Practice Team

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share);

Common Law of Duty of Confidentiality

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Emergency Services (Ambulance trusts, police, A&E departments, out of hours services, 111)

There are circumstances when intervention is necessary in order to save or protect a patient’s life or to prevent them from serious immediate harm, for example, during a collapse or diabetic coma or serious injury or accident. In many of these circumstances the patient may be unconscious or too ill to communicate.

Medical professionals have a duty of care to share data in emergencies to protect their patients or other persons. In these circumstances, your GP medical record will be shared with emergency healthcare services, the police or fire service in order to enable you receive the best treatment or service.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care.

The processing of personal data is permitted under the following paragraphs:

Article 6(1) (c) - processing for legal obligation;

Article 6(1) (d) – the processing is necessary in order to protect the vital interests of the data subject

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2) (C) – theprocessing is necessary to protect the vital interests of the data subject

Related Legislation:

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share);

Article 6(1) (e) - public interest or in the exercise of official authority.

You have the right to:

Make pre-determined decisions about the type and extent of care you will receive in an emergency, these are known as “Advance Directives”;
access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have the right to object to some or all of your personal information being shared with the recipients. You also have the right to have an “Advance Directive” placed in your records and brought to the attention of relevant healthcare workers or staff.

We will notify you at the earliest opportunity where we have shared your personal data in an emergency situation.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

GP Federations and Primary Care Networks (groups of Practices working together, and with other providers, to provide joined-up and effective care)

North London Partners

GP Federations are groups of GPs (patient centered organisation), working collaboratively and developing closer integration with other partners across health, social and third sector partners to facilitate an enhanced delivery of health and care services.

Primary Care Networks (PCNs) are similar, but are led at the GP level and may involve a variety of other organisations also noted in this privacy notice.

North London Partners are a wider grouping performing similar shared functions to the GP federations.

In each case the Practice remains the data controller for the information about you.

Through various hubs in the community the GP Federation provide direct health and care services such as continued extended access, home visits, universal offers, musculoskeletal service, GP at front door and other neighbourhood services across North Central London (which covers the boroughs of Barnet, Camden, Enfield, Haringey and Islington)

If you visit receive treatment/consultation on any of these services, personal data concerning your GP medical record may be shared with the GP Federation and their Multidisciplinary Team (MDT) in order to enable them make the best informed decision about your health/care needs, and provide you with the best possible care.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraphs:

Article 6(1)(c) - processing for legal obligation;

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services.

Related Legislation:

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share);

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Pharmacists - Medicines Optimisation

Medicines optimisation looks at the value which medicines deliver, making sure they are clinically-effective and cost-effective. It is about ensuring patients get the right choice of medicines, at the right time, and are engaged in the process by their clinical team.

Medicines optimisation enables community pharmacies to request medication electronically from the Practice and view relevant information from your GP record in order to provide you with the best medicines.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraphs:

Article 6(1)(c) - processing for legal obligation;

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services.

Related Legislation:

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share);

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Local Authority – Social Services

The practice works closely with Local Authoritiesto support and care for people of all ages to deliver the best possible social care.

Personal data concerning your GP medical record may be shared with Local Authorities and Multidisciplinary Team (MDT) delivering social care in order to enable them make the best informed decision about your social care needs if required.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care.

The processing of personal data is permitted under the following paragraphs:

Article 6(1)(c) - processing for legal obligation;

Article 6(1) (d) (processing for vital interests of data subject) and/or;

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraphs:

Article 9(2) (b) – processing necessary in the field of employment, social security and social protection law.

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services.

Related Legislation:

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share)

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Care Homes

Personal data concerning your GP medical record may be shared with Care Homes and other Multidisciplinary Team (MDT) delivering care in order to enable their care professionals make the best informed decision about your care needs, and provide you with the best possible care if you visit a Care Home.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraphs:

Article 6(1)(c) - processing for legal obligation;

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraphs:

Article 9(2) (b) – processing necessary in the field of employment, social security and social protection law.

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services.

Related Legislation:

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share)

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Other primary care services delivered for the purposes of direct care

Recipients or categories of recipients of the personal or special categories of personal data

Purpose of the processing

Data Retention Period

Lawful basis

General Data Protection Regulation

- Article 6 -

- Article 9 –

Your Rights

Integrated Urgent Care Service (IUC) - covering Out of Hours and NHS 111 service

Integrated Urgent Care Service (IUC)is an urgent care service delivered across North Central London (NCL) (Barnet, Camden, Enfield, Haringey and Islington) for the provision of a functionally integrated 24/7 urgent care access, clinical advice and treatment service for patients. IUC incorporates NHS 111 and Out of Hours (OOH) services, which is often referred to as an IUC Clinical Assessment Service.

The purpose of IUC is to ensure that patients receive the best possible healthcare service in their community.

