Practice Privacy Notice

Abbey Road Medical Practice has a legal duty to explain how we use any personal information we collect about you at the organisation. We collect records about your health and the treatment you receive in both electronic and paper format.

Why do we have to provide this privacy notice?

We are required to provide you with this privacy notice by law. It provides information about how we use the personal and healthcare information we collect, store and hold about you. If you have any questions about this privacy notice or are unclear about how we process or use your personal information or have any other issue regarding your personal and healthcare information, then please contact our Data Protection Officer

GP DPO Service

Itservicedesk.nelicb@nhs.net

0300 303 6778

The main things the law says we must tell you about what we do with your personal data are:

We must let you know why we collect personal and healthcare information about you

We must let you know how we use any personal and/or healthcare information we hold about you

We need to inform you in respect of what we do with it

We need to tell you about who we share it with or pass it on to and why

We need to let you know how long we can keep it for

Using your information

We will use your information so that we can check and review the quality of care we provide. This helps us improve our services to you.

We will share relevant information from your medical record with other health or social care staff or organisations when they provide you with care. For example, your GP will share information when they refer you to a specialist in a hospital or your GP will send details about your prescription to your chosen pharmacy.

More information on how we share your information with organisations who are directly involved in your care can be found here: NHS England » Joining up and sharing health and care data

Healthcare staff working in A&E and out of hours care will also have access to your information. For example, it is important that staff who are treating you in an emergency know if you have any allergic reactions. This will involve the use of your Summary Care Record. For more information see: NHS Digital’s Summary Care Record

You have the right to object to information being shared for your own care. Please contact the practice if you wish to object. You also have the right to have any mistakes or errors corrected.

Registering for NHS care

All patients who receive NHS care are registered on a national database (NHS Spine). The Spine is held and maintained by NHS Digital, a national organisation which has legal responsibilities to collect NHS data.

More information can be found at NHS Digital – Spine

Use of Artificial Intelligence (AI)

Artificial Intelligence (AI) use is the biggest and fastest moving change to computing in recent years and is becoming commonplace across all industries including primary care. With this being new technology, there is a requirement for additional governance measures to ensure its use is safe and does not expose personal data about both patients and staff to any unnecessary risks. Examples of AI use include:

Generation of business meeting notes and any action points

Support for clinicians during consultations to compile and document medical records

Generation of summaries of various team meetings when service users and patient cases are discussed

Prior to introducing AI tools and in support of the Data Protection Impact Assessment (DPIA), this organisation will assess the following:

Purpose
Necessity
Proportionality
Lawful basis
Confidentiality
Security
Supplier arrangements
Data location
Retention
Access
Transparency
Risks

Identifying patients who might be at risk of certain diseases

Your medical records will be searched by a computer programme so that we can identify patients who might be at high risk from certain diseases such as heart disease or unplanned admissions to hospital. This means we can offer patients additional care or support as early as possible.

This process will involve linking information from your GP record with information from other health or social care services you have used. Information which identifies you will only be seen by this organisation.

Please contact the practice for more information.

Statutory Disclosures when consent is not required

There are circumstances when we may be required or permitted to disclose information without obtaining the consent of a person and this includes:

Safeguarding

Preventing or detecting serious crime

Public health requirements

Notification of certain infectious diseases

Statutory reporting

Court orders and/or legal obligations

Requests from regulatory authorities

Investigations by authorised bodies

Coroners’ investigations

Fraud prevention

When disclosure is necessary to protect someone from serious harm

When disclosure is otherwise authorised by law

The National Health Service Act 2026 at Section 251 together with the Health Service (Control of Patient Information) Regulations 2002 provide statutory mechanisms in certain circumstances for confidential patient information to be used without consent.

It should be noted that we will only disclose information that is relevant and proportionate to the circumstances.

Safeguarding

Sometimes we need to share information so that other people, including healthcare staff, children or others with safeguarding needs, are protected from risk of harm. These circumstances are rare and we do not need your consent or agreement to do this.

Children and young people

Children have rights concerning their personal information. At this organisation, we will always consider:

The child’s age

Maturity

Their understanding

Capacity

Confidentiality

Parental responsibility

The child’s best interests

Safeguarding considerations

When a young person is considered competent to make decisions about their healthcare, confidentiality will normally be respected. A parent or person with parental responsibility does not automatically have an unrestricted right to access a child’s medical information and as detailed within the organisation’s Consent Guidance.

Further reading can be found in NHS England’s guidance titled Children and young people, CQC GP mythbuster 8: Gillick competency and Fraser guidelines

People who lack capacity

When a person is considered to lack capacity to make a particular decision, information will be handled in accordance with the organisation’s Mental Capacity Act Policy and Safeguarding policy to ensure the best interests of the patient are always considered.

Deceased patients

Whilst confidentiality continues after death, the Data Protection Act 2018 and subsequently the UK GDPR only refers to living individuals. As such, for deceased persons, access to their information is a request under the Access to Health Records Act 1990 (AHRA).

Medical research

This organisation shares information from medical records to support medical research when the law allows us to do so, for example to learn more about why people get ill and what treatments might work best. We will also use your medical records to carry out research within the organisation.

The use of information from GP medical records is very useful in developing new treatments and medicines; medical researchers use information from these records to help to answer important questions about illnesses and disease so that improvements can be made to the care and treatment patients receive.

We share information with medical research organisations with your explicit consent or when the law allows.

You have the right to object to your identifiable information being used or shared for medical research purposes. Please contact the practice if you wish to object.

Checking the quality of care – national clinical audits

This organisation contributes to national clinical audits so that healthcare can be checked and reviewed. Information from medical records can help doctors and other healthcare workers to measure and check the quality of care that is provided to you.

The results of the checks or audits can show where organisations are doing well and where they need to improve. These results are also used to recommend improvements to patient care.

Data is sent to NHS Digital, a national body with legal responsibilities to collect data.

The data will include information about you, such as your NHS Number and date of birth, and information about your health which is recorded in coded form – for example the code for diabetes or high blood pressure.

We will only share your information for national clinical audits or checking purposes when the law allows.

You have the right to object to your identifiable information being shared for national clinical audits. Please contact the practice if you wish to object.

We are required by law to provide you with the following information about how we handle your information:

Data Controller	Dr Subir Sen & Ghazala Jarwar (Practice Manager) Telephone 02085342515
Data Protection Officer	North East London ICB Email: itservicedesk.nelicb@nhs.net Telephone: 0300 303 6778
Purpose of the processing	To give direct health or social care to individual patients. For example, when a patient agrees to a referral for direct care, such as to a hospital, relevant information about the patient will be shared with the other healthcare staff to enable them to give appropriate advice, investigations, treatments and/or care. To check and review the quality of care. (This is called audit and clinical governance). Medical research and to check the quality of care that is given to patients (this is called national clinical audit)
Lawful basis for processing	These purposes are supported under the following sections of the GDPR: *Article* *6(1)(e)* ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’; and *Article 9(2)(h)* ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…” The following sections of the GDPR mean that we can use medical records for research and to check the quality of care (national clinical audits) *Article 6(1)(e)* – ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’. Healthcare staff will also respect and comply with their obligations under the common law duty of confidence.
Recipient or categories of recipients of the processed data	The data will be shared with: Healthcare professionals and staff at this surgery Local hospitals Out of hours services Diagnostic and treatment centres Other organisations involved in the provision of direct care to individual patients
Right to object and the national data opt-out	You have the right to object to information being shared between those who are providing you with direct care. This may affect the care you receive – please speak to the practice. You are not able to object to your name, address and other demographic information being sent to NHS Digital. This is necessary if you wish to be registered to receive NHS care. You are not able to object when information is legitimately shared for safeguarding reasons. In appropriate circumstances, it is a legal and professional requirement to share information for safeguarding reasons. This is to protect people from harm. The information will be shared with the local safeguarding service. Type 1 Opt–out – This is to stop identifiable or confidential information held in a patient’s GP record being disclosed outside this organisation for purposes other than their individual care. Further information can be found at Opt out of sharing your health records The national data opt-out model provides an easy way for you to opt-out of information that identifies you being used or shared for medical research purposes and quality checking or audit purposes. Please contact the practice if you wish to opt-out. Further information is available from NHS England.
Right to access and correct	You have the right to access your medical record and have any errors or mistakes corrected. Please speak to a member of staff for more information or look at our Access to Medical Records Policy on the organization’s website. We are not aware of any circumstances in which you will have the right to delete correct information from your medical record although you are free to obtain your own legal advice if you believe there is no lawful purpose for which we hold the information and contact us if you hold a different view.
Retention period	Records will be kept in line with the law and national guidance. Information about how long records are kept can be found in the Records Management Code of Practice.
Right to complain	You have the right to complain to the Information Commissioner’s Office. If you wish to complain, follow this link or call the helpline 0303 123 1113
Data Breaches	A personal data breach means a breach of security leading to the destruction, loss, alteration, unauthorised disclosure of, or access to, personal data. Should a data breach be suspected, then all staff must report this as soon as practicable and within 24 hours of the incident being identified.
Data we get from other organisations	We receive information about your health from other organisations that are involved in providing you with health and social care. For example, if you go to hospital for treatment or an operation the hospital will send us a letter to let us know what happened. This means your GP medical record is kept up-to date when you receive care from other parts of the health service.