Data Privacy

COVID-19

This practice is supporting vital coronavirus (COVID-19) planning and research by sharing your data with NHS Digital. For more information about this see:  https://digital.nhs.uk/coronavirus/gpes-data-for-pandemic-planning-and-research/general-practice-transparency-notice

Your data, privacy and the Law. How we use your medical records

• This practice handles medical records according to the laws on data protection and confidentiality.
• We share medical records with health professionals who are involved in providing you with care and treatment. This is on a need to know basis and event by event.
• Some of your data is automatically copied to the Shared Care Summary Record.
• We share some of your data with the out of hours GP service.
• Data about you is used to manage national screening campaigns such as Flu, cervical cytology and diabetes prevention.
• Data about you, usually de-identified, is used to manage the NHS and make payments.
• We share information when the law requires us to do, for instance when we are inspected or reporting certain illnesses or safeguarding vulnerable people.
• Your data is used to check the quality of care provided by the NHS.
• We may also share medical records for medical research

Below are the full privacy notices for various aspects of your NHS care, click the links to view or download them

• Direct care
• Summary Care Record sharing
• National screening programmes
• Legal requirements to share data
• Medical research and clinical audit activity
  During COVID-19 there is additional activity: NHS Digital’s legal power to collect the data is provided under COVID-19 Public Health Directions and the data will be collected and managed in accordance with NHS Digital’s strict information governance and security protocols. The data collection will continue until 30 September 2020 and will be reviewed before then. If there is a continued need for the data for COVID-19 purposes it will continue with six monthly reviews until the expiry of the Direction which is currently 31 March 2022.

Subject access requests (SARs)

You have the right, under the General Data Protection Regulation (EU) 2016/679 (Articles 12 and 15) and Data Protection Act to request access to, or a copy of, information we hold about you.  We may hold computer only records, or a combination of paper and computer records.  

You may make a verbal or written request to our practice to access information we hold about you.  Please speak with the Care Navigator Team.

We have 28 days in which to respond to your request unless we feel it will take longer, but if that is the case we will let you know within 28 days how long we expect it will take.

In most cases there is no fee for providing you with a copy of your data. However, in accordance with the law we may charge a ’reasonable fee’ for the administrative costs of complying with a request if an individual requests further copies of their data following a previous SAR, or it is "either manifestly unfounded or excessive". This is because there is considerable administrative time required to vet all of the data leaving the practice to ensure that it does not contain any references to third parties, or any other harmful information.