The Deepings Practice
Data Protection Privacy Notice for Patients
Introduction
The Deepings Practice is committed to protecting the confidentiality, integrity, and security of your personal information.
This Privacy Notice explains how we collect, use, store, and share your personal information and healthcare information when you receive services from us. It also explains your rights under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
We are required by law to provide you with information about how your personal data is processed. This notice applies to all personal information processed by or on behalf of The Deepings Practice.
If you have any questions about this Privacy Notice or how your information is used, please contact The Practice Manager.
Who We Are
The Deepings Practice provides NHS primary care services to patients registered with the practice.
For the purposes of data protection legislation, The Deepings Practice is the Data Controller for the personal information we hold about our patients.
The practice is registered with the Information Commissioner's Office (ICO).
ICO Registration Number: Z6498899
As a Data Controller, we are responsible for ensuring that your personal information is processed lawfully, fairly, transparently, and securely.
Data Protection Officer
The Practice has appointed an external Data Protection Officer (DPO) who oversees compliance with data protection legislation and provides advice on matters relating to privacy and confidentiality.
If you have any questions regarding how your personal information is handled, please contact the Practice Manager.
Information We Collect About You
To provide safe and effective healthcare services, we collect and maintain records about your health and care.
The information we may hold includes:
Personal Information
- Name
- Date of birth
- NHS number
- Address
- Telephone numbers
- Email address
- Emergency contact details
- Next of kin information
- Gender
- Ethnicity
- Language preferences
Health Information
- Medical history
- Diagnoses and clinical notes
- Consultation records
- Care plans
- Medication records
- Allergies and adverse reactions
- Test and investigation results
- Immunisation records
- Referrals and correspondence from other healthcare providers
- Information relating to treatment and care received
Administrative Information
- Appointment records
- Communication preferences
- Records of correspondence with the practice
- Telephone call recordings (where applicable)
We may also receive information about you from other healthcare organisations, social care providers, hospitals, community services, pharmacies, and other professionals involved in your care.
Why We Use Your Information
We use your information primarily to provide direct healthcare services and to ensure that you receive safe, effective, and appropriate treatment.
Your information may also be used for:
- Managing and planning healthcare services
- Clinical audit and quality improvement
- Safeguarding children and vulnerable adults
- Preventing and detecting fraud
- Public health activities
- Medical research (where permitted by law)
- Meeting legal and regulatory obligations
- Responding to complaints, claims, and incidents
Lawful Basis for Processing Your Information
Under UK GDPR, we must have a lawful basis for processing your personal information.
As an NHS General Practice, most of our processing is carried out because it is necessary for the performance of a task carried out in the public interest and for the provision of health and social care.
Personal Data
We process personal data under:
Article 6(1)(e) UK GDPR
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller.
Special Category Health Data
We process health information under:
Article 9(2)(h) UK GDPR
Processing is necessary for the purposes of preventive medicine, medical diagnosis, the provision of health or social care, treatment, or the management of health and social care systems.
Additional legal bases may apply in specific circumstances, including:
- Compliance with legal obligations
- Safeguarding responsibilities
- Public health requirements
- Medical research
- Protection of vital interests
Where consent is relied upon, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect processing already carried out lawfully before consent was withdrawn.
How We Use Your Information
We may use and share your information when:
- Referring you to hospitals, specialists, or other healthcare providers
- Receiving information from healthcare professionals involved in your care
- Prescribing medication and arranging pharmacy services
- Coordinating care with health and social care organisations
- Complying with legal obligations
- Supporting NHS planning and service improvement using anonymised or de-identified information
We will only share your information where there is a lawful basis to do so and where appropriate safeguards are in place.
We do not sell patient information and will never use your information for commercial marketing purposes.
Summary Care Record (SCR)
Most patients registered with a GP practice in England have a Summary Care Record (SCR), unless they have chosen to opt out.
The SCR is an electronic record containing important information about your health that can be accessed by authorised healthcare professionals involved in your care.
The SCR helps healthcare professionals provide safer and more effective treatment, particularly in emergency situations or when you are receiving care away from your usual GP practice.
Information Included in the SCR
The core SCR contains:
- Current medications
- Allergies
- Adverse reactions to medicines
Some patients may also choose to have additional information included, such as:
- Significant medical history
- Long-term conditions
- Care plans
- Immunisations
- End-of-life care preferences
Healthcare professionals can only access your SCR when they have a legitimate relationship with you and access is required to provide direct care.
You have the right to:
- Have a Summary Care Record with additional information
- Have a Summary Care Record containing core information only
- Opt out of having a Summary Care Record
Further information is available from the practice or NHS England.