If you visit the urgent care centre or call NHS 111 for health related needs, personal data in your GP record will be shared with healthcare professionals in order to enable them make the best the best informed decision about your health needs.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraphs:

Article 6(1)(c) - processing for legal obligation;

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services.

Related Legislation:

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share);

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Continuing Health Care (CHC)

NHS Continuing Health Care (CHC) is free care outside of hospital that is arranged and funded by the NHS to support living with complex medical conditions and on-going healthcare needs which can be delivered in the patient’s home, at their care home or in non-acute hospitals.

CHC is free, unlike support from socialservices for which a fee may be charged, depending on your income and savings. CHC is different from NHS Funded Nursing Care, which some people with less complex needs living in care homes receive.

If you require CHC needs personal data concerning your GP medical record will be shared with the care home or in non-acute hospitals looking after you.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraphs:

Article 6(1)(c) - processing for legal obligation;

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraphs:

Article 9(2) (b) – processing necessary in the field of employment, social security and social protection law.

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services.

Related Legislation:

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share);

Section 47 of The Children Act 1989.

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Resilience networks and Social Prescribing

GP services can only be a part of care, and commonly voluntary/3rd sector organisations can help with conditions by providing support and other services. Where these may be helpful, we will, with your informed consent, share with these organisations to help you

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

Article 6 1(a) – consent of the data subject

Article 9 2(a)

You have the right to:

To withdraw your consent to this processing – this has the same effect as right to object;
To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data – as this is consent based we will immediately arrange for your data to be removed from all those organisations it has been shared with.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered. Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Statutory Disclosures of Information

Recipients or categories of recipients of the personal or special categories of personal data

Purpose of the processing

Data Retention Period

Lawful basis

General Data Protection Regulation

- Article 6 -

- Article 9 –

Your Rights

Safeguarding Concerns – to prevent an individual, or to prevent a serious crime

Some members of public are recognised as needing safeguarding protection, for example children and vulnerable adults. If an individual is identified as being at risk from harm, we have a duty to do what we can to protect that individual, and we are bound ‘Safeguarding’ laws to do so.

Where there is a suspected or actual safeguarding issue we will share information that we hold about you with other relevant agencies such as local Ambulance trusts, the police, A&E departments, out of hours services, 111 or Social Services)

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care.

The processing of personal data is permitted under the following paragraphs:

Article 6(1)(c) - processing for legal obligation;

Article 6(1) (d) – the processing is necessary in order to protect the vital interests of the data subject

The processing of special categories of personal data concerning health is permitted under the following paragraphs:

Article 9 (2) (C) – theprocessing is necessary to protect the vital interests of the data subject;

Article 9(2) (b) – processing necessary in the field of employment, social security and social protection law.

Related Legislation:

Data Protection Act 2018 Section 10 (in particular the provisions under Schedule 2 Part 1 Section 18 relating to safeguarding)

Section 45 of the Care Act 2014

This sharing is a legal and professional requirement and therefore there is no right to object.

The Children Act 1989 requires local authorities to investigate where a child is the subject of an emergency protection order, is in police protection or where there is a reasonable cause to suspect that a child is suffering or is likely to suffer harm.

The Act requires the local authority to safeguard and promote the welfare of children who are in need, within their geographical area and to request help from specified authorities including General Practices, NHS Trusts, Integrated Care Systems / Boards (ICSes / ICBs – formerly CCGs) and NHS England.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

The Care Quality Commission (CQC)

The Care Quality Commission (CQC) is a regulatory body established under the Health and Social Care Act. The CQC regulates health and social care services in England toensure that safe health and care are provided. The law allows CQC to access identifiable patient data/medical records in our clinical system for the purposes of their assessment and investigation of significant safety incident.

The data will be shared with the Care Quality Commission, its officers and staff and members of the inspection teams that visit us from time to time.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care.

The processing of personal data is permitted under the following paragraph:

Article 6(1)(c) - processing for legal obligation;

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

Related Legislation:

The Health and Social Care Act 2008, s64

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Law Enforcement and Regulatory Bodies

In some circumstances the Practice may be legally required to share personal information with law enforcements and regulatory bodies (without the consent of the data subject) such as: the Police; Courts of Justice; HMRC and DVLA for the purposes of prevention or detection of crime;apprehension or prosecution of offenders; the assessment or collection of any tax or duty or, of any imposition of a similar nature.

GPs are obliged to notify the DVLA when fitness to drive requires notification but an individual cannot or will not notify the DVLA themselves, and if there is concern for road safety, which would be for both the individual and the wider public.

The Practice will review each request based on its merits before deciding whether to release information to the ‘relevant authorities’.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care.

The processing of personal data is permitted under the following paragraphs:

Article 6(1)(c) - processing for legal obligation;

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2) (G) – theprocessing is necessary for reasons of substantial public interest

Related Legislation:

There are a variety of acts which place responsibilities on health providers to provide information for law enforcement and regulatory bodies.

