Privacy

Privacy notice

As data controllers, GPs have fair processing responsibilities under the Data Protection Act 2018 and the General Data Protection Regulation (GDPR). This means ensuring that your personal confidential data (PCD) is handled in ways that are safe, transparent and what you would reasonably expect. Please find documents and links below.

Full policy documents

• Dunrobin Street Medical Centre GP GDPR Privacy Notice v3.10 June 2026 EMIS Practices GP Connect NOA and CHIS CP IS
• National Opt out policy v1.1 October 2025

Data Protection Officer

The Practice Data Protection Officer is Paul Couldrey of PCIG Consulting Limited.

Any queries regarding Data Protection issues should be addressed to him at:

Email: [email protected]

Postal:

PCIG Consulting Limited
7 Westacre Drive
Quarry Bank
Dudley
West Midlands
DY5 2EE

Practice Privacy Notice

EMIS Practices

Version: 3.10

Date: 04/06/2026

This template is for use by Practices to Comply with the UKGDPR requirement to display a Privacy Notice regarding processing of patient data.  The template is Generic in design as PCIG Consulting have clients across the UK, local sharing arrangements and area specific sharing or processing will need to be added by the practice.

EMIS Practices

The introduction of EMIS web activities has been added to this Privacy Notice, a DPIA to support this processing is available from PCDC.

What you can expect from your practice.

This guide tells you what to expect from your general practice (GP) and how you can help them, so you get the best from the National Health Service (NHS). More details can be found through the links below.

When and how can you contact your general practice?

Your general practice is open from 8.00am to 6.30pm, Monday to Friday.

Throughout these hours you, or your carer on your behalf, can:

• Visit the practice
• Call them
• Go online using the practice’s website or the NHS App.

You can choose the way you contact your practice based on what is best for you. Some practices may have longer hours or may ask that you contact them via phone or in person for urgent queries.

What if the practice is closed?

If you need urgent help for your physical or mental health when the general practice is closed, and you cannot wait until they open, go online to 111.nhs.uk or call 111. They will tell you what to do next.

What if it’s an emergency?

If it’s a serious or life-threatening emergency, go straight to A&E (Accident and Emergency) or call 999.

What happens when you contact your practice to request an appointment?

Whether you make your request by phone, on-line or visiting your practice, you may be asked to give your practice some details so that they can assess what is best for you based on your clinical need. The practice team will consider your request for an appointment or medical advice and tell you within one working day what will happen next.

This could be:

• An appointment that day or a subsequent day
• A phone call that day or a subsequent day
• A text message responding to your query
• Advice to go to a pharmacy or another NHS service.

Your practice will decide what is best for you based on your clinical need.

Your practice cannot tell you to just call back the next day.

Who might help you?

You might be offered a face-to-face appointment or a phone call with a GP or other member of the practice staff, like a nurse or pharmacist.

If you have a carer, they can speak for you with your consent.

You can ask to see a preferred healthcare professional, and the practice will try to meet your request, although you might have to wait longer for that person to be available.

It can be helpful to see the same healthcare professional, particularly if you have a long-term health condition.

From what age can you see a GP on your own?

If you are 16 or older, you can make and go to appointments by yourself.

If you are under 16, you can still ask to see a GP without your parent or guardian. The GP will decide if that’s appropriate for you.

What if you need extra help?

If you do not speak English, you can ask for interpretation services in your preferred language when you make an appointment.

If you need extra help like longer appointments, a quiet space, wheelchair access, or information in a different format, tell your practice and they will try to help.

How do you choose a general practice?

You can:

• Call or visit a local practice
• Use Find a GP online.

If you want to change to a new general practice you can do so at any point. Most people have a few choices nearby.

Do you need ID or proof of address?

No, you do not need ID, an NHS number or proof of address. It can help the practice if you do, but it is not needed to register or see a GP.   You can also register with a practice if you are homeless.

Can a practice say no to registering you?

They must write to you within 14 days if they say no and explain why. A practice can only say no for a good reason, like if you live too far away or their patient list is closed. For example, they cannot say no for reasons such as immigration status, not having a permanent address, or for reasons connected with other characteristics protected under equalities legislation.

Can you choose which hospital or clinic you are referred to?

If your GP needs to refer you for a physical or mental health condition, in most cases you have the right to choose the hospital or service you’d like to go to. You can get further information on your right to choose on the nhs.uk website.

If you are new to the UK

You can still register with a GP. It’s free to use and your immigration status does not affect your right to register with a GP.

If you are away from home but still in the UK

If you are away from home for more than 24 hours (but less than 3 months), you can register as a temporary patient near where you’re staying.

You can also change your nominated pharmacy so you can get your medicine nearby. You can do this by contacting your practice or via the NHS App.

Do general practices charge for anything?

NHS GP services are free.  Sometimes, if you ask the GP to do private work (like writing a letter for insurance), they may charge a fee.

How should everyone be treated?

