Privacy Notice

The GP Practice Privacy Notice

This practice is supporting vital health and care planning and research by sharing your data with NHS Digital. For more information about this see the GP Practice Privacy Notice for General Practice Data for Planning and Research.

NHS Digital have created an animation for patients that explains what data is being collected and why.

Why we need your personal information

We collect information about you mainly to provide you with health and care services. This is in accordance with the statutory obligations under the NHS Act 2006 and Health and Social Care Act 2012.  

The information we collect is used for medical purposes that include:

• preventative medicine
• medical diagnosis
• medical research
• provision of direct care and treatment

We collect your personal information so that your care team has accurate and up-to-date information to plan your treatment options.

The new data protection law

The General Data Protection Regulation (GDPR) is a new law which allows and regulates the processing of personal data for health and social care, where data are processed by a public authority, such as this organisation. 

Health, social care and genetic data are amongst special categories of data requiring special protection and subject to additional controls.

Integrating your care with our partners

Health and care partners in south east London, such as your GP, hospitals, and mental health, community and social care services, work together to make best use of your personal data to improve your treatment and care. This collaborative work helps us to build a more complete picture of all your health and care needs. 

You can read the full privacy statement from Our Healthier South East London here

South East London Integrated Care Records (Local Care Record in Southwark, Lambeth and Bromley) (Connect Care in Lewisham, Greenwich, and Bexley)

Integrated care records in south east London securely connect the electronic health record systems in your GP practice with similar systems in other care settings. These include south east London hospitals, care professionals in urgent and emergency care services (such as NHS 111 or 999), the London Ambulance Service and the National Record Locator Service, which is run by the NHS in England.

Integrating your care records means that your care teams can view your medications, previous treatments, test results and any other relevant care information at the touch of a button. This improves communication between your health and care providers, making best use of clinical resources during your appointments or hospital stay.

Sharing health records is helping to improve your care by providing your care team with essential clinical information at the touch of a button. This reduces the need for repeated phone calls and delayed letters.

Find more information about the integrated care records in south east London, including how to opt out of this form of data sharing.

Other uses of your personal information

Using information for commissioning or regulatory compliance

Commissioning is when organisations plan and pay for health care services. Health and care commissioners need information from your GP practice, hospitals and other care providers about your treatment to review and plan health services. To do this, they need to be able to see information about your care but they do not need to know who you are.

The commissioners use intermediary services called Data Services for Commissioners Regional Office (DSRCO). DSRCOs specialise in analysing and converting coded clinical information within a secure environment into a format that commissioners can legally use. This is specific data about your care that does not reveal your identity or contact details.

NHS Digital, formally known as the Health and Social Care Information Centre (HSCIC), can provide coded data about your care securely to commissioners under the Health and Social Care Act (2012).

NHS Digital, through its DSCROs, is allowed by law to collect, hold and process your personal data. This is for purposes beyond direct patient care, to support care commissioning organisations and the commissioning functions within local authorities.  

Service evaluation contributes to the overall quality and effectiveness of clinical services to you and a group of people with a similar condition. This routine quality assessment of care services falls outside the scope of your direct care. It covers:

• care services management
• preventative care and medicine
• health and social care research

Service evaluations are routinely undertaken using anonymised data. Where identifiable information is to be used, the NHS will always do it lawfully and securely in a way that will always protect your privacy.

Using information for research

Our practice works with researchers to find ways to develop better treatments for care. The information in your health records can also be used to help NHS researchers understand more about the causes of illnesses and how best to treat them. They need to follow strict rules to make sure your personal data is always kept secure and confidential.

Where possible, researchers will make efforts to take out any information that could identify you, such as your name, address and postcode. If they cannot practically take out such information, it is their legal responsibility to ask for your explicit permission (consent).

Health services work with researchers and technical experts to develop computer systems and encryption techniques, such as pseudonymisation (using special codes), to enhance your privacy and protect your confidentiality before using your information for research. For more information on such local research systems and initiatives, visit the King’s Health Partners website.

In more exceptional cases, researchers may seek special support from the Secretary of State under the health service (control of patient information) regulations (also known as ‘section 251 support’). This can allow researchers to use your personal data without your permission, only when it is not practical to do seek permission. They must also have reassured an independent committee who have reviewed the purpose and data security arrangements. You can find more information on trials where researchers have used this special support known as ‘section 251’ support.

