, whether held on paper, computer, visually or audio recorded, or held in the memory of the professional, must not normally be disclosed without the reasonable expectation of the patient. It is irrelevant how old the patient is or what the state of their mental health is; the duty still applies.

HR, Staffing, Employment, Recruitment and Training
This Practice collects and stores information pertaining to staff for the purposes of HR, employment, recruitment and training.   Information is collected and stored about prospective, current and past employees, including self-employed and temporary staff.   Data is collected for purposes including recruitment, occupational health, vetting checks, staff training and payroll.    We share information with the following organisations with your explicit consent or when the law allows: future employers reference request and HM Revenue & Customs.  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the sharingLegal Obligation  
4) The Lawfulness Conditions and Special CategoriesThe lawful basis for processing, storing and sharing this data under UK Data Protection Legislation are –      Article 6(1)(c)the processing is necessary for compliance with any legal obligation to which the controller is subject”.   And in addition, an Article 9 condition for processing must also be adhered to: –   Article 9(2)(b) – ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment”.  
5) Recipient or categories of recipients of the shared dataThe data will be shared with HM Revenue & Customs and future employers where a reference is requested.
6) Rights to objectYou do not have to consent to your data being used for this purpose. You can change your mind and withdraw your consent at any time. Contact the Controller or the practice.
7) Right to access and correctYou have the right to access any identifiable data that is being shared and have any inaccuracies corrected.
8) Retention periodThe data will be retained for the period as specified in the specific employment protocol(s).

9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
Individual Funding Request

An ‘Individual Funding Request’ is a request made on your behalf, with your consent, by a Clinician, for funding of specialised healthcare which falls outside the range of services and treatments that CCG has agreed to commission for the local population. An Individual Funding Request is taken under consideration when a case can be set out by a patient’s Clinician that there are exceptional clinical circumstances which make the patient’s case different from other patients with the same condition and who are at the same stage of their disease, or when the request is for a treatment that is regarded as new or experimental and where there are no other similar patients who would benefit from this treatment. A detailed response, including the criteria considered in arriving at the decision, will be provided to the patient’s Clinician.

Job application and employment

If you send us information in connection with a job application, we may keep it for up to three years in case we decide to contact you at a later date.

If we employ you, we collect information about you and your work from time to time throughout the period of your employment. This information will be used only for purposes directly relevant to your employment. After your employment has ended, we will keep your file for six years before destroying or deleting it.

Keeping your records up to date

GDPR requires that the information we hold about you is accurate and current. We rely on our patients to tell us if they have moved house, or had medical treatment abroad. For our part, we will update your medical records at each consultation with a doctor or a nurse (either face to face, or by telephone), and with any relevant information we receive from hospital, community or social services providers (e.g. new diagnoses, change in circumstances).

Litigations and Clams
This Practice is legally obliged to investigate any litigation or claims brought against them, and this will require us to access, process and hold some your personal identifiable data. This may include your name, address, date or birth and medical condition and other data we may hold. The data this Practice will need to process will depend on the type of litigation or claim received.   This NHS Litigation Authority operates a scheme which this Practice pays an annual contribution for, and in return the NHS Litigation Authority supports the settlement of any clinical negligence claims the Practice receives.  
1) Data Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingLegal Obligations of the Practice  
4) The Lawfulness Conditions and Special CategoriesThe lawful justifications for the processing and possible sharing of this data under Data Protection Legislation are –   Article 6(1)(c) “the processing is necessary for compliance with any legal obligation to which the controller is subject”.   Article 9(f) “the processing is necessary for the establishment, exercise or defence of legal claims or whenever courts are acting in their judicial capacity”
5) Recipient or categories of recipients of the shared dataThe data may be shared with organisations such as Our solicitors or legal team The Court processing the claim. Any regulatory body who has a statutory basis for evidencing, overseeing, investigating, or substantiating litigation, a claim or national or professional standards such as the GMC, the Care Quality Commission and other bodies or the outcomes of such action.
6) Rights to objectYou have the right under Article 21 of the GDPR to object to your personal information being processed. Please contact the Practice if you wish to object to the processing of your data. You should be aware that this is a right to raise an objection which is not the same as having an absolute right to have your wishes granted in every circumstance. Practice’s process personal data under Article 6(1)(c) on a lawful and legitimate basis where the organisation is obliged under law to comply with The UK General Data Protection Regulations (GDPR) The Data Protection Act 2018 The Freedom of Information Act The NHS Constitution The Local Authority Social Services and National Health Service Complaints (England) Regulations 2009 By complying with these laws, the Practice has compelling legitimate grounds for the processing which override the interests, rights and freedoms in the right to object.
7) Right to access and correctYou have the right to access any identifiable personal data that is being processed or shared and to have any inaccuracies corrected.

8) Retention periodThe data will be retained for the period as specified in the national records retention schedule.

9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
Mobile phone

If you provide us with your mobile phone number, we may use this to send you reminders about any appointments or other health screening information being carried out. This may be by telephone call or SMS text messaging, ( if this service is available). Please contact the reception if you wish to ‘opt-out’ of this service and this information will be added to your records.

National Fraud Initiative – Cabinet Office

The use of data by the Cabinet Office for data matching is carried out with statutory authority under Part 6 of the Local Audit and Accountability Act 2014. It does not require the consent of the individuals concerned under the Data Protection Act 2018. Data matching by the Cabinet Office is subject to a Code of Practice. For further information see UK Government publications code of data.