The practice should treat everyone fairly, kindly and respectfully.  Likewise, you should also treat staff with respect.  The practice can remove patients from their list if they are violent or abusive to staff.

To learn more about your rights, you can read the NHS Constitution.

How can you help your general practice?

1. Be prepared: Before an appointment, think about writing down your symptoms, what you are worried about and what you want to talk about.
2. Be on time: Being late for an appointment or being unavailable for a timed call-back can affect other patients.
3. Cancel if needed: If you can’t go to your appointment, tell the practice as soon as you can, so that they can offer it to someone else.
4. Use the NHS App or website: If you’re confident using smart phones or computers, you can book or cancel appointments, order repeat prescriptions, and see your test results online.
5. Turn on notifications: If you use the NHS App, turn on notifications so the practice can contact you more easily.  Please keep an eye out for messages.
6. Order repeat medicines on time: Make sure you ask for repeat prescriptions on time, so you don’t run out, and only order what you need.
7. Join the Patient Participation Group: You practice will have a group of patients who can offer feedback on the services it delivers. Your practice website should explain how you can join.

How can you give feedback or raise concerns?

If you want to give feedback, raise a concern or wish to make a formal complaint, ask to speak to the practice manager. If you don’t feel comfortable doing this, contact your integrated care board (ICB) – the local NHS body that oversees GPs practices. You can find your local integrated care on the NHS England website.
You can also give feedback about your practice to your local Healthwatch. Their job is to make sure NHS leaders and other decision-makers hear your voice and use your feedback to improve care. Healthwatch is independent and impartial, and any information you share with them is confidential. To find your local Healthwatch visit the Healthwatch website.

RAPID HEALTH

For more information about this service see here:-

https://vimeo.com/948772217/f3e9d87d1b

NHS login

If you access Rapid Health using your NHS login details, the identity verification services are managed by NHS England.

NHS England is the controller for any personal information you provided to NHS England to get an NHS login account and verify your identity and uses that personal information solely for that single purpose. For this personal information, our role is a “data processor” only and we must act under the instructions provided by NHS England (as the “data controller”) when verifying your identity.

For more information on NHS login, see the NHS login privacy notice and NHS login terms and conditions.

NHS App

You can access Rapid Health on the NHS App using your NHS login details.

If you sign in using NHS login, we will ask your permission to share your NHS login information with our service. This allows us to fill in some personal details for you, such as
your name, date of birth and contact details.

We will not use your NHS login information for any other purposes. You can only share your NHS login information if you have proved your identity to NHS login.

You can choose not to share your NHS login information with Rapid Health but you will need to enter your information yourself whilst using the service.

For more information, see the NHS login privacy notice and NHS login terms and conditions.

Dunrobin Street Medical Centre (the Practice)

Data Protection Privacy Notice for Patients

Introduction:

This privacy notice lets you know what happens to any personal data that you give to us, or any information that we may collect from you or about you from other organisations.

This privacy notice applies to personal information processed by or on behalf of the practice.

This Notice explains

• Who we are and how we use your information
• Information about our Data Protection Officer
• What kinds of personal information about you we hold and use (process)
• The legal grounds for our processing of your personal information (including when we share it with others)
• What should you do if your personal information changes?
• For how long your personal information is retained / stored by us?
• What are your rights under Data Protection laws

The UK General Data Protection Regulation (UKGDPR) and the Data Protection Act 2018 (DPA 2018) became law on 25th May 2018, and 1st January 2021 when the UK exited the EU.

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (UK) 2016/679) (the “UKGDPR”), and the Data Protection Act 2018 the practice responsible for your personal data is Dunrobin Street Medical Centre.

This Notice describes how we collect, use and process your personal data, and how in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights.

How we use your information and the law

Dunrobin Street Medical Centre will be what’s known as the ‘Controller’ of your personal data.

We collect basic personal data about you and location-based information.  This does include name, address and contact details such as email and mobile number etc.
We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity and sex life information that are linked to your healthcare, we may also receive this information about you from other health providers or third parties.

Why do we need your information?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously.  These records help to provide you with the best possible healthcare and treatment.

NHS health records may be electronic, paper-based or a mixture of both.  We use a combination of working practices and technology to ensure that your information is kept confidential and secure.

Records about you may include the following information;

• Details about you, such as your address, your carer or legal representative and emergency contact details.
• Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments.
• Notes and reports about your health.
• Details about your treatment and care.
• Results of investigations such as laboratory tests, x-rays etc.
• Relevant information from other health professionals, relatives or those who care for you.
• Contact details (including email address, mobile telephone number and home telephone number)

To ensure you receive the best possible care, your records are used to facilitate the care you receive, including contacting you. Information held about you may be used to help protect the health of the public and to help us manage the NHS and the services we provide. Limited information may be used within the GP practice for clinical audit to monitor the quality of the service we provided.

How do we lawfully use your data?