Research recruitment

You can give your care coordinator an advance permission for researchers to contact you in the future if you match the criteria of a trial. Your advance permission, known as ‘consent for contact’ will be noted in your health records. You will only hear from a research nurse, who will explain what that study will entail in more detail.

Clinical data linkages

Partnerships between care providers, such as between your GP practice and NHS hospitals and universities is leading to better opportunities to use clinical data for better care services and treatments by securely joining or ‘linking’ information from different clinical sources within a secure and regulated NHS environment. This joins two or more independent healthcare data sources, for example someone’s GP record and their hospital record, in order to improve the quality of information and to enable NHS researchers to look at your healthcare in more detail.  Any information that may identify individuals are all removed prior to any researchers.

Your legal rights

You have several rights under the data protection law:

a. Right to be informed: you have a right to be informed about uses of your information, with an emphasis on transparency. This fair processing notice, in support of other privacy notices makes sure that your right to be informed is upheld.

b. Right of access: you have a right to receive:

• confirmation of what information is recorded about you
• confirmation of how your information is used
• access to your personal health information and other information we hold

To exercise your right of access, you will be asked to complete a subject access request (SAR) form, provide proof of identification and may be asked to explain exactly what information you require.

Your request must be made in writing addressed to the practice. Please hand this to our receptionists. If you have a query about access to your reocrds, please ask to speak to our reception supervisor who is responsible for coordinating these requests.

We deal with subject access requests without undue delay, but are required to act on them within 1 month of the request being made. The NHS target is to respond within 20 days. In exceptional circumstances we can extend the time to respond by a further two months if the request is complex or we have received a number of requests from the individual.

You will not be charged for this service.

Other people can also apply to access your health records on your behalf. These include anyone authorised by you in writing (such as a solicitor), or any person appointed by a court to manage your affairs if it decides you cannot manage them yourself.

c. Right to rectification: rectification means correcting inaccuracies or incomplete data we hold about you. This often applies to factual information only such as identifiers and next of kin. We are unable to remove or alter professional opinions that you may disagree with. You do however have the right to include your personal statements alongside professional opinions.

• To rectify your information please contact your clinical team.

d. Right to deletion: in some circumstances you can request that we delete the information we hold about you. This right will apply only if the processing has been based on consent which is withdrawn, the processing of data is found not to be lawful or the information is no longer required. We will tell you about activities to which this right applies

There are exceptions to the right to deletion. Your health and care providers are legally required to maintain your records in accordance with the retention guide in the Record management code of practice for health and social care

e. Right to object: you do not have a general right to object to processing of your personal information for your individual care, however you can object if the information is used for a secondary purpose, such as:

• marketing
• scientific or historical research
• statistical purposes
• purposes in the public interest or under an official authority (eg NHS Act 2006)
• public patient involvement groups

f. Right to restrict processing: the right to restrict processing means that, if you have disputed the accuracy of information, objected to its use or require data due for destruction to be maintained for a legal claim, you can have the data stored by the Trust but not allow other uses until the dispute is settled. To request restriction to processing, please contact the data protection officer.

We will respect your rights under the data protection legislation whether you are an adult or a child. We will respects the wishes of parents’ (or legal guardians’) in respect of data rights of children who are younger than 14 years old.

You should also tell us how you would like us to contact you. Your preferences may include post, text messaging and phone. You should notify your care team about your preferences and ask it to be recorded in your health and care record. You can change your mind later as long as you give timely notifications to your care team about any changes to your preferences.

If you want to complain

If you think that information in your NHS health records is wrong, please talk to the doctor looking after you and ask to have the record amended. You can also ask for the information to be amended by contacting our practice manager.

If your request to have your records amended is turned down because the information is not wrong, we will add a statement of your views to the record.

If you are unhappy with our response, you have the right to complain to the Information Commissioner’s Office (ICO), which regulates and enforces the Data Protection Act. For details of how to do this:

• visit the ICO website
• telephone 0303 123 1113

Further information

Please talk to a member of our team if you want to know more about how we use your health records or if you do not want your information used in any of the ways described here.