National Screening 
The NHS provides national screening and reporting programmes so that certain diseases can be detected at an early stage. These currently apply to bowel cancer, breast cancer, aortic aneurysms, and diabetic retinal screening service as well as other exempt programmes. The law allows us to share your contact information with Public Health England and NHS England so that you can be invited to the relevant screening programme and so that nationally exempted programmes can operate effectively with regards to public and patient health.   More information can be found at: https://www.gov.uk/topic/population-screening-programmes or  https://digital.nhs.uk/services/national-data-opt-out/compliance-with-the-national-data-opt-out (select link for Data Uses and Releases Compendium) or speak to the practice.  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]  
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingThe NHS provides several national health screening and reporting programs to detect diseases or conditions earlier such as cervical and breast cancer, aortic aneurysm and diabetes. More information can be found at https://www.gov.uk/topic/population-screening-programmes The information is shared so as to ensure only those who should be called for screening are called and or those at highest risk are prioritised.  
4) Lawful basis for processingThe sharing is to support Direct Care which is covered under UK Data Protection Legislation.   Article 6(1)(e); “necessary… in the exercise of official authority vested in the controller’ the processing is necessary to perform a task in the public interest.   And   Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”  Or Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices…’   We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality” *
5) Recipient or categories of recipients of the shared dataThe data will be shared with national and research bodies as allowed by law.  Please see links for full details.
6) Rights to objectYou have the right to object to this processing of your data and to some or all of the information being shared with the recipients. Contact the Controller or the practice. For national screening programmes: you can opt so that you no longer receive an invitation to a screening programme. See: https://www.gov.uk/government/publications/opting-out-of-the-nhs-population-screening-programmes Or speak to your practice.  
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention periodGP medical records will be kept in line with the law and national guidance. Information on how long records can be kept can be found at: https://transform.england.nhs.uk/information-governance/guidance/records-management-code/ Or speak to the practice.
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
10) National Data Opt OutWhenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.   The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:   improving the quality and standards of care providedresearch into the development of new treatments preventing illness and diseasesmonitoring safetyplanning services   This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.   Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed.   You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.   To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters   On this web page you will: See what is meant by confidential patient information.Find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care.Find out more about the benefits of sharing data.Understand more about who uses the data.Find out how your data is protected.Be able to access the system to view, set or change your opt-out settingFind the contact telephone number if you want to know any more or to set/change your opt-out by phone See the situations where the opt-out will not apply.   You can also find out more about how patient information is used at: https://www.hra.nhs.uk/information-about-patients/ (which covers health and care research); and https://understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made)   You can change your mind about your choice at any time.   Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes.  Data would only be used in this way with your specific agreement.

More information can be found at: Population screening programmes, or if you prefer please contact the Practice. Please contact the Practice if you do not wish to participate in any National Screening programmes offered.

National Data Opt-Out – General Practice Data for Planning and Research (GPDPR)

NHS Digital want to collect

  • data about diagnoses, symptoms, observations, test results, medications, allergies, immunisations, referrals, recalls and appointments, including information about physical, mental and sexual health
  • data on sex, ethnicity and sexual orientation
  • data about staff who have treated patients in a pseudonymised way (which is still personal data, as the data can be linked back.

Further information about General Practice Data for Planning and Research (GPDPR) and opting out can be found at NHS Digital

NHS APP

NHS App messaging Service

We use the NHS Account Messaging Service provided by NHS England to send you messages relating to your health and care. You need to be an NHS App user to receive these messages. Further information about the service can be found at the privacy notice for the NHS App managed by NHS England at: NHS App Privacy Policy.

NHS Diabetes Prevention Programme

NHS England has commissioned a provider, Xyla Health and Wellbeing, to provide the ‘Your local Healthier You: NHS Diabetes Prevention Programme’ for patients at risk of type 2 diabetes. Once a patient is referred, they will be contacted for a motivational interview with the provider (Xyla) to help them enrol onto the course and to have an opportunity to ask any questions they have at this time, including if you don’t want to enrol in the programme. Xyla Health and Wellbeing is part of the Acacium Group and sometimes, if required and legally allowed, Xyla may share some of your basic details such as your name and contact details with providers who have been identified as suitable to contact you to provide support for you during this programme. Any sharing of your data is done as little as possible, under due diligence and in compliance with applicable laws. For full details on how Xyla would use your data for the diabetes prevention programme, see their privacy notice at: https://preventing-diabetes.co.uk/diabetes-prevention-privacy-policy/ For general information on the national diabetes prevention programme, please visit the NHS England website on this at: https://preventing-diabetes.co.uk/

NHS Digital

NHS Digital collects health information from the records health and social care providers keep about the care and treatment they give, to promote health or support improvements in the delivery of care services in England.

Our legal basis for sharing data with NHS Digital

NHS Digital has been legally directed to collect and analyse patient data from all GP practices in England to support the coronavirus response for the duration of the outbreak. NHS Digital will become the controller under the General Data Protection Regulation 2016 (GDPR) of the personal data collected and analysed jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse this data under the COVID-19 Public Health Directions 2020 (COVID-19 Direction).

All GP practices in England are legally required to share data with NHS Digital for this purpose under the Health and Social Care Act 2012 (2012 Act). More information about this requirement is contained in the data provision notice issued by NHS Digital to GP practices.

Under GDPR our legal basis for sharing this personal data with NHS Digital is Article 6(1)(c) – legal obligation. Our legal basis for sharing personal data relating to health, is Article 9(2)(g) – substantial public interest, for the purposes of NHS Digital exercising its statutory functions under the COVID-19 Direction.

The type of personal data we are sharing with NHS Digital

The data being shared with NHS Digital will include information about patients who are currently registered with a GP practice or who have a date of death on or after 1 November 2019 whose record contains coded information relevant to coronavirus planning and research. The data contains NHS Number, postcode, address, surname, forename, sex, ethnicity, date of birth and date of death for those patients. It will also include coded health data which is held in your GP record such as details of:

  •  diagnoses and findings
  •  medications and other prescribed items
  •  investigations, tests and results
  •  treatments and outcomes
  •  vaccinations and immunisations

How NHS Digital will use and share your data

NHS Digital will analyse the data they collect and securely and lawfully share data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for coronavirus response purposes only. These purposes include protecting public health, planning and providing health, social care and public services, identifying coronavirus trends and risks to public health, monitoring and managing the outbreak and carrying out of vital coronavirus research and clinical trials. The British Medical Association, the Royal College of General Practitioners and the National Data Guardian are all supportive of this initiative.

NHS Digital has various legal powers to share data for purposes relating to the coronavirus response. It is also required to share data in certain circumstances set out in the COVID-19 Direction and to share confidential patient information to support the response under a legal notice issued to it by the Secretary of State under the Health Service (Control of Patient Information) Regulations 2002 (COPI Regulations).

Legal notices under the COPI Regulations have also been issued to other health and social care organisations requiring those organisations to process and share confidential patient information to respond to the coronavirus outbreak. Any information used or shared during the outbreak under these legal notices or the COPI Regulations will be limited to the period of the outbreak unless there is another legal basis for organisations to continue to use the information. 

Data which is shared by NHS Digital will be subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the coronavirus purpose will be shared. Organisations using your data will also need to have a clear legal basis to do so and will enter into a data sharing agreement with NHS Digital. Information about the data that NHS Digital shares, including who with and for what purpose will be published in the NHS Digital data release register.

For more information about how NHS Digital will use your data please see the NHS Digital Transparency Notice for GP Data for Pandemic Planning and Research (COVID-19).