We need your personal, sensitive and confidential data in order to provide you with healthcare services as a General Practice, under the General Data Protection Regulation we will be lawfully using your information in accordance with: –

Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

We use your personal and healthcare information in the following ways:

• when we need to speak to or contact other doctors, consultants, nurses or any other medical/healthcare professional or organisation during your diagnosis or treatment or ongoing healthcare; this includes the use of telephone or video consultation.
• when we are required by law to hand over your information to any other organisation, such as the police, by court order, solicitors, or immigration enforcement.
• In a de-identified form to support planning of health services and to improve health outcomes for our population

We will never pass on your personal information to anyone else who does not need it, or has no right to it, unless you give us consent to do so.

Legal justification for collecting and using your information

The law says we need a legal basis to handle your personal and healthcare information.

Contract: We have a contract with NHS England to deliver healthcare services to you. This contract provides that we are under a legal obligation to ensure that we deliver medical and healthcare services to the public.

Consent: Sometimes we also rely on the fact that you give us consent to use your personal and healthcare information so that we can take care of your healthcare needs.
Please note that you have the right to withdraw consent at any time if you no longer wish to receive services from us.

Necessary care: Providing you with the appropriate healthcare, where necessary. The Law refers to this as ‘protecting your vital interests’ where you may be in a position not to be able to consent.

Law: Sometimes the law obliges us to provide your information to an organisation (see above).

Special categories

The law states that personal information about your health falls into a special category of information because it is very sensitive. Reasons that may entitle us to use and process your information may be as follows:

Public Interest: Where we may need to handle your personal information when it is considered to be in the public interest. For example, when there is an outbreak of a specific disease and we need to contact you for treatment, or we need to pass your information to relevant organisations to ensure you receive advice and/or treatment

Consent: When you have given us consent

Vital Interest: If you are incapable of giving consent, and we have to use your information to protect your vital interests (eg if you have had an accident and you need emergency treatment)

Defending a claim: If we need your information to defend a legal claim against us by you, or by another party

Providing you with medical care: Where we need your information to provide you with medical and healthcare services

AccuRX

As part of the Digital First National programme of work, GP Practices are required to provide a tool for patients to access primary care services.

The aim of the Accurx platform is to improve communications between healthcare staff and patients resulting in improved outcomes and productivity. The platform facilitates digital communications between the practice and our patients.

Using the Accurx platform will require the processing of special category data by Accurx, their sub-processors and by default the GP Practice as a Controller. This will include; exchanging and storing messages in relation to patients and medical staff, performing video consultations (these will not be recorded or stored) between healthcare staff and their patients This will allow you to respond to the Practice in multiple ways such as; free text, questionnaires and submitting images/documents.

If you have a non-urgent healthcare concern or need to contact the Practice for any medical or admin reason, click on the online via our website or via NHS app or via NHS website. Fill out the online form, which will then be reviewed and processed by our healthcare professionals to decide the right care for you. We will respond to every online request 2 workings days.

Accurx is approved by NHS England to be used by GP practices and the other systems involved in patient care. NHS England has a lengthy assurance process to make sure they meet the highest standards of safety and security. Your data is safe and is shared only with your GP Practice for the purposes of your direct care. Your data is stored and sent securely using industry best practices, and Accurx only collect the data that is necessary to allow your GP Practice to provide you with care.

The Practice uses the following Accurx features:

• SMS, Friends and Family test, online consultations, video consultations, AccuMail and Record Views

Accurx’s privacy notice can be found on their website here: Accurx – Privacy Policy

GP Connect System and Data Sharing

Dunrobin Street Medical Centre has reviewed the National Data Sharing Arrangement (NDSA) for GP connect. GP Connect helps clinicians gain access to GP patient records during interactions away from a patient’s registered practice and makes their medical information available to appropriate health and social care professionals when and where they need it, to support the patient’s direct care.

From a privacy, confidentiality and data protection perspective, GP Connect provides a method of secure information transfer and reduces the need to use less secure or less efficient methods of transferring information, such as email or telephone.

GP Connect – key points.

• GP Connect can only be used for direct care purposes.
• Individuals can opt out of their GP patient record being shared via GP Connect by contacting their GP practice.
• Access to GP Connect is governed by role-based access control (RBAC) and organisational controls; only people who need to see the GP patient record for a patient’s direct care should be able to see it
• All systems that allow the use of GP Connect must undergo a robust compliance process and the organisations involved must sign a connection agreement holding them to high standards of information security.

GP Connect products can help health and social care professionals share, view or act on information that could be required for a patient’s direct care, but they would otherwise have difficulty accessing easily (for example if they are using different IT systems).

Organisations can have access to relevant information in GP patient records to provide direct care to patients only.