Shared Care Records
To improve patient care and support joined-up healthcare services, The Deepings Practice participates in local Shared Care Record arrangements where appropriate.
Shared Care Records allow authorised health and care professionals involved in your treatment to access relevant information from different healthcare organisations.
Information may be shared with:
- NHS Trusts
- Community healthcare providers
- Mental health services
- Social care services
- Ambulance services
- Other authorised healthcare organisations involved in your care
Shared Care Records are used solely to support your direct care and treatment.
Medicines Management
The Practice may undertake medicines management reviews to ensure patients receive safe, effective, and appropriate treatment.
This may involve sharing relevant information with pharmacists and medicines optimisation teams working on behalf of NHS organisations under appropriate contractual and confidentiality arrangements.
GP Connect
The Practice participates in the NHS GP Connect service.
GP Connect allows authorised healthcare professionals involved in your direct care to securely access relevant information held in GP systems.
Examples include:
- NHS 111
- Urgent Treatment Centers
- Out-of-Hours Services
- Hospital clinicians
GP Connect helps improve continuity of care and enables appropriate appointments to be arranged where necessary.
Access is strictly controlled and audited.
Research and Service Improvement
Patient information may be used to support healthcare research, service planning, and quality improvement activities were permitted by law.
Where possible, information used for these purposes will be anonymised or de-identified.
Research helps the NHS to:
- Improve patient care
- Develop new treatments and medicines
- Monitor safety and effectiveness of services
- Improve public health outcomes
The Practice may participate in approved research programs, including those managed by NHS organisations and approved research bodies.
Where identifiable information is required for research purposes, additional safeguards and approvals will apply.
National Data Opt-Out
The NHS National Data Opt-Out allows patients to choose whether their confidential patient information is used for purposes beyond their individual care and treatment.
This includes:
- Research
- Health service planning
Choosing to opt out will not affect your care or treatment.
You can manage your choice at any time through NHS services.
Further information is available from NHS England or directly from the practice.
Risk Stratification and Population Health Management
The NHS uses risk stratification and population health management techniques to identify patients who may benefit from additional support, preventative interventions, or enhanced services.
These programmes help healthcare providers:
- Improve health outcomes
- Reduce health inequalities
- Prevent avoidable hospital admissions
- Plan services effectively
Information used for these purposes is subject to strict governance controls and is processed in accordance with data protection legislation.
Where possible, information is de-identified before analysis.
Safeguarding
The Practice has a legal and professional responsibility to safeguard children and adults at risk.
Information may be shared without consent where necessary to:
- Protect individuals from harm
- Prevent abuse or neglect
- Support safeguarding investigations
- Comply with statutory safeguarding duties
Safeguarding information is shared only with appropriate organisations and professionals involved in protecting vulnerable individuals.
Who We Share Information With
We may share information with organisations involved in providing your care, including:
- NHS England
- Integrated Care Boards (ICBs)
- NHS Trusts and Foundation Trusts
- Community healthcare providers
- Mental health services
- Ambulance services
- Pharmacies
- Dentists
- Opticians
- Social care providers
- Local authorities
- Safeguarding services
- Independent healthcare providers involved in your care
We may also share information with:
- Regulators
- Commissioners
- Approved auditors
- Approved research organisations
- Legal authorities where required by law
Information is only shared where there is a lawful basis to do so.
Information Technology Providers
The Practice uses specialist suppliers to provide:
- Clinical systems
- Appointment management systems
- Document management systems
- Data hosting services
- Electronic prescribing systems
- Communication systems
- Website services
All suppliers are required to comply with UK GDPR, NHS security standards, and contractual confidentiality requirements.
Sharing Information Without Consent
There are circumstances where we may be required to share information without your consent, including:
- Where required by law
- Court orders
- Safeguarding concerns
- Prevention or detection of serious crime
- Protection of public health
- Protection of life
- National screening programmes
- Statutory reporting obligations
Where appropriate, we will inform you that information has been shared unless doing so would place someone at risk or prevent a lawful investigation.
How Long We Keep Your Information
The Practice retains records in accordance with the NHS Records Management Code of Practice 2021 and other applicable legal requirements.
Healthcare records are retained for specified periods depending on the type of record and applicable legislation.
Records are securely destroyed when they are no longer required.
Further information about retention periods is available upon request.
Your Rights
Under UK GDPR and the Data Protection Act 2018, you have rights regarding your personal information.
These include:
Right to be Informed
You have the right to know how your information is used.
Right of Access
You may request a copy of information we hold about you.
Right to Rectification
You may request correction of inaccurate or incomplete information.
Right to Restrict Processing
In certain circumstances you may request restrictions on how information is used.
Right to Object
You may object to certain types of processing.