National Data Opt-Out

The application of the National Data Opt-Out to information shared by NHS Digital will be considered on a case by case basis and may or may not apply depending on the specific purposes for which the data is to be used. This is because during this period of emergency, the National Data Opt-Out will not generally apply where data is used to support the coronavirus outbreak, due to the public interest and legal requirements to share information.

Your rights over your personal data

To read more about the health and care information NHS Digital collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS Digital of your personal data, see:

NHS Digital is the secure haven for NHS patient data, a single secure repository where data collected from all branches of the NHS is processed. NHS Digital provides reports on the performance of the NHS, statistical information, audits, and patient outcomes (https://digital.nhs.uk/data-and-information).   Examples include A/E and outpatient waiting times, the numbers of staff in the NHS, percentage target achievements, payments to GPs etc and more specific targeted data collections and reports such as the Female Genital Mutilation, general practice appointments data and English National Diabetes Audits. GPs are required by the Health and Social Care Act to provide NHS Digital with information when instructed.   This is a legal obligation which overrides any patient wishes. These instructions are called “Directions”. More information on the directions placed on GPs can be found at https://digital.nhs.uk/article/8059/NHS-England-Directions- and www.nhsdatasharing.info  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingTo provide the Secretary of State and others with information and reports on the status, activity and performance of the NHS.   [Practice to insert specific functions that are reported to NHSD]
4) Lawful basis for processingThe legal basis will be Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” And Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;”
5) Recipient or categories of recipients of the shared dataThe data will be shared with NHS Digital according to directions which can be found at https://digital.nhs.uk/article/8059/NHS-England-Directions-  
6) Rights to objectYou have the right to object to some or all of the information being shared with NHS Digital. Contact the Controller or the practice.
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention periodThe data will be retained for active use during the processing and thereafter according to NHS Policies and the law.
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)/
Opt-out of information sharing

Opt-outs

You have a right to object to your information being shared.  Should you wish to opt out of data collection, please contact a member of staff who will be able to explain how you can opt out and prevent the sharing of your information; this is done by registering a Type 1 opt-out, preventing your information from being shared outside this Practice.

If you have previously opted-out of any data sharing arrangements, your opt-out I will continue to be valid.

Other Matters

Use of our website by children

  • If you are under 18, you may use our website only with consent from a parent or guardian
  • We collect data about all users of and visitors to these areas regardless of age, and we anticipate that some of those users and visitors will be children
  • Such child users and visitors will inevitably visit other parts of the site and will be subject to whatever on-site information they find, wherever they visit

Encryption of data sent between us

We use Secure Sockets Layer (SSL) certificates to verify our identity to your browser and to encrypt any data you give us.

Whenever information is transferred between us, you can check that it is done so using SSL by looking for a closed padlock symbol or other trust mark in your browser’s URL bar or toolbar.

Patient Participation and Engagement Groups
This practice hosts Patient Participation and Engagement groups to improve the quality of services delivered by the practice.   We collect and store information that has been received directly from you if you are actively involved in the Patient Participation or Engagement group. The Practice uses the following methods of patient engagement: [Practice to insert details] We may share information with the following organisations with your explicit consent or when the law allows: [Practice to insert names e.g., ICS or service provider]. You have the right to object to your identifiable information being used or shared for this purpose. Please speak to the practice if you no longer wish to have your data used or be a part of the Patient Participation or Engagement group.  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the sharingPublic Task  
4) Lawfulness ConditionsThe lawful justifications for the processing and possible sharing of this data are; –   Article 6(1)(a)the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.  
5) Recipient or categories of recipients of the shared dataThe data will be shared with [insert name and URLs of organisations]
6) Rights to objectYou do not have to consent to your data being used for the patient participation or engagement groups. You can change your mind and withdraw your consent at any time. Contact the Practice using the contact details above.
7) Right to access and correctYou have the right to access any identifiable data that is being shared and have any inaccuracies corrected.
8) Retention periodThe data will be retained for the period as specified in the national records retention schedule.
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)

Payments

Contract holding GPs in the UK receive payments from their respective governments on a tiered basis. Most of the income is derived from baseline capitation payments made according to the number of patients registered with the practice on quarterly payment days. These amounts paid per patient per quarter varies according to the age, sex and other demographic details for each patient.   There are also graduated payments made according to the practice’s achievement of certain agreed national quality targets known as the Quality and Outcomes Framework (QUOF), for instance the proportion of diabetic patients who have had an annual review. Practices can also receive payments for participating in agreed national or local enhanced services, for instance opening early in the morning or late at night or at the weekends.   Practices can also receive payments for certain national initiatives such as immunisation programs and practices may also receive incomes relating to a variety of non-patient related elements such as premises. Finally, there are short term initiatives and projects that practices can take part in. Practices or GPs may also receive income for participating in the education of medical students, junior doctors and GPs themselves as well as research2.   In order to make patient-based payments basic and relevant necessary data about you needs to be sent to the various payment services. The release of this data is required by English laws1  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingTo enable GPs to receive payments. To provide accountability.
4) Lawfulness Conditions and Special CategoriesThe processing of personal data in the delivery of direct care and for providers’ administrative purposes in this surgery and in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the UK GDPR: Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” And   Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”   
5) Recipient or categories of recipients of the processed dataThe data will be shared with Health and care professionals and support staff in this surgery and at hospitals, diagnostic and treatment centres who contribute to your personal care.
6) Rights to objectYou have the right to object to some or all the information being processed under Article 21. Please contact the Practice. You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention periodThe data will be retained in line with the law and national guidance. https://transform.england.nhs.uk/information-governance/guidance/records-management-code/
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
1, NHS England’s powers to commission health services under the NHS Act 2006 or to delegate such powers to ICBs and the GMS regulations 2004 (73)1
2, For more information about payments the English GPs please see; https://digital.nhs.uk/NHAIS/gp-payments , https://digital.nhs.uk/catalogue/PUB30089 and http://www.nhshistory.net/gppay.pdf
Processing of information

The basis on which we process information about you

The Law requires us to determine under which of six defined bases we process different categories of your personal information, and to notify you of the basis for each category. If a basis on which we process your personal information is no longer relevant then we shall immediately stop processing your data. If the basis changes then, if required by Law, we shall notify you of the change and of any new basis under which we have determined that we can continue to process your information.

Lawful basis for processing

The legal basis will be

Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.”

And

Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards ”

Information we process because we have a contractual obligation with you

When you join our Practice, receive medical services from us, or otherwise agree to our terms and conditions, a contract is formed between you and us. In order to carry out our obligations under that contract we must process the information you give us. Some of this information may be personal information.