Type of organisations that use GP Connect

Examples of organisations that may wish to use GP connect to view GP patient records include:

• GP surgeries that patients are not registered at – for example, if they need to see a doctor when they are away from home
• secondary care (hospitals) if they need to attend A&E or are having an operation
• GP hubs/primary care networks (PCNs)/integrated care systems (ICSs), partnerships between healthcare providers and local authorities
• local ‘shared care’ record systems
• ambulance trusts, so paramedics can view GP patient records in an emergency
• healthcare professionals such as community services
• acute and emergency care service providers
• NHS 111
• pharmacies
• optometrists
• dentistry
• mental health trusts
• hospices
• adult and children’s social care
• care and nursing homes

The government and NHS England are determined to improve people’s access to, and experience of, GP services. From 1 October 2025 practices will be required to keep their online consultation tool open for the duration of core hours (8am – 6:30pm) for non-urgent appointment requests, medication queries and admin requests.

GP Connect is a service that allows information and the GP Patient Record to be viewed and shared between IT systems. This means authorised clinical staff from different healthcare settings can share and view clinical information held by a GP practice.

The sharing of records is only for the purpose of direct care, and by medical examiners for the statutory purpose of reviewing deaths, where the patient is being treated or consulted in a setting away from their regular GP. GP Connect respects patient consent choices and will not share their data if the patient has asked their GP not to.

This will :-

• allow read only access to patients’ care records (GP Connect Access Record HTML and Structured) by other NHS commissioned providers, for the purposes of direct patient care and read only access for providers of private healthcare (only in cases where the private provider obtains explicit permission from the patient to access their NHS GP care record, and they are providing direct care to the patient).
• allows Community Pharmacy registered professionals to send consultation summaries into the GP practice workflow (GP Connect Update Record).

Patients should contact their GP practice if they want to opt out of their patient GP record being shared via GP Connect

GP Connect can be used in a variety of care settings but can only be used for the purpose of direct care, and by medical examiners for the statutory purpose of reviewing deaths, as per NHSE legal directions.

Full details about GP connect can be found here: –

https://digital.nhs.uk/services/gp-connect/gp-connect-in-your-organisation/transparency-notice.

Confidentiality

Confidentiality and trust are essential to the relationship between GPs and their patients.
The information a patient provides to their GP is confidential, and they can expect that any information that is shared for their direct care will remain confidential.

GP Connect relies on ‘implied consent’.

Explicit consent is not required when information is shared for a direct care purpose. If a patient does not want their information to be shared using GP Connect, they can opt out.

The NDSA and its terms and conditions stipulate that any information received or accessed about a patient for direct care purposes must remain confidential.
In addition to the NDSA, health and social care professionals are also subject to their own professional codes of confidentiality and are aware that any information received via GP Connect is provided in confidence, which must be respected.

Organisations using GP Connect are notified of their duty as ‘controllers’ to be fair and transparent about their processing of their patients’ information and to ensure that their transparency notices are fully updated with how they may be using GP Connect functionality.

NHS England helps support the mitigation of information sharing risks by ensuring that:

• NHS England audit data access is subject to two-factor authentication and role-based access controls – only certain assured users can have access to the full audit logs
• a completed Supplier Conformance Assessment List (SCAL) which covers service and capability specific compliance requirements and controls of the consumer system is in place

It is the responsibility of organisations using GP Connect to ensure that they comply with the NDSA, and their statutory and legal obligations regarding data protection and confidentiality.

Opting out of GP Connect

If patients do not wish their information to be shared using GP Connect, they can opt out by contacting their GP practice.

The National Record Locator (NRL)

The National Record Locator (NRL) is one of a number of services that was set up under the NHS Digital Establishment of Systems: Digital Interoperability Platform (DIP) Directions 2019The purpose of the DIP was to “develop and operate such IT applications, IT infrastructure and IT systems as are necessary to deliver the digital interoperability platform”,  The Secretary of State considered (in accordance with Section 254(2)(b) of the Health and Social Care Act 2012),  that it was “in the interests of the health service in England or of the recipients or providers of adult social care in England” that these Directions be given.  Since NHS Digital has merged with NHS England, all services set up under this Direction are now managed by NHS England.

The NRL is a national index of pointers to the location of Patient Records of patients who live in England and/or who are registered with a GP in England. Providers that hold a relevant Patient Record will create a Pointer to the record, which can then be accessed by Consumers for the Agreed Purpose.

Information permitted to share on the NRL (where the document type exists for the patient) is as follows:

• Care plans*
• NEWS2 Report – National Early Warning Scores
• Shared Care Record Summary document
• International Patient Summary

* Care plans:

• mental health crisis plan
• end of life care plan
• emergency health care plan
• treatment escalation plans
• personalised care and support plans
• contingency plans

The Pointer is limited to:

• patient NHS Number
• ODS code for the Holder
• the name of the care setting
• what type of information is held
• A URL to contact details for the Holder (optional)
• A URL to retrieve the information (this is a spine secure proxy for the patient record)
• A location for the record which allows the information to be retrieved via a link or up to date contact details

Access by Consumers is currently view only. Once the Consumer closes the PDF, the Shared Personal Data is no longer accessible to them and if still required must be requested again through the same process.

For queries, please email [email protected].

Personal Data is processed by Providers and Consumers under the following lawful bases:

• Article 6(1)(e) – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;
• Article 6(1)(g) – Reasons of substantial Public Interest (with a basis in law) and with Conditions 11 and 18 under Schedule 1 of the Data Protection Act 2018 and/or;
• Article 9(2)(h) – Health or social care (with a basis in law) – Processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services.

The Common Law Duty of Confidence is met because the processing of personal confidential information is for the purpose of Direct Care. Information may be further shared where the disclosure is necessary to safeguard the individual or others, or for another purpose where it is necessary to do so in the public interest.

Processing will continue until a Party withdraws from the Agreement or the Agreement is otherwise terminated by NHS England.

In accordance with clause 6.2, Personal Data must not be retained except for instances where Shared Personal Data has been used to update the Consumer’s patient medical record for the purposes of Direct Care.

National Data Opt-Out

The National Data Opt-out is a service that allows patients to opt out of their confidential patient information being used for research and planning.

The National Data Opt-out only applies to any disclosure of data for purposes beyond direct care, so having National Data Opt-out will not prevent your GP patient record being shared via GP Connect.

Risk Stratification

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from several sources including NHS Trusts and from this GP Practice. The identifying parts of your data are removed, analysis of your data is undertaken, and a risk score is then determined. This is then provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way in most circumstances, please contact the practice for further information about opt out.
Individual Risk Management at a GP practice level however is deemed to be part of your individual healthcare and is covered by our legal powers above.

Medicines Management

The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments. The reviews are carried out by the ICBs Medicines Management Team under a Data Processing contract with the Practice.

Transferring the current paper medical records into patients’ electronic medical records.

The following provisions of the General Data Protection Regulation permit us to digitise existing paper medical records:

Article 6(1)(e) – ‘processing is necessary…in the exercise of official authority vested in the controller…’’

Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services…’

The paper patient records will be shared with [Scanning provider], who will scan and digitise the current paper medical records before destroying them.  The paper patient records will be shared with the scanning provider above, who will scan and digitise the current paper medical records before destroying them.

Data Shared with NHSE

NHSE may request and be provided with information from our telephone system for national requirements, investigations or audits.  NHSE may request and be provided with information from our online consultation system for national requirements, investigations or audits.

Anonymised information

Sometimes we may provide information about you in an anonymised form. Such information is used analyse population- level heath issues and helps the NHS to plan better services. If we share information for these purposes, then none of the information will identify you as an individual and cannot be traced back to you.

Child Health Information Service

A CHIS is an NHS commissioned service that is responsible for collating data from various organisations for all children aged 0-19 that are either residents or registered with a GP Practice in a specified area, into a single Child Health Record. The child health record begins from birth of the child and monitors the care processes and screening of the child, such as Newborn Blood Spot or hearing assessments through to the various immunisations (stated within the NHS National Vaccination Schedule). Data is received from with organisations such as Public Health, Health Visitors, School Nursing and Immunisations teams to help with increasing vaccination coverage to prevent outbreaks of disease, supporting the healthy child programme, assisting in the delivery of children’s public health services and safeguarding vulnerable children.

The aims of our CHIS services are to:

• Have a Child Health Record for each and every child within our area, regardless of the child is registered at a GP Practice or not
• Obtain all data from the respective care provider(s) for all children for the aspects of care given to each child, for example screening and immunisation
• Provide NHS compliant data sharing arrangements which will allow the appropriate healthcare professionals and parent/guardians to access the child health records
• Eradicate costly paper based data flows with more efficient electronic interfaces to receive the information more quickly

Our CHIS services adhere to the latest NHS England Service Specification and through our innovation and passion to improve the health of children, we meet the aims and objectives of the NHS Child Health Digital Strategy.

The local CHIS service is managed by {Name of Provider}

Research – National Institute for Health & Social Care Research (NIHR) – Clinical Research Network

Clinical Research Network West Midlands (CRN WM) provides a research delivery service to GP practices across the West Midlands. All CRN WM Delivery Support staff are employed by The Royal Wolverhampton NHS Trust. All NHS Staff members who have been allocated to work within the Practice will be issued with a Letter of access or assurance to confirm individual study placements and pre-employment checks.

The legal bases for processing this information

CRN WM processes data under the instruction of the individual research protocol, as delegated by the practice (data controller). You can opt out of being invited to participate in research at any time, please inform a member of the practice team and we will add the appropriate opt out code to your record.

Prior to informed consent:
The legal basis which allows us to process your personal data for research is GDPR article 6 (1)(f) …legitimate interests…except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject…’

Once informed consent has been given:
The legal basis which allows us to process your personal data is informed consent – Article 6 1(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; and Article 9 (2) (a) the data subject has given explicit consent to the processing those personal data for one or more specified purposes.

Individual study consent forms will detail how to withdraw consent and who to contact, this will usually be via the study sponsor.

