How We Use Your Data
We use the information we receive from you, together with information we have obtained from our dealings with you (including in relation to services we provide to you) to continue to allow us to provide services that you request, to communicate with you, and to personalise information sent to us regarding your health from other Health Care Providers. Examples of how we may personalise information include using your information in generating referrals for you, looking at treatment options for you and deciding on further healthcare needs you may have in the future.
We are also a Research Practice and may contact you in regards to research trials that the surgery have been invited to take part in. We may invite you to take part in a study, your information will not be divulged to any research trial without your explicit consent.
Information to be provided where personal data is collected from the data subject
Where personal data relating to a data subject is collected from the data subject, the controller shall, at the time when personal data is obtained, provide the data subject with all of the following information:
The identity and the contact details of the controller and, where applicable, of the controller’s representative
The contact details of the data protection officer, where applicable
The purposes of the processing for which the personal data are intended as well as the legal basis for the processing
The recipients or categories of recipients of the personal data, if any;
We do not sell, trade, or rent your personal information to others.
We store all the information you provide us, including information provided via forms you complete on our secure server. Our server is secured in line with GDPR regulations and is fully risk assessed annually. Any new information you provide us may be used to update an existing record we hold for you. If you provide a work or home email address we will not be responsible for third parties having access to any communications we send.
Third parties, for instance pharmacies may deliver some of our products to you, or provide all or part of the service requested by you. In these instances, while the information you provide will be disclosed to them, it will only be used for the administration of the service provided (for instance prescriptions).
We ask for your home, mobile phone number, and email address to enable us to contact you in regards to your healthcare.
We make outbound phone calls for a number of reasons including changing of appointments or other administrative tasks. We will only call the number that is contained within your medical record. We cannot call you back to a number that is not contained within the registration portal on your medical record.
We may invite you in for an appointment based on your healthcare needs. We will only ever write to the address that is contained within your medical record.
If we provide information to a third party it is for healthcare purposes if the party we are sending to process data we will exercise the strictest control over the third party contractually, requiring it and any of its agents and/or suppliers to:
- maintain the security and confidentiality of the information and restrict access to those of its own employees
- use the data for the agreed purpose only and prevent it being used for any other purpose by any other party
- refrain from communicating with you other than concerning the healthcare issue in question
- once you have left the practice we will hold your data in the timeframe laid down in GDPR regulations
In addition, we will restrict the information disclosed to the absolute minimum necessary, for example, to provide the product or service.
Our own security procedures mean that we may occasionally have to request proof of identity.
In the event of phone calls from you, we also reserve the right to ask security questions (which we in our sole discretion deem appropriate) in order to satisfy ourselves that you are who you say you are.
As a primary care provider and part of the National Health Service we do participate in medical research projects. Please rest assured that your data is not shared with any research provider without your express consent. All research projects are undertaken with NIHR Clinical Research Network or providers that are ISO2700 and ICH-GCP certified and also NHS IG compliant. We also ensure that all research providers adhere fully with the DPA 1988 and GDPR legislation.
Before you provide any data to us we will endeavor to make it clear why we need it. As a Health Care Provider we need to use what is called sensitive personal data (this is your medical history). When this is required we will obtain your consent first. Consent is required for each instance of access when the request comes from another data controller or provider that does not process their data in line with that of GDPR Article 9:
processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;
Certain exceptions may be made in regards to the collection of medications by your spouse or nominated person. These exceptions have been fully risk assessed and a copy of this assessment is available upon request. The nominated person must detail on the patient record when picking up a controlled drug.
Links to other sites on our Website
How you can control cookies
If cookies are disabled on your device you will still be able to use most of this site. However it may limit what you can do.
How you manage your cookies depends on your browser. To find out which browser you use:
PC: open your browser and go to the Help menu and then click on the ‘About’ option.
Apple Macintosh: open your browser and go to the Apple menu and then click on the ‘About’ option.
Mobile device: check your settings.
If you would like to know more about cookies you can visit www.allaboutcookies.org which explains in detail how they can work and can be managed.
Disclosure of information to third parties
As previously mentioned, we do not sell, trade or rent your information, and will never disclose information about you (including information obtained from our dealings with you) to third parties, except:
We may of course be obliged at law to pass on your information to the police or any other statutory or regulatory authority and in some cases, exemptions may apply under the GDPR Act, whereby we can legitimately release personal data as required to by law.
Subject access requests
You have a statutory right of access to accessible personal and/or sensitive personal data that we hold about you. In order to exercise this right, your application must be in writing for security reasons.
Subject Access Requests will be provided free of charge except:
Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:
Charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or
Refuse to act on the request.
The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.
Without prejudice to Article 11 of the Act, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.
Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 of GDPR in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:
The prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security
Other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security
The protection of judicial independence and judicial proceedings;
The prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;
A monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);
The protection of the data subject or the rights and freedoms of others;
The enforcement of civil law claims.
In particular, any legislative measure referred to in the paragraph above shall contain specific provisions at least, where relevant, as to:
The purposes of the processing or categories of processing
The categories of personal data
The scope of the restrictions introduced
The safeguards to prevent abuse or unlawful access or transfer
The specification of the controller or categories of controllers
The storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing
The risks to the rights and freedoms of data subjects
The right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction
Security of Processing
Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, as the controller we shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:
The pseudonymisation and encryption of personal data;
The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services
The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;
A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.
In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, un-authorised disclosure of, or access to personal data transmitted, stored or otherwise processed.
As the controller we shall take steps to ensure that any natural person acting under the authority of us as the controller who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.
IP addresses and log file data on the Budbrooke Medical Centre site, does not automatically capture or store personal information, other than logging the user’s IP Address or the location of your computer or network on the Internet, for systems administration and troubleshooting purposes. (If you are connected to the Internet you have an IP address, for example, an IP address might read “184.108.40.206”). We do not use IP addresses in the aggregate to track which pages people visit in order to improve the quality of the site.
Data collection and use You may be asked for personal information if you complete one of the forms on this site. We will only use the information about you for the purpose for which you provide it. Personal information to our website is stored on secure servers. We will never sell or share your personal information with other organisations for their direct marketing purposes without your explicit consent. We do not hold any personal information about you on our website. If you would like further information our data protection officer will be happy to assist you.
Online Registration When you register with the practice on our site or subscribe to our emails, we ask you for information such as name address telephone number previous GP etc. This is used only to register you as a patient on our clinical system this information is not kept in any other format or file.
How we protect your information Our website has security measures in place to protect against the loss, misuse or alteration of the information under our control. When you contribute online, we use a secure server to protect your personal information during transmission.
Opt out Form
All health and care organisations in England are required to apply your national data opt-out in line with the policy by March 2020, including hospitals and GP practices. Your type 2 opt-out only applied to confidential patient information being shared by NHS Digital.
National data opt-outs are not recorded at the GP practice and instead you can change your national data opt-out using the online service or by calling our contact centre. 03003035678
Young adults from the age of 13 can set and change their own national data opt-out.
You can also tell your GP practice if you do not want your confidential patient information held in your GP medical record to be used for purposes other than your individual care. This is commonly called a type 1 opt-out. This opt-out request can only be recorded by your GP practice.
Type 2 opt-out: information held by NHS Digital
Previously you could tell your GP practice if you did not want us, NHS Digital, to share confidential patient information that we collect from across the health and care service for purposes other than your individual care. This was called a type 2 opt-out.
The type 2 opt-out was replaced by the national data opt-out. Type 2 opt-outs recorded on or before 11 October 2018 have been automatically converted to national data opt-outs.
GP practices will no longer use the type 2 opt out code to record a patient's opt out choice.
Type 2 opt-outs are those opt-outs recorded on the patient record to prevent NHS Digital sharing confidential patient information for research and planning. These were previously managed by the patient’s GP practice making a coded entry into the patient's record. If you have already opted out then your existing type 2 opt-out will automatically be converted into the national data opt-out.
You have a choice. If you are happy for your information to be used for research and planning you do not have to do anything. If you have any concerns and wish to prevent this from happening, you can choose to opt out. To find out how to do this, and for more information on the NHS national data opt out programme, please visit the link below
This link will also provide you with information regarding how to cancel an existing opt-out choice, should you wish to do so