We may use it in order to:

  • verify your identity for security purposes
  • provide you with our services
  • provide you with suggestions and advice and how to obtain the most from using our website

We process this information on the basis there is a contract between us, or that you have requested we use the information before we enter into a legal contract. Additionally, we may aggregate this information in a general way and use it to provide class information, for example to monitor our performance with respect to a particular service we provide. If we use it for this purpose, you as an individual will not be personally identifiable.

We shall continue to process this information until the contract between us ends or is terminated by either party under the terms of the contract.

Why do we collect this information?

The NHS Act 2006 and the Health and Social Care Act 2012 invests statutory functions on GP Practices to promote and provide the health service in England, improve quality of services, reduce inequalities, conduct research, review performance of services and deliver education and training. To do this we will need to process your information in accordance with current data protection legislation to:

  • Protect your vital interests;
  • Pursue our legitimate interests as a provider of medical care, particularly where the individual is a child or a vulnerable adult; 
  • Perform tasks in the public’s interest;
  • Deliver preventative medicine, medical diagnosis, medical research; and
  • Manage the health and social care system and services.

About the personal information we use

We use personal information on different groups of individuals including:  

  • Patients 
  • Staff
  • Contractors
  •  Suppliers
  • Complainants, enquirers
  • Survey respondents
  • Professional experts and consultants
  • Individual captured by CCTV

The personal information we use includes information that identifies you like your name, address, date of birth and postcode.We also use more sensitive types of personal information, including information about racial or ethnic origin; political opinions; religious or philosophical beliefs; trade union membership; genetic and biometric data, health; sex life or sexual orientation.The information we use can relate to personal and family details; education, training and employment details; financial details; lifestyle and social circumstances; goods and services; visual images; details held in the patient record; responses to surveys.

Information we process with your consent

Through certain actions when otherwise there is no contractual relationship between us, such as when you browse our website or ask us to provide you with more information about our business, including job opportunities and our services, you provide your consent to us to process information that may be personal information.

Wherever possible, we aim to obtain your explicit consent to process this information, for example, by asking you to agree to our use of cookies.

Sometimes you might give your consent implicitly, such as when you send us a message by e-mail to which you would reasonably expect us to reply.

Except where you have consented to our use of your information for a specific purpose, we do not use your information in any way that would identify you personally. We may aggregate it in a general way and use it to provide class information, for example to monitor the performance of a particular page on our website.

We continue to process your information on this basis until you withdraw your consent or it can be reasonably assumed that your consent no longer exists.

You may withdraw your consent at any time by instructing us in writing. However, if you do so, you may not be able to use our website or our services further.

Information we process for the purposes of legitimate interests

We may process information on the basis there is a legitimate interest, either to you or to us, of doing so.

Where we process your information on this basis, we do after having given careful consideration to:

  • whether the same objective could be achieved through other means
  • whether processing (or not processing) might cause you harm
  • whether you would expect us to process your data, and whether you would consider it reasonable to do so

For example, we may process your data on this basis for the purposes of:

  • record-keeping for the proper and necessary administration of our business or profession
  • responding to unsolicited communication from you to which we believe you would expect a response
  • protecting and asserting the legal rights of any party
  • insuring against or obtaining professional advice that is required to manage business or professional risk
  • protecting your interests where we believe we have a duty to do so

Information we process because we have a legal obligation

We are subject to the Law like everyone else. Sometimes, we must process your information in order to comply with a statutory obligation.

For example, we may be required to give information to legal authorities if they so request or if they have the proper authorisation such as a search warrant or court order.

This may include your personal information.

Information we process may be categorised as special category data

Special category data is personal data which the GDPR says is more sensitive, and so needs more protection. For example information about an individuals:

  • race
  • ethnic origin
  • health
  • sex life or
  • sexual orientation

We may process this information for the purposes of medical diagnosis, provision of health treatment and management of the health of our patients and the community we serve.

Specific uses of information you provide to us

Healthcare Professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records are used to help to provide you with the best possible healthcare.

NHS healthcare records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records we hold about you may include the following information;

  • Details about you, such as your name, address, carers, legal representatives and emergency contact details
  • Any contact the Surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
  • Notes and reports about your health
  • Details about your treatment and care
  • Results of investigations such as laboratory tests, x-rays, etc.
  • Relevant information from other Healthcare Professionals, relatives or those who care for you

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within our GP Practice for clinical audit to monitor the quality of the service provided. Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified.

Sometimes your information may be requested to be used for research purposes – the Surgery will always gain your consent before releasing the information for this purpose.

Who else may ask to access your information

  • The Court can insist that we disclose medical records to them
  • Solicitorsoften ask for medical reports. These will always be accompanied by your signed consent for us to disclose information. We will not normally release details about other people that are contained in your records (e.g. wife, children parents etc.) unless we also have their consent
  • Social Services – The Benefits Agency and others may require medical reports on you from time to time. These will often be accompanied by your signed consent to disclose information. Failure to cooperate with these agencies can lead to loss of benefit or other support. However, if we have not received your signed consent we will not normally disclose information about you
  • Insurance Companies frequently ask for medical reports on prospective clients. These are always accompanied by your signed Consent Form. We will only disclose the relevant medical information as per your consent. You have the right, should you request it, to see reports prepared for Insurance Companies or employers before they are sent. We may contact you on receipt of a third party request to discuss your consent and clarify what will be shared
  • If you have any questions about the above points please contact the Practice.

Access to to your own information

  • Confirmation that your personal information is being held or used by us
  • Access to your personal information
  • Additional information about how we use your personal information

Although we must provide this information free of charge, if your request is considered unfounded or excessive, or if you request the same information more than once, we may charge a reasonable fee. 

If you would like to access your personal information, you can do this by submitting a written request to the Practice at the address shown at the top of this page.

Once we have received your request and you have provided us with enough information for us to locate your personal information, we will respond to your request without delay, within one month (30 days). However If your request is complex we may take longer, by up to two months, to respond. If this is the case we will tell you and explain the reason for the delay. 

Rights to object

You have the right under Article 21 of the GDPR to object to your personal information being processed. Please contact the Practice if you wish to object to the processing of your data. You should be aware that this is a right to raise an objection which is not the same as having an absolute right to have your wishes granted in every circumstance.

GP Practices process personal data under Article 6(1)(c) on a lawful and legitimate basis where the organisation is obliged under law to comply with

  • The General Data Protection Regulations (GDPR)
  • The Freedom of Information Act
  • The NHS Constitution
  •  The Local Authority Social Services and National HealthService Complaints (England) Regulations 2009
    By complying with these laws, the Practice has compelling legitimate grounds for the processing which override the interests, rights and freedoms in the right to object.