Categories of personal data

The data processed by CRN WM delivery staff, in addition to demographic and contact details, is likely to be special category information (such as health information) to determine eligibility for individual research studies.

Recipients of data
The data processed by CRN WM delivery staff will be used to invite potentially eligible patients into research studies. Once patients have consented to participate, data processed by the CRN WM delivery staff will be used to answer the research questions as outlined in individual research protocols.
For further information, please refer to the Clinical Research Network West Midlands Privacy Notice: https://local.nihr.ac.uk/documents/crn-wm-privacy-notice-march-2021/27187

Summary Care Records

All patients registered with a GP have a Summary Care Record, unless they have chosen not to have one. The information held in your Summary Care Record gives registered and regulated healthcare professionals, away from your usual GP practice, access to information to provide you with safer care, reduce the risk of prescribing errors and improve your patient experience.

Your Summary Care Record contains basic (Core) information about allergies and medications and any reactions that you have had to medication in the past.
Some patients, including many with long term health conditions, previously have agreed to have Additional Information shared as part of their Summary Care Record. This Additional Information includes information about significant medical history (past and present), reasons for medications, care plan information and immunisations.

Change to information held in your Summary Care Record

In light of the current emergency, the Department of Health and Social Care has removed the requirement for a patient’s prior explicit consent to share Additional Information as part of the Summary Care Record.

This is because the Secretary of State for Health and Social Care has issued a legal notice to healthcare bodies requiring them to share confidential patient information with other healthcare bodies where this is required to diagnose, control and prevent the spread of the virus and manage the pandemic. This includes sharing Additional Information through Summary Care Records, unless a patient objects to this.

If you have already expressed a preference to only have Core information shared in your Summary Care Record, or to opt-out completely of having a Summary Care Record, these preferences will continue to be respected and this change will not apply to you. For everyone else, the Summary Care Record will be updated to include the Additional Information. This change of requirement will be reviewed after the current coronavirus (COVID-19) pandemic.

Why we have made this change

In order to look after your health and care needs, health and social care bodies may share your confidential patient information contained in your Summary Care Record with clinical and non-clinical staff in other health and care organisations, for example hospitals, NHS 111 and out of hours organisations. These changes will improve the healthcare that you receive away from your usual GP practice.

Your rights in relation to your Summary Care Record

Regardless of your past decisions about your Summary Care Record preferences, you will still have the same options that you currently have in place to opt out of having a Summary Care Record, including the opportunity to opt-back in to having a Summary Care Record or opt back in to allow sharing of Additional Information.
You can exercise these rights by doing the following:

Choose to have a Summary Care Record with all information shared. This means that any authorised, registered and regulated health and care professionals will be able to see a detailed Summary Care Record, including Core and Additional Information, if they need to provide you with direct care.

Choose to have a Summary Care Record with Core information only. This means that any authorised, registered and regulated health and care professionals will be able to see limited information about allergies and medications in your Summary Care Record if they need to provide you with direct care.

Choose to opt-out of having a Summary Care Record altogether. This means that you do not want any information shared with other authorised, registered and regulated health and care professionals involved in your direct care. You will not be able to change this preference at the time if you require direct care away from your GP practice. This means that no authorised, registered and regulated health and care professionals will be able to see information held in your GP records if they need to provide you with direct care, including in an emergency.

To make these changes, you should inform your GP practice or complete this form and return it to your GP practice.

Patient Communication

Because we are obliged to protect any confidential information, we hold about you and we take this very seriously, it is imperative that you let us know immediately if you change any of your contact details.

We may contact you using SMS texting to your mobile phone if we need to notify you about appointments and other services that we provide to you involving your direct care, therefore you must ensure that we have your up-to-date details. This is to ensure we are sure we are contacting you and not another person. As this is operated on an ‘opt out’ basis we will assume that you give us permission to contact you via SMS if you have provided us with your mobile telephone number. Please let us know if you wish to opt out of this SMS service. We may also contact you using the email address you have provided to us. Please ensure that we have your up-to-date details.
There may be occasions where authorised research facilities would like you to take part in research. Your contact details may be used to invite you to receive further information about such research opportunities.

The NHS App

We use the NHS Account Messaging Service provided by NHS England to send you messages relating to your health and care. You need to be an NHS App user to receive these messages. Further information about the service can be found at the privacy notice for the NHS App managed by NHS England.

Safeguarding

The Practice is dedicated to ensuring that the principles and duties of safeguarding adults and children are holistically, consistently, and conscientiously applied with the wellbeing of all, at the heart of what we do.

Our legal basis for processing For the General Data Protection Regulation (GDPR) purposes is: –

Article 6(1)(e) ‘…exercise of official authority…’.

For the processing of special categories data, the basis is: –

Article 9(2)(b) – ‘processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law…’

Child protection information sharing system

The Child Protection – Information Sharing (CP-IS) service is a national system (across England) that securely links health and social care records to help protect children who:

• Are looked after by local authorities.
• Are subject to a child protection plan (including unborn child protection plans).
• Have been in either category within the previous 12 months

It enables health professionals to access key safeguarding information when a child presents at a healthcare setting, especially when they are outside their home local authority area.