This sharing is a legal and professional requirement and therefore there is no right to object. Personal data processed these purposes are exempt the first data protection principle (processed lawfully, fairly and in a transparent manner).

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Medical Examiner Service

When a person dies, all death are now reviewed by the medical examiner service. We are required to share information about the deceased’s medical record with the examiner. This record may contain information regarding the living – for example, family members, persons who treated the deceased. Data is reviewed only by persons under a professional duty of confidence as part of the medical examiner service.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care.

The processing of personal data is permitted under the following paragraph:

Article 6(1)(c) - processing for legal obligation;

Additionally, as the sharing is mandated for improvement of health and care

Article 6(1)(e) ‘…for the performance of a task carried out in the public interest or in the exercise of official authority…’

The processing of special categories of personal data concerning health is permitted under the following paragraphs:

Article 9 (2) (b): processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject.

Additionally, as the sharing is intended to improve health and care

Article 9 (2) (h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services.

Related Legislation

The National Health Service Trust (Scrutiny of Deaths) (England) Order 2021

This sharing is a legal and professional requirement and therefore there is no right to object.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Medico-Legal

Medico-Legal - Where a medical professional is holding personal data for the purpose of providing medical reports in connection with legal action.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care.

The processing of personal data is permitted under the following paragraph:

Article 6(1)(c) - processing for legal obligation;

The processing of special categories of personal data concerning health is permitted under the following paragraphs:

Article 9 (2) (b): processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject

Art.18 (2): Processing for the establishment, exercise or defence of legal claims.

This sharing is a legal and professional requirement and therefore there is no right to object.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

General Medical Council (GMC)

General Medical Council (GMC) is a public body that maintains the official register of medical practitioners within the United Kingdom. Its primary responsibility is ‘to protect, promote and maintain the health and safety of the public’ by controlling entry to the register, and suspending or removing members when necessary.

Under the Medical Act 1983, the GMC has the power to request access to a patient’s medical records for the purposes of an investigation into a doctor’s fitness to practise.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care.

The processing of personal data is permitted under the following paragraph:

Article 6(1)(c) - processing for legal obligation;

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

Related Legislation:

The Medical Act 1983

The Health Service Ombudsman (HSO)

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

The Health Service Ombudsman (HSO) wasset up by Parliament to provide an independent complaint handling service for complaints that have not been resolved by the NHS in England and UK government departments.

The HSO has the power to request access to a patient’s medical records for the purpose of an investigation.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1)(c) - processing for legal obligation;

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

Related Legislation:

The Health Services Commissioners Act 1993,s12

S254 of the Health and Social Care Act 2012

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

NHS Counter Fraud

Under the NHS Act 2006, investigations into fraud in the NHS may require access to confidential patient information.

This means that we are compelled by the law to share your data.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1)(c) - processing for legal obligation;

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

Related Legislation:

s10 NHS Act 2006

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

NHS Digital

NHS Digital (previously known as the Health and Social Care Information Centre)is anational information and technology partner to the health and social care system. NHS Digital use digital technology to transform the NHS and social care.

NHS Digital carries out National Data collections/ extractionfrom the GP record. These include:

General Practice Extraction Service (GPES)

This is an extraction of much of your GP data for use by the NHS centrally for planning and research. It is controlled by NHS Digital and is a statutory requirement upon your GP under sections 259(1)(a) and 259(5) of the Health and Social Care Act 2012.

Further details for patients are provided at https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research.

National Diabetes Audit (NDA) - A national monitoring system, auditing the care of patients with diabetes. The data extracted for the purpose of NDA includes NHS Number, date of birth and postcode, as well as clinical parameters related to diabetes. NDA is a mandatory data extraction under section 254 of the Health and Social Care Act 2012, this means that we are compelled by law to share your data

Individual GP Level Data (IGPLD) - A national monitoring system to enable NHS Digital to provide GPs with clinical information on the care provision for their patients. The data extracted includes the NHS number. IGPLD is a mandatory data extraction under 254 of the Health and Social Care Act 2012, this means that we are compelled by law to share your data

FGM) - NHS Digital collects data on FGM within the NHS in England on behalf of the Department of Health (DH). Data collected is used to produce information that helps improve NHS and local authorities to improve on how they support women and girls who have had or, who are at risk of FGM.

FGM Enhanced Dataset is a mandatory data extraction under section 254 of the Health and Social Care Act 2012, this means that we are compelled by law to share your data when required.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1)(c) - processing for legal obligation;

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

Related Legislation:

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You do not have the right to object as the sharing is a legal and professional requirement under the law.