The right to rectification 

If the personal information we hold about you is inaccurate or incomplete you have the right to have this corrected.

If it is agreed that your personal information is inaccurate or incomplete we will aim to amend your records accordingly, normally within one month, or within two months where the request is complex. However, we will contact you as quickly as possible to explain this further if the need to extend our timescales applies to your request. Unless there is a risk to patient safety, we can restrict access to your records to ensure that the inaccurate or incomplete information is not used until amended.

If for any reason we have shared your information with anyone else, such as for a referral to another service, we will notify them of the changes required to ensure their records are accurate.  
If on consideration of your request we do not consider the personal information to be inaccurate then we will add a comment to your record stating your concerns about the information. If this is the case we will contact you within one month to explain our reasons for this.

Public Health

Public health encompasses everything from national smoking and alcohol policies, the management of epidemics such as flu, the control of large scale infections such as TB and Hepatitis B to local outbreaks of food poisoning or Measles. Certain illnesses are also notifiable; the doctors treating the patient are required by law to inform the Public Health Authorities, for instance Scarlet Fever.

This will necessarily mean the subjects personal and health information being shared with the Public Health organisations.

Some of the relevant legislation includes: the Health Protection (Notification) Regulations 2010 (SI 2010/659)the Health Protection (Local Authority Powers) Regulations 2010 (SI 2010/657) ,  the Health Protection (Part 2A Orders) Regulations 2010 (SI 2010/658) ,  Public Health (Control of Disease) Act 1984Public Health (Infectious Diseases) Regulations 1988 and The Health Service (Control of Patient Information) Regulations 2002

Public health encompasses everything from national smoking and alcohol policies, the management of epidemics such as flu, the control of large-scale infections such as TB and Hepatitis B to local outbreaks of food poisoning or Measles. Public Health England (PHE) monitors the numbers of certain infections that occur in healthcare settings through routine surveillance programmes and advises on how to prevent and control infection in establishments such as hospitals, care homes and schools.   In order to allow PHE to carry out accurate monitoring of infections, it may rely on information held by the Practice with regards to Healthcare Acquired Infections (HCAIs).   This will necessarily mean the subjects personal and health information being shared with the Public Health organisations.   Some of the relevant legislation includes:   Health Protection (Notification) Regulations 2010 (SI 2010/659) Health Protection (Local Authority Powers) Regulations 2010 (SI 2010/657) Health Protection (Part 2A Orders) Regulations 2010 (SI 2010/658) Public Health (Control of Disease) Act 1984 Public Health (Infectious Diseases) Regulations 1988 and The Health Service (Control of Patient Information) Regulations 2002  
1) Controller contact detailsQuay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact detailsDanielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingThere are occasions when medical data needs to be shared with Public Health England, the Local Authority Director of Public Health, or the Health Protection Agency, either under a legal obligation or for reasons of public interest or their equivalents in the devolved nations.  
4) Lawfulness Conditions and Special CategoriesThe legal bases will be under UK GDPR: Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject” and Article 9(2)(i) “processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices,..”  
5) Recipient or categories of recipients of the shared dataThe data will be shared with Public Health England https://www.gov.uk/government/organisations/public-health-england and equivalents in the devolved nations.  
6) Rights to objectYou have the right under Article 21 of the GDPR to object to your personal information being processed. Please contact the Practice if you wish to object to the processing of your data. You should be aware that this is a right to raise an objection which is not the same as having an absolute right to have your wishes granted in every circumstance.  
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a Court of Law.  
8) Retention periodThe data will be retained for active use during the period of the public interest and according to legal requirements and Public Health England’s criteria on storing identifiable data
https://www.gov.uk/government/organisations/public-health-england/about/personal-information-charter.  
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office. You can contact them at this link: https://ico.org.uk/global/contact-us/ or by calling their helpline on 0303 123 1113 (local rate) or 01625 545 745 (national rate). There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website).  
Private Healthcare Providers and Access to Medical Reports

Personal information shared with private health care providers in order to deliver direct care to patients at the patient’s request. Consent from the patient will be required to share data with Private Providers.

Legal Basis Consented and under contract between the patient and the provider

The Access to Medical Reports Act 1988 allows both employers and insurers to a request medical report from a GP. Employers and Insurers are required to seek a patient’s consent prior making a request and a patient must be informed of their right to withhold consent during the process. Where requests are made for copies of your medical records for insurance purposes, we will contact you to discuss the request and confirm you are happy for us to release the records. This is in line with guidance from the British Medical Association (BMA) and the Information Commissioners Office (ICO).   Patients may also request a copy of the report however, there are some exemptions to this right that can be applied in certain circumstances such as: Where serious harm to the physical or mental health of the individual or others or would indicate the intentions of the practitioner in respect of the individual.Where the report reveals information about another person, or reveals the identity of another person who has supplied information to the practitioner about the individual.  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact details    Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingTo provide the Employers and Insurers with a Medical Reports following the consent of the patient.
4) Lawful basis for processingThe legal basis will be Article 6(1)(a) “the data subject has given clear consent to the processing of his or her personal data for one or more specific purposes” And Article 9(2)(a)”the data subject has given explicit consent to the processing of those personal data for one or more specified purposes”  
5) Recipient or categories of recipients of the shared dataThe data will be shared with the specified employment or Insurance organisation or specified Officers. Patients may also request a copy of a report.
6) Rights to objectYou have absolute right to object to your information being shared for direct marketing. You have the right to object to some or all the information being shared with Employers or Insurers. Contact the Controller or the practice.
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention periodThe data will be retained for active use during the processing and thereafter according to NHS Policies and the law.
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/   or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website).
Reporting Gunshot and Knife Wounds
Patients may require treatment for injuries related to Gunshot and Knife wounds. In certain circumstances, a GP may need to share information with the local Police Force in order to safeguard others.   Wherever possible, patient consent will be obtained however, in limited circumstances, such as where gaining consent is impractical or if the public interest outweighs the patients’ rights, information may be shared without the patient’s knowledge.
1) Controller contact details  Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact details  Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingTo provide local Police Force with information relating Gunshot and Knife wounds for the protection of others.
4) Lawful basis for processingThe legal basis will be. Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”. And Article 9(2)(g) “processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject”.  
5) Recipient or categories of recipients of the shared dataThe data will be shared with the local Police Force.
6) Rights to objectYou have the right to object to some or all the information being shared with a local police force in certain circumstances. Contact the Controller or the practice.
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention periodThe data will be retained for active use during the processing and thereafter according to NHS Policies and the law.
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website).
Risk Stratification

‘Risk stratification for case finding’ is a process for identifying and managing patients who have or may be at-risk of health conditions (such as diabetes) or who are most likely to need healthcare services (such as people with frailty). Risk stratification tools used in the NHS help determine a person’s risk of suffering a particular condition and enable us to focus on preventing ill health before it develops.
Information about you is collected from a number of sources including NHS Trusts, GP Federations and your GP Practice. A risk score is then arrived at through an analysis of your de-identified information. This can help us identify and offer you additional services to improve your health. Risk-stratification data may also be used to improve local services and commission new services, where there is an identified need. In this area, risk stratification may be commissioned by the our NHS Clinical Commissioning Group (OCCG). Section 251 of the NHS Act 2006 provides a statutory legal basis to process data for risk stratification purposes.