In England, since 2014, the Child Protection Information Sharing System (CP-IS) has been sharing information between Local Authorities (LAs), unscheduled settings, and ambulance services about unborn babies & children who have a child protection plan and children who are looked after. This information sharing is intended to enable frontline staff who are working with children at risk of abuse or neglect to make well-informed assessments, identify emerging problems, and streamline interagency working to support the children and their families when and where they need it.

CP-IS is currently used across the following unscheduled healthcare settings:

• Emergency Departments (NHS Trusts)
• Minor Injury Units (NHS Trusts)
• Walk in Centres (CCGs/Primary Care)
• Urgent Care Centres/Urgent Treatment Centres
• GP Out of Hours only

The information CP-IS provides comes from and is managed and updated by Local Authorities (Councils) across England with the use of the child’s or mother’s NHS number. It does not include information from health or educational systems such as GP practices, schools, or health visitors (HVs), who continue to use Summary Care Records (SCRs) or the Primary Care Records to access health information.

As part of the NHS Long-Term Plan, it is now a target to make CP-IS available NHS-wide in England.  So, the GP in hours service via the National Care Records Service, CP-IS data will be available and used 2 by December 2025.

This is to support decision-making processes undertaken by front-line NHS health practitioners, CP-IS will provide a limited amount of child protection indicator information (NHS Number, Type, start and end date of any child protection plan a child is on, name and contact details of the responsible LA, and an access history [including date and time] of the previous twenty-five visits to unscheduled care setting) about children at risk of abuse or neglect.

CP-IS does NOT SHARE:

• The child’s full social care file.
• The category of the CPP.
• Details of the child’s parents or carers.
• The reason the child has previously presented for care.
• Medical information.

While CP-IS will only be accessible to practitioners with the correct permissions, all our staff are responsible for ensuring they are aware of and understand this process.

Benefits of CP-IS

Early Intervention – Acting to prevent and or reduce future harm happening to children – With instant access to CP-IS information, communication with the appropriate Social Worker can occur quickly, leading to a better outcome for the child.

Because the Social Worker is notified immediately if a child in their care has presented at an unscheduled care setting, they are better placed to assess whether any intervention is needed to achieve a good outcome for the child.

Improved safety and care – Doing the best when children need help – Because health practitioners (in unscheduled and now scheduled care settings) can see CP-IS information about a child anywhere in England, they will be better equipped to make the right decision about that child’s care.

Increased workforce efficiency and effectiveness – Doing the most for children with the resources we have – Because CP-IS automatically sends information to the NHS Spine daily, it is always up to date.

Research

Clinical Practice Research Datalink (CPRD) collects de-identified patient data from a network of GP practices across the UK. Primary care data are linked to a range of other health related data to provide a longitudinal, representative UK population health dataset.  You can opt out of your information being used for research purposes at any time (see below), full details can be found here: –

https://cprd.com/transparency-information

The legal bases for processing this information

CPRD do not hold or process personal data on patients; however, NHS Digital (formally the Health and Social Care Centre) may process ‘personal data’ for us as an accredited ‘safe haven’ or ‘trusted third-party’ within the NHS when linking GP data with data from other sources. The legal bases for processing this data are:
Medicines and medical device monitoring: Article 6(e) and Article 9(2)(i) – public interest in the area of public health

Medical research and statistics: Article 6(e) and Article 9(2)(j) – public interest and scientific research purposes

Any data CPRD hold or pass on to bona fide researchers, except for clinical research studies, will have been anonymised in accordance with the Information Commissioner’s Office Anonymisation Code of Practice. We will hold data indefinitely for the benefit of future research, but studies will normally only hold the data we release to them for twelve months.

Categories of personal data

The data collected by Practice staff in the event of a safeguarding situation will be as much personal information as is possible that is necessary to obtain in order to handle the situation. In addition to some basic demographic and contact details, we will also process details of what the safeguarding concern is. This is likely to be special category information (such as health information).

Sources of the data

The Practice will either receive or collect information when someone contacts the organisation with safeguarding concerns, or we believe there may be safeguarding concerns and make enquiries to relevant providers.

Recipients of personal data

The information is used by the Practice when handling a safeguarding incident or concern. We may share information accordingly to ensure duty of care and investigation as required with other partners such as local authorities, the police or healthcare professionals (i.e. their GP or mental health team).

GP Connect Service

The GP Connect service allows authorised clinical staff at NHS 111 to seamlessly access our practice’s clinical system and book directly on behalf of a patient. This means that should you call NHS 111 and the clinician believes you need an appointment with your GP Practice, the clinician will access available appointment slots only (through GP Connect) and book you in. This will save you time as you will not need to contact the practice direct for an appointment.