Whilst there is no right to object under 6(1)(c), NHS Digital respects Type 1 objections (9Nu0) present in the GP record and no data will be extracted and uploaded if so.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

NHS England

NHS England is responsible for securing, planning, designing and paying for Primary Care & Specialised NHS services not otherwise funded by North Central London Integrated Care Board.This includes planned and emergency hospital care, mental health, rehabilitation, community and primary medical care (GP) services.

We may often share personal information with NHS England potentially for safeguarding concerns that need escalating beyond our borough.

Where required the Practice may also have to share staff personal information with NHS England for the purpose of allegations framework or performers list.

The source of the information that may be shared in this instance are in the staff record and patient’s electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services.

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You do not have the right to object as the sharing is a legal and professional requirement under the law.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Public Health

Public Health England is an executive agency of the Department of Health and Social Care, and a distinct organisation with operational autonomy.

The main purpose of the organisation is to protect and improve the health and wellbeing of citizens. These include the management of smoking, alcohol and obesity; management of epidemics and infections such as flu, measles, tuberculosis or outbreaks of food poisoning.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1) (c) - processing for legal obligation;

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9(2) (b) – processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices.

Related Legislation:

The Health Protection (Notification) Regulations 2010 (SI 2010/659);

The Health Protection (Local Authority Powers);

Regulations 2010 (SI 2010/657)

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared with the recipient.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Processing for the Purposes of Commissioning, Planning, Research and Risk Stratification

Integrated Care Systems / Boards (ICSes / ICBs)

Formerly known as Clinical Commissioning Groups CCG (s)

Integrated Care Boards(ICBss) are responsible for securing, planning, designing and paying for your NHS services, including planned and emergency hospital care, mental health, rehabilitation, community and primary medical care (GP) services. This is known as ‘Commissioning’. We are part of the Integrated Care System (ICS) responsible for delivery of services.

In order to enable North Central London ICB carry its statutory duties the Practice

In order to enable North Central London ICB carry out its statutory responsibilities effectively, efficiently and safely, we may share personal data about you with the ICB for the following purposes:

Individual Funding Requests;

Continuing Health Care;

appeals, queries or compliments; safeguarding concerns;

commissioning purposes such as payment for target achievement known as Quality and Outcomes Framework (QOF); and where the Practice is participating in agreed national or local enhanced services.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared with the recipient.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

“Risk Stratification" (Population Health Management and Case Finding)

Recipient: Cerner - HealtheIntent

Ardens – EMIS Templates

[INSERT OTHERS AS NEEDED]

The Practice performs computerised searches of some or all of our records to identify individuals who may be at increased risk of certain conditions or diagnoses i.e. Diabetes, heart disease, risk of falling). Your records may be amongst those searched. This is often called “risk stratification” or “case finding”. These searches are sometimes carried out by Data Processors who link our records to other records that they access, such as hospital attendance records. The results of these searches and assessment may then be shared with other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care.

Risk stratification can be grouped into two purposes namely:

Direct Care – ‘Case Finding’ where carried out by a health professional (e.g. GPs and Provider) involved in an individual’s care or by a data processor acting under contract with such a provider, it is treated as direct care.

Indirect Care - understand the local population needs and plan for future requirement.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

Related Legislation:

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared with the recipient.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Prescribing Improvement and alerting

Recipient:

First Databank UK

Optum

[INSERT /REMOVE OTHERS AS NEEDED]

The Practice when prescribing passed pseudonomised data to prescribing improvement and alerting services to ensure that healthcare workers provide the most appropriate treatments and therapies. This allows the NHS to reduce cost and improve patient safety.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

Related Legislation:

Oviva UK Ltd (Paediatric Cow's milk allergy)

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared with the recipient.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Nutrition improvement

Recipient:

Oviva UK Ltd (Adult Oral Nutritiopn Support)

[INSERT /REMOVE OTHERS AS NEEDED]

If your child has a cow’s milk allergy, or you are an adult patient with certain nutrition difficulties, Oviva UK will be used as a subprocessor to provide assistance for the condition.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

Related Legislation:

Cerner - Health Information Exchange (HIE))

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared with the recipient.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Research Partners

The practice participates projects and will only agree to do so if there is an agreed clearly defined reason for the research that is likely to benefit healthcare and patients. Such proposals will normally have a consent process, ethics committee approval, and will be in line with the principles of Article 89(1) of UK GDPR.

Research organisations do not usually approach patients directly but will ask us to make contact with suitable patients to seek their consent. Occasionally research can be authorised under law without the need to obtain consent. This is known as the Section 251 arrangement.

We may also use your medical records to carry out research within the practice.

We share information with the following medical research organisations with your explicit consent or when the law allows: [insert names e.g. Clinical Practice Research Datalink].

The source of the information shared in this way is your electronic GP record.