Further information about risk stratification.

If you do not wish information about you to be included in any risk stratification programmes, please let us know. We can add a code to your records that will stop your information from being used for
this purpose. Please be aware that this may limit the ability of healthcare professionals to identify if you have or are at risk of developing certain serious health conditions.

The records we keep enable us to plan for your care.   This practice keeps data on you that we apply searches and algorithms to in order to identify from preventive interventions.  This means using only the data we hold or in certain circumstances linking that data to data held elsewhere by other organisations, and usually processed by organisations within or bound by contracts with the NHS.   If any processing of this data occurs outside the practice your identity will not be visible to the processors. Only this practice will be able to identify you and the results of any calculated factors, such as your risk of having a heart attack in the next 10 years or your risk of being admitted to hospital with a complication of chest disease.   You have the right to object to our processing your data in these circumstances and before any decision based upon that processing is made about you. Processing of this type is only lawfully allowed where it results in individuals being identified with their associated calculated risk. It is not lawful for this processing to be used for other ill-defined purposes, such as “health analytics”.   Despite this we have an overriding responsibility to do what is in your best interests. If we identify you as being at significant risk of having, for example a heart attack or stroke, we are justified in performing that processing in order to provide you with medical care.  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact detailsDanielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingThe practice performs computerised searches of some or all of our records to identify individuals who may be at increased risk of certain conditions or diagnoses i.e., Diabetes, heart disease, risk of falling).   Your records may be amongst those searched. This is often called “risk stratification” or “case finding”. These searches are sometimes carried out by Processors who link our records to other records that they access, such as hospital attendance records. The results of these searches and assessment may then be shared with other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care.
4) Lawfulness Conditions and Special CategoriesThe legal basis for this processing is Article 6(1)(e); “necessary… in the exercise of official authority vested in the controller’. And   Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”   We will recognise your rights under UK Law collectively known as the “Common Law Duty of Confidentiality” *  
5) Recipient or categories of recipients of the shared dataThe data will be shared for processing with any software supplier commissioned to complete risk stratification searches.
6) Rights to objectYou have the right to object to this processing where it might result in a decision being made about you. That right may be based either on implied consent under the Common Law of Confidentiality, Article 22 of GDPR or as a condition of a Section 251 approval under the HSCA. It can apply to some, or all of the information being shared with the recipients. Your right to object is in relation to your personal circumstances. Contact the Practice using the above details.
7) Right to access and correctYou have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention periodThe data will be retained in line with the law and national guidance. https://transform.england.nhs.uk/information-governance/guidance/records-management-code/
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
Safeguarding

The Practice is dedicated to ensuring that the principles and duties of safeguarding adults and children are holistically, consistently and conscientiously applied with the wellbeing of all, at the heart of what we do. 

Our legal basis for processing For the General Data Protection Regulation (GDPR) purposes is: –

            Article 6(1)(e) ‘…exercise of official authority…’. 

For the processing of special categories data, the basis is: –

Article 9(2)(b) – ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’

Some members of society are recognised as needing protection, for example children and adults with care and support needs (adult hereafter). Safeguarding is the action that is taken to promote the welfare and protect children/ adult from harm. If a child/ adult is suffering or likely to suffer significant harm, professionals have a statutory responsibility to protect them. This statutory responsibility is enshrined within the Care Act 2014, Children Acts 1989 & 2004 & Social Care Act 2014.    Where there is a suspected or actual safeguarding issue professionals should aim to gain agreement to share information but should be mindful of situations where to do so would place a child/ adult at increased risk of harm. Information may be shared without agreement if a professional has reason to believe that there is good reason to do so, and that the sharing of information will enhance safeguarding.  When decisions are made to share or withhold information, practitioners should record who has been given the information and why.   This is covered in the following legislation guidance: The Mental Capacity Act 2005  http://www.legislation.gov.uk/ukpga/2005/9/contents Section 47 of The Children Act 1989 :
(https://www.legislation.gov.uk/ukpga/1989/41/section/47), Section 18 Schedule 1 Part 2 of Data Protection Bill 2018 (https://www.legislation.gov.uk/) and Section 45 of the Care Act 2014 http://www.legislation.gov.uk/ukpga/2014/23/section/45/enacted.   For children where who are identified as Child In Need professionals are required to seek consent in regards to sharing information. The relevant guidance is covered; Section 17 Children Act 1989 https://www.legislation.gov.uk/ukpga/1989/41/section/17  
1) Controller contact details  Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]
2) Data Protection Officer contact details  Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the processingThe purpose of the processing is to protect the child or vulnerable adult.
4) Lawful basis for processingThe sharing is a legal requirement to protect vulnerable children or adults, therefore for the purposes of safeguarding children and vulnerable adults, the following UK GDPR Article 6 conditions apply:   Article 6(1)(e) “for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”;   Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject”.   And the following Article 9 condition for processing special category personal data:   Article 9(2)(b) “…is necessary for the purposes of carrying out the obligations and exercising the specific rights of the controller or of the data subject in the field of …social protection law in so far as it is authorised by Union or Member State law.”   We will consider your rights established under UK case law collectively                             known as the “Common Law Duty of Confidentiality” *.
5) Recipient or categories of recipients of the shared dataThe data will be shared with the Nursing Directorate Safeguarding teams and other organisations such as police, NHS or Local Authority where deemed necessary.
6) Rights to objectThis sharing is a legal and professional requirement and therefore there is no right to object. There is also GMC guidance for adult and child safeguarding: https://www.gmc-uk.org/guidance/ethical_guidance/children_guidance_56_63_child_protection.asp https://www.gmc-uk.org/ethical-guidance/ethical-hub/adult-safeguarding
7) Right to access and correctThe Data Subjects or their legal representatives have the right to access the data that is being processed or shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.
8) Retention periodThe data will be retained for active use during any investigation and thereafter retained in an inactive stored form according to the law and national guidance
9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
Sending Messages to the Practice and Other Communication

When you contact us, whether by telephone, through our website or by e-mail, we collect the data you have given to us in order to reply with the information you need. We record your request and our reply in order to increase the efficiency of our Practice. We keep personally identifiable information associated with your message, such as your name and email address so as to be able to track our communications with you to provide a high quality service.