Right to Data Portability
Where applicable, you may request transfer of your information to another healthcare provider.
Rights Relating to Automated Decision-Making
You have rights regarding decisions made solely by automated processes.
Some rights may be limited where exemptions apply under healthcare legislation.
Subject Access Requests
You have the right to request access to information we hold about you.
Requests should be made in writing to the Practice.
There is normally no charge for providing information.
We will respond within one calendar month unless an extension is permitted by law.
We may ask for proof of identity before releasing information.
Updating Your Information
It is important that the information we hold about you is accurate and up to date.
Please notify the Practice promptly if any of the following change:
- Name
- Address
- Telephone number
- Email address
- Next of kin details
- Emergency contact details
Online Services
Patients may access certain services online, including:
- NHS App
- Online consultation services
- Appointment booking
- Repeat prescription requests
- Access to parts of their medical record
Patients are responsible for keeping login credentials secure and preventing unauthorised access to their accounts.
Website and Cookies
This Privacy Notice applies only to The Deepings Practice website.
The website may use cookies to improve functionality and user experience.
Details of cookies used are provided within the Practice Cookie Policy.
Links to external websites are provided for convenience. The Practice is not responsible for the privacy practices or content of external websites.
CCTV
The Practice operates CCTV systems for the purposes of:
- Protecting patients, staff, and visitors
- Preventing and detecting crime
- Protecting Practice property
CCTV does not operate within consulting or treatment rooms.
Access to CCTV recordings is restricted to authorised personnel.
Recordings are retained only for as long as necessary in accordance with Practice policy.
Telephone Call Recording
Telephone calls to and from the Practice may be recorded for:
- Staff training
- Quality assurance
- Investigation of complaints
- Patient safety
- Service improvement
Access to recordings is restricted to authorised staff.
Recordings are retained in accordance with the Practice retention schedule.
Confidentiality and Security
The Practice takes the security of your information seriously.
Measures include:
- Secure NHS systems
- Access controls
- Encryption
- Staff confidentiality training
- Confidentiality agreements
- Cyber security controls
- Audit logging and monitoring
All staff have a legal duty to maintain confidentiality.
Complaints
If you have concerns about how your information has been handled, please contact the Practice Manager.
We will investigate concerns promptly and seek to resolve them fairly.
If you remain dissatisfied, you have the right to complain to the Information Commissioner’s Office (ICO).
Information Commissioner’s Office
Changes to This Privacy Notice
This Privacy Notice may be reviewed and updated periodically to reflect changes in legislation, guidance, or Practice procedures.
Additional Privacy Notice - AI Scribe Tools
As part of the Digital First National programme of work, GP Practices are required to record accurate data about patient interaction, especially within consultations. To assist with this administrative task, the practice is using a new technology known as AI Scribe, namely Heidi and Anima.
The primary purposes include improving clinical documentation, aiding healthcare professionals in notetaking, and generating consult summaries. Both technologies enable clinicians to focus on patients during the consultation, contributing to improved patient care. It also acts as a valuable tool for medical practitioners, saving them hours of administrative time per week.
They work by transcribing speech into text from a healthcare encounter such as conversations between clinicians and patients or by clinicians dictating their clinical findings, impression and/or management plans before, during and after the healthcare encounter. The clinician can also add additional contextual notes about the healthcare encounter.
These systems are designed to alleviate the administrative burden on healthcare professionals, allowing them to focus more on patient care rather than paperwork. The AI Scribe will leverage natural language processing (NLP), speech recognition technology, and machine learning algorithms to understand and interpret complex medical dialogue, identify key health information, and categorise data into the appropriate sections of an Electronic Health Record (EHR).
Your consent will be sought for consultations that are transcribed using the AI scribe tools. They also use aggregated de-identified information from these consults to improve its models and outputs, ultimately improving both patient care and clinician experience.
All Data that identifies you stays within the practice and its servers which are UK based, no identifiable data is used by the AI Scribe tools for machine learning.
AI Scribe will not make decisions about your care, it only transcribes verbal interactions with the practice, with your consent.
Additional Privacy Notcice - OpenSAFELY
NHS England has been directed by the government to establish and operate the OpenSAFELY COVID-19 Service and the OpenSAFELY Data Analytics Service. These services provide a secure environment that supports research, clinical audit, service evaluation and health surveillance for COVID-19 and other purposes.
Each GP practice remains the controller of its own GP patient data but is required to let approved users run queries on pseudonymised patient data. This means identifiers are removed and replaced with a pseudonym.
Only approved users are allowed to run these queries, and they will not be able to access information that directly or indirectly identifies individuals.
Patients who do not wish for their data to be used as part of this process can register type 1 opt out with their GP.