You have the right to object to the sharing of your personal health data concerning your GP medical for research purposes. This is exercised via the National Data Opt-out; see the NHS Your Data Matters page.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data is permitted under the following paragraph:

Article 9 (2) (j) - for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared with the recipient.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Employment Processing

The Practice ensures the protection of the rights and freedoms in respect of the processing of its employees’ personal data, in particular for the purposes of the recruitment, obligations performance contract of employment, rights and benefits management planning, health and safety, equality and diversity in the workplace, health and safety at work.

The Practice ensures that personal data it collects from employees are used only for employment related purposes or where there is a statutory obligation to share the personal information with to regulatory bodies (e.g. courts, police or NHS England).

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data is permitted under the following paragraph:

Article 9(2) (b): processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject

Employees have the right to:

To access, view or request copies of their personal information held by the Practice;
request rectification of any inaccuracy to their personal information;
restrict the processing of their personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: Employees have a general right to raise an objection to the sharing personal data.

If an employee wishes to exercise his/her rights they can contact the Practice (data controller) or the DPO and their request will be carefully considered.

Right to complain:If an employee is dissatisfied with the way the Practice processes his/her personal data, they have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Data Sharing Databases

System/database

Recipients or categories of recipients of the personal or special categories of personal data

Purpose of the processing

Data Retention Period

Lawful basis

General Data Protection Regulation

- Article 6 -

- Article 9 –

Your Rights

London Care Record

(in North Central London, provided via

The London Care Record (LCR)is an Electronic Health Record (EHR) linking system that brings together patient data across the health and care system in a secure manner, embedding a single aggregated longitudinal view of the patient natively in each EHR system irrespective of traditional organisational or technological boundaries.

The LCR includes information about patients/clients recorded by acute hospitals, mental health, community health, social care and GP Practices.

Healthcare professionals across London and the region are able to access can access subsets of their patients/service users’ medical or social recordsfrom a single system in order to provide the best possible care.

The source of the information shared in this way is your electronic GP record for the purposes of direct patient care and indirect care.

All records held by the Practice and in the LCR system are kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraphs:

Article 6(1) (c) - processing for legal obligation;

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services.

Related Legislation:

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share);

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share);

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object or opt-out: You have the right to raise an objection to your personal data being shared in the LCR. You also have the right opt out of the LCR by completing an opt-out with your Practice. Although we will first need to explain how this may affect the care you receive. Opting out of the LCR includes opting out of HealtheIntent.

You can opt-out of the London Care Record via the form available online at https://northlondonpartners.org.uk/our-working-areas/using-digital-technology-to-improve-health-and-care/info-residents/faqs/

If you wish to exercise any other of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Cerner - HealtheIntent

HealtheIntent is a platform that allows the practice and other healthcare providers to improve healthcare outcomes, patient experience, reduce adverse events and shift towards more preventative care. It covers both sharing and risk stratification.

HealtheIntent uses the shared care record (see above, LCR) plus additional data from care providers to give a better picture of your health.

The HealtheIntent platform contains three main tools - HealtheRecord, HealtheRegistries and HealtheAnalytics, and a data warehouse (HealthEDW).

HealthEDW is the data warehouse which securely holds all of the normalised, longitudinal data. Normalised means that all the same measurements are used so there is no confusion, longitudinal means that data is available over time.

HealtheRegistries provides a dashboard view for specific population cohorts usually a long-term condition e.g. diabetes. It provides users with an overview of indicators/measures and allows them to see how a patient is doing against these measures e.g. Hba1C result as well as their population (e.g. GP practice). This helps the user identify gaps or duplication in care at both an individual and population level.
HealtheAnalytics is a dashboard tool (Tableau) which can be used to identify trends and unwarranted variation in population cohorts. It will also enable clinicians and care professionals to ‘drill down’ to see which of their patients/clients require specific action.

All records held by the Practice and in the LCR system are kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraphs:

Article 6(1) (c) - processing for legal obligation;

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services.

Related Legislation:

Section 251B Health and Social Care (Safety and Quality Act) 2015 (Duty to Share);

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object or opt-out: You have the right to raise an objection to your personal data being shared in HealtheIntent. You also have the right opt out of HealtheIntent by completing an opt-out form with your Practice. Although we will first need to explain how this may affect the care you receive. Opting out of HealtheIntent includes opting out of the London Care Record.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

EMIS Systems Local Record Sharing – Integrated Care

EMIS Local Record Sharing enables yourGP medical record held on our secure EMIS Web clinical system to be shared with other healthcare Providers (e.g. acute hospitals, mental and community health and other GPs) who are commissioned to provide to provide health care services within your borough.

This local sharing is used to provide direct patient care for services such as continued extended access, home visits, universal offers, musculoskeletal service, GP at front door and other neighbourhood services across North Central London.

The information is accessed in real time and on-demand, meaning that data from your GP record is neither extracted, nor uploaded, nor sent anywhere in real time and on-demand, meaning that data from your GP record is neither extracted, nor uploaded, nor sent anywhere.