The practice will not be sharing any of your data and the practice will only allow NHS 111 to see available appointment slots. They will not even have access to your record. However, NHS 111 will share any relevant data with us, but you will be made aware of this. This will help your GP in knowing what treatment / service / help you may require.

Please note if you no longer require the appointment or need to change the date and time for any reason you will need to speak to one of our reception staff and not NHS 111.

National Obesity Audit (NOA)

Background:

More than one in four adults are currently living with obesity. We know obesity puts people at greater risk of many serious diseases and increases their chances of associated comorbidities e.g., cancers, cardiovascular disease, type 2 diabetes.

What is the National Obesity Audit?

NHS England has established a National Obesity Audit (NOA) to bring together comparable data from the different types of weight management services across England. For the NOA to be successful, linking to primary care patient-level data is a critical part of the project to enable analysis of longitudinal weight change, to inform improvement aims.

How will the NOA benefit patients?

By linking to GP patient-level data with weight management service data, the NOA will provide information across the weight management pathway to support quality improvements to patient care. For example, equity of access, improving outcomes of weight management services, reducing obesity-related comorbidities, and improving population health.

What information is collected?

The NOA data collection includes both personal data and special categories of personal data relating to patients living with overweight or obesity, including:

• Demographic information – such as NHS number, date of birth, postcode, sex and ethnicity
• Health information – such as Body Mass Index (BMI), obesity-related co-morbidities, healthcare interventions such as weight loss advice and bariatric surgery.

More information on the data used for the purposes of the NOA is available in the NOA dataset specification

How the NOA will use your data

NOA data will be used for the purposes of informing policy and guidelines for managing obesity across the NHS and local authorities.  It will also be used for benchmarking and to enable NHS providers to maximise the use of their resources and to improve patient outcomes.

NHS England will analyse the data held in the NOA to carry out data quality checks, to pseudonymise the data (de-identify) and to derive values, for example turn date of birth into age.

Data in the NOA may also be linked to other data that NHS England holds, including the Hospital Episode Statistics (HES), Cardiovascular Disease Prevention Audit (CVD Prevent) and the Community Services Data Set (CSDS).

NOA data is used to create regular statistical publications on the NHS England website including dashboards and an annual report.  All data published is anonymous and aggregate so that patients cannot be identified from the data.

The data collected for the NOA from the CVD Prevent Audit will not be used for performance management of GPs.

NOA legal basis

Data protection law requires NHS England to have a legal basis before we can use your personal data.

Our legal basis is:

Legal obligation

Article 6(1)(c) of UK GDPR.  This is because the Secretary of State for Health and Social Care has issued NHS England with a Direction to analyse this data for NOA purposes. This Direction is called the National Obesity Audit Directions 2023

We also need an additional legal basis in the UK GDPR and the Data Protection Act 2018 (DPA 2018) to use data which is extra sensitive. This is known as ‘special categories of personal data’. Our legal basis to use data relating to your health and ethnicity is:

Substantial public interest

Article 9(2)(g) of UK GDPR, plus Schedule 1, Part 2, Paragraph 6 “statutory etc and government purposes” of DPA 2018

Health or social care

Article 9(2)(h) of UK GDPR, plus Schedule 1, Part 1, Paragraph 2 “Health or social care purposes” of DPA 2018.

The NOA and NHSE will share this data with

We treat the data we hold with great care. All data which is shared by NHS England is subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the relevant health and social care purpose will ever be shared.

Data is shared or is expected to be shared with organisations such as healthcare providers, clinicians, and commissioners of NHS services, for example:

• the organisation that provided your care: to assess the effectiveness of your care and to improve the services they offer
• The Department of Health and Social Care: to inform policy and guidelines
• organisations responsible for the commissioning of NHS services in England, such as Integrated Care Boards: to plan and improve weight management services and for benchmarking
• local authorities: to help plan and improve weight management services
• research organisations, including universities and charities: to carry out research

These organisations must apply for access to NOA data through NHS England’s Data Access Request Service.  Each application is assessed very carefully to make sure that the organisation:

• has a legal basis to access the data for that purpose
• will use the data for the benefit of health and care and for the agreed purposes only
• will handle and store the data securely

We only share data which can identify you (identifiable data) if this is absolutely necessary and the organisation who has made an application for data cannot achieve their purpose without it.  Where possible we remove information from the data which identifies you, or we replace it with a unique reference number (this is known as pseudonymisation).

Each organisation we share data with must sign a Data Sharing Framework Contract and a Data Sharing Agreement and we carry out audits to check they are using the data as agreed.

Details about the NOA data we have shared with other organisations, except for anonymous data, will be published in the NHS England Data Uses Register.

Read the Full policy document

Dunrobin Street Medical Centre GP GDPR Privacy Notice v3.10 June 2026 EMIS Practices GP Connect NOA and CHIS CP IS

Changes

It is important to point out that we may amend this Privacy Notice from time to time.  If you are dissatisfied with any aspect of our Privacy Notice, please contact the Practice Data Protection Officer.