This Practice will contact patients at times in relation to services, feedback and new initiatives in the area that they have registered an interest in.   We collect and store information that has been received directly from you when you have consented to this process. We may share information with the following organisations with your explicit consent or when the law allows. You have the right to object to your identifiable information being used or shared for this purpose. Please speak to the Practice if you no longer wish to have your data used or be contacted by the Practice in future.  
1) Controller contact details    Quay Health Solutions 50 Old Jamaica Road London SE16 4BN. Tel 0203 883 1620 [email protected]  
2) Data Protection Officer contact details  Danielle Gibbons GP Data Protection Officer [email protected]
3) Purpose of the sharingPublic Task  
4) Lawfulness ConditionsThe lawful justifications for the processing and possible sharing of this data are –   Article 6(1)(a)the data subject has given consent to the processing of his or her personal data for one or more specific purposes”.
5) Recipient or categories of recipients of the shared dataThe data will not be shared without your explicit consent or when the law allows.
6) Rights to objectYou do not have to consent to the Practice being able to contact you. You can change your mind and withdraw your consent at any time. Contact the Controller for more information.  
7) Right to access and correctYou have the right to access any identifiable data that is being shared and have any inaccuracies corrected.
8) Retention periodThe data will be retained for the period as specified in the national records retention schedule.

9)  Right to Complain.You have the right to complain to the Information Commissioner’s Office, you can use this link https://ico.org.uk/make-a-complaint/data-protection-complaints/ or calling their helpline Tel: 0303 123 1113 (local rate) or 01625 545 745 (national rate) There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website)
Sharing of Information

Local Information Sharing

Your GP electronic patient record is held securely and confidentially on an electronic system managed by your registered GP Practice. If you require attention from a local Healthcare Professional outside of your usual practice services, such as in an Evening and Weekend GP Access Clinic, GP Federation Service, Emergency Department, Minor Injury Unit or Out Of Hours service, the professionals treating you are better able to give you safe and effective care if some of the information from your GP record is available to them.

Where available, this information can be shared electronically with other local healthcare providers via a secure system designed for this purpose. Depending on the service you are using and your health needs, this may involve the Healthcare Professional accessing a secure system that enables them to view parts of your GP electronic patient record ,or a secure system that enables them to view your full GP electronic patient record (e.g. EMIS remote consulting system).

In all cases, your information is only accessed and used by authorised staff who are involved in providing or supporting your direct care. Your permission will be asked before the information is accessed, other than in exceptional circumstances (e.g. emergencies) if the Healthcare Professional is unable to ask you and this is deemed to be in your best interests (which will then be logged).

Disclosure and sharing of your information

Information we obtain from third parties

We sometimes receive data that is indirectly made up from your personal information from third parties whose services we use. No such information is personally identifiable to you.

Information provided on the understanding that it will be shared with a third party

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the new information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that Health and Social Care Professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles. They should be supported by the policies of their employers, regulators and professional bodies.

Who are our partner organisations?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;

  • NHS Trusts / Foundation Trusts
  • GPs
  • eMBED Health
  • NHS Commissioning Support Units
  • Independent Contractors such as Dentists, Opticians & Pharmacists
  • Private Sector Providers
  • Voluntary Sector Providers
  • Ambulance Trusts
  • Clinical Commissioning Groups
  • Social Care Services
  • Health and Social Care Information Centre (HSCIC)
  • NHS England (NHSE) and NHS Digital (NHSD)
  • Local Authorities
  • Education Services
  • Fire and Rescue Services
  • Police & Judicial Services
  • Voluntary Sector Providers
  • Private Sector Providers
  • Other ‘data processors’ which you will be informed of

You will be informed who your data will be shared with and in some cases asked for explicit consent for this to happen, when required.

We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure.

What to do if you don’t want your information shared

Please tell us if you don’t want your information to be shared – either in some or all circumstances. We can make a note on your record that will ensure that your records can only be accessed by a health professional in the Practice (i.e. no administrative staff will be able to look at your records) or we can block your health data so that it can’t be accessed by other health service bodies e.g. Electronic Care Record.

Information submitted online

The practice website allows for the submission of some personal information for the purposes of updating your medical record e.g. new contact details. The service is provided by accredited suppliers, and all information submitted is covered by the same regulations as all other patient information.

Patient Rights (as the Data Subject)The right to erasure

The right to erasure is also known as “the right to be forgotten” and in general refers to an individual’s right to request the deletion or removal of personal information where there is no compelling reason for the Practice to continue using it.

As with other rights, there are particular conditions around this right and it does not provide individuals with an absolute right to be forgotten.

Individuals have the right to have their personal information deleted or removed in the following circumstances:

  • When it is no longer necessary for the purpose for which it was collected
  • When the Practice no longer have a legal basis for using you your personal information, for example if you gave us consent to use your personal information in a specific way, and you withdraw your consent, we would need to stop using your information and erase it unless we had an overriding reason to continue to use it
  • When you object to the Practice using your personal information and there is no overriding legitimate interest for us to continue using it.
  • If we have used your personal information unlawfully
  • If there is a legal obligation to erase your personal information for example by court order

The Practice can refuse to deal with your request for erasure when we use your personal information for the following reasons:

  • to comply with a legal obligation for the performance of a public interest task or exercise of official authority
  • for public health purposes in the public interest
  • archiving purposes in the public interest, scientific research historical researchor statistical purpose
  • the exercise or defence of legal claims

The right to restrict processing

You have the right to control how we use your personal information in some circumstances. This is known as the right to restriction. When processing is restricted, the Practice is permitted to store your personal information, but not further use it until an agreement is reached with you about further processing. We can retain enough information about you to ensure that your request for restriction is respected in the future.

Examples of ways you can restrict our processing would be:

  • If you challenge the accuracy of your personal information, stop using it until we check its accuracy 
  • If you object to processing which is necessary for the performance of our tasks in the public interest or for the purpose of legitimate interests, we will restrict our processing while we consider whether our legitimate grounds override your individual interests, rights and freedoms 
  • If our use of your personal information is found to be unlawful and you ask for restriction instead of full erasure we will restrict our processing
  • If we no longer need your personal information but you need it to establish, exercise or defend a legal claim, we will restrict our processing.

If we have shared your personal information with any individuals or organisations, if we restrict our processing, we will tell those individuals or organisations about our restriction if it is possible and not an unreasonable amount of effort.
Whenever we decide to lift a restriction on processing we will tell you.

Direct Care Emergencies

There are occasions when intervention is necessary in order to save or protect a patient’s life or to prevent them from serious immediate harm, for instance during a collapse or diabetic coma or serious injury or accident. In many of these circumstances the patient may be unconscious or too ill to communicate.

In these circumstances we have an overriding duty to try to protect and treat the patient. If necessary we will share your information and possibly sensitive confidential information with other emergency healthcare services, the police or fire brigade, so that you can receive the best treatment.

The NHS Care Record Guarantee

The NHS Care Record Guarantee for England sets out the rules that govern how patient information is used in the NHS, what control the patient can have over this, the rights individuals have to request copies of their data and how data is protected under the Data Protection Act 2018.

NHS digital looking after information and data

The NHS Constitution

The NHS Constitution establishes the principles and values of the NHS in England. It sets out the rights patients, the public and staff are entitled to. These rights cover how patients access healthcare services, the quality of care received, the treatments and programmes available, confidentiality, information and a patient’s right to complain if things go wrong.

Third Parties mentioned on your Medical Record

Sometimes we record information about third parties mentioned by you to us during any consultation. We are under an obligation to make sure we also protect that third party’s rights as an individual and to ensure that references to them which may breach their rights to confidentiality, are removed before we send any information to any other party including yourself. Third parties can include: spouses, partners, and other family members.

Use of Information

Use of information we collect through automated systems when you visit our website

Cookies

Cookies are small text files that are placed on your computer’s hard drive by your web browser when you visit any website. They allow information gathered on one web page to be stored until it is needed for use on another, allowing a website to provide you with a personalised experience and the website owner with statistics about how you use the website so that it can be improved.

Some cookies may last for a defined period of time, such as one day or until you close your browser. Others last indefinitely.

Your web browser should allow you to delete any you choose. It also should allow you to prevent or limit their use.

Our website uses cookies. They are placed by software that operates on our servers, and by software operated by third parties whose services we use.

If you choose not to use cookies or you prevent their use through your browser settings, you will not be able to use all the functionality of our website.

We use cookies in the following ways:

  • to track how you use our website
  • to record whether you have seen specific messages we display on our website
  • to keep you signed in our site
  • to record your answers to surveys and questionnaires on our site while you complete them

Personal identifiers from your browsing activity

Requests by your web browser to our servers for web pages and other content on our website are recorded.

We record information such as your geographical location, your Internet service provider and your IP address. We also record information about the software you are using to browse our website, such as the type of computer or device and the screen resolution.

We use this information in aggregate to assess the popularity of the webpages on our website and how we perform in providing content to you.

If combined with other information we know about you from previous visits, the data possibly could be used to identify you personally, even if you are not signed in to our website.

Data may be processed outside the European Union

Our website is hosted in the United Kingdom.

We may also use outsourced services in countries outside the European Union from time to time in other aspects of our business.

Accordingly data obtained within the UK or any other country could be processed outside the European Union.

For example online patient forms on our website are encrypted and delivered securely to the NHS system by an email service provider based in the United States of America. Their systems comply with provisions certified under the EU-U.S. and Swiss-U.S. Privacy Shield frameworks, a mechanism for cross border transfer of personal data.

Video and Telephone Consultations

As an alternative to face to face appointments, there may be instances where we may offer you an appointment via telephone or video consultation. By accepting the invitation and entering the consultation you are consenting to this. Your personal/confidential patient information shared on the consultation will be safeguarded in the same way it would with any other consultation with relevant information added to your patient record.

Video or audio consultations/appointments are not typically recorded, but if are, your permission will be sought as to the purpose and use of the recording i.e.: for direct care purposes: diagnosis, treatment or care. Recordings will be stored as part of your patient record in line with NHS Digital Record Management Code of Practice (2016).

If, as part of the consultation, still images or photographs are taken/obtained and are to be kept, they will be securely stored as part of your patient record in line with NHS Digital Record Management Code of Practice (2016).

If the recording/images are to be used for any other reason than what the original permission was obtained for, then further permission would be required prior to that use.

If recordings or still images obtained are no longer needed (i.e.: adequately described in the clinical notes) then the recording/ images will be confidentially and securely destroyed as per our policies and in line with NHS Digital’s guidance.

Your Data

Your health records contain a type of data called confidential patient information. This data can be used to help with research and planning.

You can choose to stop your confidential patient information being used for research and planning. You can also make a choice for someone else like your children under the age of 13

To find out more about the benefits of data sharing, how data is protected, or to make/change your opt-out choice visit NHS your data matters.

Your Rights

The right of access

Individuals have the right to access their personal data and a request can be made verbally or in writing. We have one month to respond to a request and in most circumstances we cannot charge a fee. Please refer to our Subject Access Request section for further information.

The right to rectification

The GDPR includes a right for individuals to have inaccurate personal data rectified or completed if it is incomplete. We have one month to respond to a request and in some circumstances, we may refuse this request.

The right to data portability

The right to data portability allows individuals to obtain and re-use their personal information for their own purposes across different services. It allows them to move, copy or transfer personal information easily from one IT environment to another in a safe and secure way. For example: it enables consumers to take advantage or applications and services which can use their information to find them a better deal.The right to data portability only applies when the individual has submitted their personal information directly, through electronic means to our Practice.This means that in most circumstances the right to data portability does not apply within the Practice.

Rights related to automated decision making and profiling

You have the right to object to any instances where a decision is made about you solely by automated means without any human involvement, including profiling.

The Practice does not undertake any decision-making about you using wholly automated means.

Invoking your rights

If you wish to invoke any of the data subject rights then please write to The Practice Manager, at the above address.

What is GDPR?

The GDPR is the replacement for the Data Protection Act and comes into effect on the 25th of May 2018. Although it is European legislation the UK will be adopting GDPR into UK law even after Brexit. This youtube video helps explain some of the changes with the GDPR.

Further Information – Understanding Patient Data

Understanding Patient Data’ supports better conversations about the uses of health information. Our aim is to explain how and why data can be used for care and research, what’s allowed and what’s not, and how personal information is kept safe. We work with patients, charities and Healthcare Professionals to champion responsible use of data.

Review of this Privacy Policy

We may update this Privacy Notice from time to time as necessary. The terms that apply to you are those posted here on our website on the day you use our website. We advise you to print a copy for your records.

If you have any question regarding our Privacy Policy, please contact us.