The source of the information shared in this way is your electronic GP record.

National Diabetic Retinal Screening Service– Diabetic eye screening is carried out in north central London by the North Central London Diabetic Eye Screening Programme (NCL-DESP).

NCL-DESP is provided by North Middlesex University Hospital NHS Trust which conducts screening across five London boroughs: Barnet, Camden, Enfield, Haringey and Islington.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice and the EMIS Local Record Sharing system are be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraphs:

Article 6(1) (c) - processing for legal obligation;

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraphs:

Article 9(2) (b) – processing necessary in the field of employment, social security and social protection law.

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

Related Legislation:

National NHS Digital Services “Spine” including:

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared with the recipients.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Spine supports the IT infrastructure for health and social care in England, joining together over 23,000 healthcare IT systems in 20,500 organisations.

It hosts 5 key services to support the delivery of your care. They enable healthcare professionals, authorised with an NHS smartcard, to view relevant information about you as follows

Patient Demographics Service – The Personal Demographics Service (PDS) is the national electronic database of NHS patient details such as name, address, date of birth and NHS Number (known as demographic information). It helps healthcare professionals to identify patients and match them to their health records. It also allows them to contact and communicate with patients.

Summary Care Record (SCR) – is an electronic record of important patient information, created from GP medical records. It can be seen and used by authorised staff in other areas of the health and care system involved in the patient's direct care.

When your personal health records on your GP Record is uploaded to the spine, NHS Digital becomes the data controller for the uploaded information.

The source of the information shared in this way is your electronic GP record.

At a minimum, the SCR holds important information about;

current medication
allergies and details of any previous bad reactions to medicines
the name, address, date of birth and NHS number of the patient

The patient can also choose to include additional information in the SCR, such as details of long-term conditions, significant medical history, or specific communications needs.

e-Referral Service - The NHS e-Referral Service (e-RS) combines electronic booking with a choice of place, date and time for first hospital or clinic appointments. Patients can choose their initial hospital or clinic appointment, book it in the GP surgery at the point of referral, or later at home on the phone or online.

Electronic Prescription Service - The Electronic Prescription Service (EPS) sends electronic prescriptions from GP surgeries to pharmacies. Eventually EPS will remove the need for most paper prescriptions.

GP2GP - GP2GP allows patients' electronic health records to be transferred directly, securely, and quickly between their old and new practices, when they change GPs. This improves patient care by making full and detailed medical records available to practices, for a new patient's first and later consultations.

The source of the information shared in all of the instances above in this way is your electronic GP record.

All records held by the Practice and the EMIS Local Record Sharing system are be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object or opt-out: You have the right to raise an objection or opt-out of out of having an SCR by returning a completed opt-out form to their GP practice. Although we will first need to explain how this may affect the care you receive.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Open Exeter

Open Exeter is a web-enabled viewer which provides the facility for healthcare professionals to share/access patient data held on the National Health Application and Infrastructure Services (NHAIS) systems, including cervical screening, breast screening, organ donor, blood donor and home oxygen.

Access to Open Exeter is only possible on the N3 network, and via authorised logons/passwords provided by NHS Digital.

The source of the information shared in this way is your electronic GP record.

Data is viewed on screen.
If printed, it is destroyed when no longer required (usually within 24 hrs).

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared in Open Exeter.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Data Processors

System/database

Recipients or categories of recipients of the personal or special categories of personal data

Purpose of the processing & Data Retention Period

Data Retention Period

Lawful basis

General Data Protection Regulation

- Article 6 -

- Article 9 –

Your Rights

AccuRx

AccuRx supply a number of systems to practices including text (SMS) messaging and remote consultations.

Your personal data is passed to them solely for these purposes and not used further.

Processing is carried out by AccuRx under instruction held as a processing agreement with your GP.

Data is not retained in this system once processed, but transferred to the clinical record system,

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Amazon Web Services (AWS)

Amazon web services are used as a sub-processor by some NHS organisations and suppliers, including EMIS and NHS Digital.

Processing is carried out by AWS as a sub-processor to controllers such as Egton and EMIS Health.

These organisation are responsible under their contract for the management of the sub-processor.

Your GP does not have a direct relationship with AWS.

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Microsoft Azure and Office 365

Microsoft are used as a processor by some NHS organisations and suppliers, including GPs, Optum, GP federations and others.

All records held in the Practice EMIS system be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

“GP records should be retained until 10 years after the patient's death or after the patient has permanently left the country, unless they remain in the UK.

Electronic patient records must not be destroyed or deleted for the foreseeable future.”

Where Microsoft (particularly Azure) is a sub-processor, for example to Optum, your GP does not have a direct relationship and the contracting organisation is responsible under their contract for the management of the sub-processor

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

EMIS Health and Egton

EMIS Health and Egton are responsible for the provision of a clinical system, software and IT services used by the Practice to securely store and process your medical record.

