This website would like to use analytics cookies. These send information about how our site is used to a service called Google Analytics. We use this information to improve our site.
Let us know if this is OK. We'll also use a cookie to save your choice. You can read more about how Google uses cookies.
We also have an easy read version of this page, if you would like a quick summary of this notice, please visit this page: Privacy Notice (Easy Read)
This privacy notice describes the data, the practice holds about you, why we hold it, where and how we store it, how long for and how we protect it. It also tells you about your rights under the Data Protection Legislation and how the law protects you.
We are Lissonwell – officially known as Lisson Grove and Woolwell Medical Centres (Practice Code: L83147). We’re one GP practice working across two sites:
We are the Data Controller for your information. We hold your data in order to provide you with health and social care.
This privacy notice explains:
This privacy notice applies to personal information processed by or on behalf of the practice.
This Notice explains
The UK General Data Protection Regulation (UK GDPR), together with the Data Protection Act 2018, sets out how personal data must be handled and protected.
For the purposes of applicable data protection legislation (including but not limited to the UK General Data Protection Regulation and the Data Protection Act 2018), the practice is the Data Controller responsible for your personal data.
This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights.
The practice will be what’s known as the ‘Controller’ of the personal data you provide to us.
We collect personal data about you, including both basic personal information and special category data (such as health information), in order to provide you with safe and effective care. This includes:
1. Basic Personal Details
2. Health and Sensitive Data (known as ‘special category data’)
Your health records help us to provide safe, high-quality care, refer you to other services if needed, ensure we’re offering the right treatments and monitor how well services are working. For example, we may use your data for Risk Stratification, where we use secure tools to identify patients who may need extra support to prevent illness, or for Medicines Management, allowing us to review prescriptions to ensure you’re getting the most suitable efficient treatments.
We lawfully use your data in order to provide you with Healthcare services as a General Practice, under the following legal grounds:
Why do we need your information?
The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Emergency care.). These records help to provide you with the best possible healthcare.
NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which the practice hold about you may include the following information;
To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.
How do we maintain the confidentiality of your records?
We are committed to protecting your privacy and will only use information collected lawfully in accordance with:
Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.
We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles.
Our practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the UK General Data Protection Regulation (UK GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data related to our patients will be protected.
All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for the practice an appropriate contract (art 24-28) will be established for the processing of your information.
In certain circumstances where we rely on your consent, you may have the right to withdraw your consent to the processing of data. Please contact the Data Protection Officer in writing if you wish to withdraw your consent. If some circumstances we may need to store your data after your consent has been withdrawn to comply with a legislative requirement.
Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes.
With your consent we would also like to:
We would like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions were authorised research facilities would like you to take part on innovations, research, improving services or identifying trends.
At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place. This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the practice DPO as below.
Where do we store your information Electronically?
All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance this information may be located on servers within the European Union.
We only share your personal data with third parties where it is lawful to do so and appropriate safeguards are in place. We have a Data Protection regime in place to oversee the effective and secure processing of your personal and/or special category (sensitive, confidential) data.
Who are our partner organisations?
We are part of the Shared Record System for Devon and Cornwall, and healthcare staff can see the details held by GP practices, hospitals and other health and care organisations across Devon, Cornwall and the Isles of Scilly. As part of, and in addition to this, we may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;
You will be informed who your data will be shared with and in some cases asked for consent for this to happen when this is required.
We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor for the practice an appropriate contract (art 24-28) will be established for the processing of your information.
How long will we store your information?
We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements. More information on records retention can be found online at (https://transform.england.nhs.uk/media/documents/NHSX_Records_Management_CoP_V7.pdf)
How can you access, amend move the personal data that you have given to us?
Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.
Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.
Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example for a research project), or consent to market to you, you may withdraw your consent at any time.
Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to “erase” your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data are collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so.
Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this with a GP to GP data transfer and transfer of your hard copy notes
Access to your personal information
Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:
What should you do if your personal information changes?
You should tell us so that we can update our records. Please contact the practice as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), the practice will, from time to time, ask you to confirm that the information we currently hold is accurate and up-to-date.
The practice’s website uses cookies. A cookie is a small file, typically of letters and numbers, downloaded on to a device (like your computer or smart phone) when you access certain websites. Cookies allow a website to recognise a user’s device. Some cookies help websites to remember choices you make (e.g. which language you prefer if you use the Google Translate feature). Analytical cookies are to help us measure the number of visitors to our website. The two types the practices uses are ‘Session’ and ‘Persistent’ cookies.
Some cookies are temporary and disappear when you close your web browser, others may remain on your computer for a set period of time. We do not knowingly collect or intend to collect any personal information about you using cookies. We do not share your personal information with anyone. Most web browsers allow some control of most cookies through the browser settings.
To find out more about cookies, including how to see what cookies have been set and how to manage and delete them, visit: http://www.allaboutcookies.org/
Our Data Protection Officer is Delt Shared Services Ltd.
We regularly review and may update this notice. The latest version will always be available on our website. If you have any questions, contact us at lissongrove@nhs.net