All information about your personal health records are stored in your GP electronic record. This information is then available to practice staff & external bodies as outlined in this document.

This data can includes video, audio and photographic evidence from remote consultations.

All records held in the Practice EMIS system be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

“GP records should be retained until 10 years after the patient's death or after the patient has permanently left the country, unless they remain in the UK.

Electronic patient records must not be destroyed or deleted for the foreseeable future.”

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

NHSMail

The practice uses NHSMail to process and manage email and calendar appointments for staff. As such, it contains a mix of staff and patient personal data.

The practice uses NHSMail in line with guidance from NHS Digital

Rights and policies in respect of staff personal data are held by NHS Digital as the controller and available at the link below

NHSMail Transparency Information

The source of this data as a patient is your electronic patient record.

The NHSMail data retention and Information Management policy is available at the link below:

NHSMail Data Retention and Information Management Policy

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Microsoft Office 365 including Teams, Sharepoint, Onedrive

The practice uses Microsoft Office 365 supplied by NHS Digital for internal information management. As such, it contains a mix of staff and patient personal data.

The practice uses Microsoft Office 365 in line with guidance from NHS Digital.

The source of this data as a patient is your electronic patient record.

All records held in the Practice EMIS system be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

“GP records should be retained until 10 years after the patient's death or after the patient has permanently left the country, unless they remain in the UK.

Electronic patient records must not be destroyed or deleted for the foreseeable future.”

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

North Central London Integrated Care Board

(formerly North Central London CCG)

NHS North Central London ICB is responsible for securing, planning, designing and paying for your NHS services, including planned and emergency hospital care, mental health, rehabilitation, community and primary medical care (GP) services, Information Communication Technology (ICT), providing risk stratification services.

The ICB act as the Data Processor for EMIS Systems Local Record Sharing and, process personal data from your GP record in accordance with instructions from the Practice.

Some services provided by the ICB are shared across London and provided to the ICB by other areas. These are detailed in this document.

The source of the information shared in this way is your electronic GP record.

All records held in the Practice EMIS system be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

“GP records should be retained until 10 years after the patient's death or after the patient has permanently left the country, unless they remain in the UK.

Electronic patient records must not be destroyed or deleted for the foreseeable future.”

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

South West London Integrated Care Board - GP Practice Data Extraction Services

The GP Practice Data Extraction Services is shared across London, with South West London performing the service. This enables SWL to, on behalf of the NCL area, extract personal data from GP Practice covering all currently registered patients and those ever registered since April 2009 except where patients have explicitly dissentedfrom their information being extracted, for the provision of services back to the practice which may include:

Risk stratification; linking data to other data sets;

financial reporting;

business intelligence;

statistical analysis and;

information to support delivery of patient care.

The source of the information shared in this way is your electronic GP record.

All records held in the Practice EMIS system be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared with NEL CSU.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Docman and Docmail

Docman Limited act as a data processor and provides cloud-based storage software for electronic patient document. This includes letters that we receive, scan and upload to the patient record, as well as letters that we receive in an electronic format.

Generally, Docman enables primary health care organisations capture, file, workflow, view and manage primary care documents efficiently.

Docmailenables primary health care organisations send letters, invoices and documents directly from computers and other portable devices.

The source of the information shared in this way is your electronic GP record for the purposes of direct administrative patient care.

All records held in the Practice EMIS system and the Docman vault are kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

“GP records should be retained until 10 years after the patient's death or after the patient has permanently left the country, unless they remain in the UK.

Electronic patient records must not be destroyed or deleted for the foreseeable future.”

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

iPlato

iPlato is cloud-based text messaging service used by GPs to communicate with their patients.

The source of the information shared in this way is your electronic GP record for the purposes of direct administrative patient care.

All personal health records held in the Practice EMIS system and the iPlato system are kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

“GP records should be retained until 10 years after the patient's death or after the patient has permanently left the country, unless they remain in the UK.

Electronic patient records must not be destroyed or deleted for the foreseeable future.”

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: In line with the UK GDPR Article 21, you have a general right to raise an objection to the processing of your personal data in some particular circumstances. This right only applies where we cannot demonstrate compelling legitimate grounds for continued processing of your personal data for the purposes of direct provision of care, and compliance with a legal obligation to which we are subject.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

INhealth Intelligence

QMS-UK are commissioned by NHS England to provide secure data processing solutions for two services:

Child Health Information Service – information relating to children’s vaccinations is shared with North East London Foundation Trust who run one of 4 Child Health Information Services across London.

All records held in the Practice EMIS system and the QMS database are kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

“GP records should be retained until 10 years after the patient's death or after the patient has permanently left the country, unless they remain in the UK.

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared in QMS.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

Better Ltd Urgent Care Plan

Better Ltd are commissioned by South West London on behalf of all parts of London to provide secure data processing solutions for:

Urgent Care Plans – The NHS aims to provide personalised care based on what matters to you. Care planning enables your wishes and individual care and support needs to be communicated digitally with your healthcare professionals across London.

A care plan can be created following a conversation between you and your healthcare professional (such as a doctor or nurse). Your healthcare professional will listen to you, understand your needs and make notes about:
What is important to you in your day-to-day life
Your preferences or wishes about your care, such as where you prefer to be cared for
What support you need and who is best placed to provide this
Information about others who may be involved in your care, such as relatives
Based on your conversation, your healthcare professional can document this information using a digital system. Your care plan can be continuously updated throughout your life, depending on your needs and wishes.

For details, see https://ucp.onelondon.online/patients/

Your healthcare professional will document a clinical recommendation, should you need emergency care. Information on your care plan is visible to all health and care services who are involved in your care.

This may include the London Ambulance Service, 111 and Out of Hours GP services who may see you in an emergency.

All records held in the are kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

Since the Urgent Care Plan is created voluntarily by patients, patients can withdraw it at any time, in which case it will be deleted.

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

GP Connect

GP Connect allows authorised clinical staff to share and view GP practice clinical information and data between IT systems, quickly and efficiently. It is run and managed by NHS England

It provides full record sharing to other partners in health and care and is used for a many of the linkages noted elsewhere in this notice.

For more details, please visit:

https://digital.nhs.uk/services/gp-connect

All records held in the Practice EMIS system are kept for the duration specified in the Records Management Codes of Practice for Health and Social Care

GP records should be retained until 10 years after the patient's death or after the patient has permanently left the country, unless they remain in the UK.

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared in QMS.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

[Insert your Risk Stratification software supplier excluding EMIS (covered above) – e.g. Docobo, MedeAnalytics, Sollis or any listed on NHSE Approved Suppliers

The Practice performs computerised searches of some or all of our records to identify individuals who may be at increased risk of certain conditions or diagnoses i.e. Diabetes, heart disease, risk of falling). Your records may be amongst those searched. This is often called “risk stratification” or “case finding”. These searches are sometimes carried out by Data Processors who link our records to other records that they access, such as hospital attendance records. The results of these searches and assessment may then be shared with other healthcare workers, such as specialist, therapists, technicians etc. The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and or care.

Risk stratification can be grouped into two purposes namely:

Direct Care – ‘Case Finding’ where carried out by a health professional (e.g. GPs and Provider) involved in an individual’s care or by a data processor acting under contract with such a provider, it is treated as direct care.

Indirect Care - understand the local population needs and plan for future requirement.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care.

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data concerning health is permitted under the following paragraph:

Article 9 (2)(h) - processing is necessary for medical or social care treatment or, the management of health or social care systems and services

Related Legislation:

Section 251 NHS Act 2006

You have the right to:

To access, view or request copies of your personal information;
request rectification of any inaccuracy in your personal information;
restrict the processing of your personal information where:
accuracy of the data is contested,
the processing is unlawful or,
where we no longer need the data for the purposes of the processing.

Right to object: You have a general right to raise an objection to your personal data being shared for the purpose of risk stratification.

If you wish to exercise any of your rights please contact the Practice (data controller) or the DPO and your request will be carefully considered.

Right to complain:If you are dissatisfied with the way the Practice processes your data, you have the right to appeal/complain. You may raise the issue with the Practice’s Data Protection Officer, contact details are given at section 6, or if not satisfied, with the Information Commissioner (ICO). The ICO can be contacted at:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

Tel: 0303 123 1113 or 01625 545 745

Website: https://ico.org.uk

[insert the names of the organisations you conduct clinical research with]

To enable healthcare professionals working for the Practice to provide information, derived from GP records, about individuals to accredited research organisations.

This covers research situations where the data controller (the Practice) is approached by research organisations, directly, to recruit patients for studies.

Any research proposal will only be agreed with a clearly defined protocol, consent mechanisms, and relevant research ethics committee approval, and in line with the principles of Article 89(1) of the UK GDPR.

Research organisations do not approach patients directly, rather the Practice will invite appropriate patients directly seeking their wish to take part.

This Privacy Noticedoes not cover situations where the Practice has been approached by an organisation seeking personal sensitive data to be disclosed in the absence of consent, i.e. via Related Legislation: Section 251 NHS Act 2006 / Health Research Authority (HRA) approval.

The source of the information shared in this way is your electronic GP record.

All records held by the Practice will be kept for the duration specified in the Records Management Codes of Practice for Health and Social Care.

The processing of personal data is permitted under the following paragraph:

Article 6(1) (e) - public interest or in the exercise of official authority.

The processing of special categories of personal data is permitted under the following paragraph:

Article 9 (2) (j) - for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law

Related Legislation: