Privacy Notice

MARKET SURGERY

February 2025

Data Protection Privacy Notice

INTRODUCTION

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.

This privacy notice applies to personal information processed by or on behalf of the practice.

This Notice explains

Who we are, how we use your information and our Data Protection Officer
What kinds of personal information about you do we process?
What are the legal grounds for our processing of your personal information (including when we share it with others)?
What should you do if your personal information changes?
For how long your personal information is retained by us?
What are your rights under data protection laws?

In accordance with the applicable data protection legislation in the UK (The Data Protection Act 2018 and the UK General Data Protection Regulation (UKGDPR)) the practice responsible for your personal data is Market Surgery.

This Notice describes how we collect, use, and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights

HOW WE USE YOUR INFORMATION AND THE LAW

Market Surgery is known as the ‘Controller’ of the personal data you provide to us.

We will collect basic personal data about you which includes name, address, date of birth and contact details such as email and mobile number etc.

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sexual orientation through the delivery of services we provide to you and/or linked to your healthcare through other health providers or third parties.

WHY DO WE NEED YOUR INFORMATION?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which the Practice hold about you may include the following information:

Details about you, such as your address, carer, legal representative, emergency contact details
Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
Notes and reports about your health
Details about your treatment and care
Results of investigations such as laboratory tests, x-rays etc
Relevant information from other health professionals, relatives or those who care for you

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.

HOW DO WE LAWFULLY USE YOUR DATA?

We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services as a General Practice, under the UK General Data Protection Regulation we will be lawfully using your information in accordance with:

Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

Risk Stratification

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from several sources including NHS Trusts and from this GP Practice.

A risk score is then arrived at through an analysis of your de-identified information is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way – please see the section on Your Rights below.

Medicines Management

The Practice may conduct Medicines Management reviews of medications prescribed to its patients under a processing arrangement with the Medicines Management Team at Rotherham Clinical Commissioning Group. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

HOW YOUR INFORMATION IS SHARED SO THAT THIS PRACTICE CAN MEET LEGAL REQUIREMENTS

The law requires the practice to share information from your medical records in certain circumstances. Under the UKGDPR we will be lawfully using your information in accordance with

Article 6(1)(c) – ‘processing is necessary for compliance with a legal obligation to which the controller is subject…’

Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services…’

Information is shared so that the NHS or Public Health England can, for example:

plan and manage services
check that the care being provided is safe
prevent infectious diseases from spreading

We will share information with NHS Digital, the Care Quality Commission and local health protection team (or Public Health England) when the law requires us to do so. Please see below for more information.

We must also share your information if a court of law orders us to do so.

NHS Digital

NHS Digital is a national body which has legal responsibilities to collect information about health and social care services.

It collects information from across the NHS in England and provides reports on how the NHS is performing. These reports help to plan and improve services to patients.

This practice must comply with the law and will send data to NHS Digital, for example, when it is told to do so by the Secretary of State for Health or NHS England under the Health and Social Care Act 2012.

More information about NHS Digital and how it uses information can be found at:

https://digital.nhs.uk/home

https://digital.nhs.uk/data-and-information/data-collections-and-data-sets/data-collections/general-practice-data-for-planning-and-research/transparency-notice

This practice is supporting vital health and care planning and research by sharing your data with NHS Digital. For more information about this see the GP Practice Privacy Notice for General Practice Data for Planning and Research.

Care Quality Commission (CQC)

The CQC regulates health and social care services to ensure that safe care is provided.

The law says that we must report certain serious events to the CQC, for example, when patient safety has been put at risk.

For more information about the CQC see: http://www.cqc.org.uk/

Public Health

The law requires us to share data for public health reasons, for example to prevent the spread of infectious diseases or other diseases which threaten the health of the population.

We will report the relevant information to local health protection team or Public Health England.

For more information about Public Health England and disease reporting see: https://www.gov.uk/guidance/notifiable-diseases-and-causative-organisms-how-to-report

National screening programmes

The NHS provides national screening programmes so that certain diseases can be detected at an early stage.

These screening programmes include bowel cancer, breast cancer, cervical cancer, aortic aneurysms and a diabetic eye screening service.

The law allows us to share your contact information with Public Health England so that you can be invited to the relevant screening programme. The following sections of the UK GDPR allow us to contact patients for screening.

Article 6(1)(e) – ‘processing is necessary…in the exercise of official authority vested in the controller…’’

For national screening programmes you can opt so that you no longer receive an invitation to a screening programme.

See: https://www.gov.uk/government/publications/opting-out-of-the-nhs-population-screening-programmes

More information can be found at: https://www.gov.uk/topic/population-screening-programmes or speak to the practice.

OUR COMMITMENT TO DATA PRIVACY AND CONFIDENTIALITY

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

Data Protection Act 2018
The UK General Data Protection Regulation
Human Rights Act 1998
Common Law Duty of Confidentiality
Health and Social Care Act 2012
NHS Codes of Confidentiality, Information Security and Records Management

In the circumstances where we are required to use personal identifiable information, we will only do this if:

The information is necessary for your direct healthcare, or
We have received explicit consent from you to use your information for a specific purpose, or
There is an overriding public interest in using the information:
- In order to safeguard an individual,
- To prevent a serious crime or in the case of Public Health or other emergencies, to protect the health and safety of others, or
There is a legal requirement that allows or compels us to use or provide information (e.g. a formal court order or legislation), or
We have permission from the Secretary of State for Health and Social Care to use certain confidential patient identifiable information when it is necessary for our work

Everyone working for the NHS has a legal and contractual duty to keep information about you confidential.

Our practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the UK General Data Protection Regulation (UKGDPR) and all UK specific Data Protection requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor an appropriate contract (art 24-28) will be established for the processing of your information.

Where information is held centrally and used for statistical purposes, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes – please see Your Rights section below.

WHERE YOUR CONSENT IS REQUIRED

We would like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions where authorised research facilities would like you to take part in innovations, research, improving services or identifying trends.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place.

This information is not shared with third parties or used for any marketing and you can withdraw your consent at any time via phone, email or by informing the practice DPO as below.

WHERE DO WE STORE YOUR INFORMATION?

All the personal data we hold is processed and stored in the UK. Your information will not be sent outside of the UK where the laws do not protect your privacy to the same extent as the law in the UK. We will never sell any information about you.

No third parties have access to your personal data unless the law allows them to do so and appropriate safeguards have been put in place.

WHO ARE OUR PARTNER ORGANISATIONS?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations:

NHS Trusts / Foundation Trusts
GPs
NHS Commissioning Support Units
Independent Contractors such as dentists, opticians, pharmacists
Private Sector Providers
Voluntary Sector Providers
Ambulance Trusts
Clinical Commissioning Groups / Integrated Care Boards
Social Care Services
NHS England (NHSE) and NHS Digital (NHSD)
Local Authorities
Education Services
Fire and Rescue Services
Police & Judicial Services
Voluntary Sector Providers
Private Sector Providers
Connect Healthcare Rotherham
Other ‘data processors’ which you will be informed of

We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor an appropriate contract (UKGDPR Article 24-28) will be established for the processing of your information. List of Data Processors:

TPP SystmOne
Numed Healthcare
Eclipse Healthcare
Accurx
C The Signs
World Healthnet
Express Diagnostics
Continuum Health Ltd (Anima)
IGPR
INR Star

HOW LONG WILL WE STORE YOUR INFORMATION?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements.

More information on records retention can be found online at (https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016 )

YOUR RIGHTS

Under the UK General Data Protection Regulation all individuals have certain rights in relation to the information which the Practice holds about them. Not all rights apply equally to all our processing activity as certain rights are not available depending on the lawful basis for the processing. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Examples of where rights may not apply – where our lawful basis is:

Processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller – then rights of erasure, portability do not apply.
Legal Obligation – then rights of erasure, portability, objection, automated decision making and profiling do not apply.

If you require further detail each link below will take you to the Information Commissioner’s Office’s website where further detail is provided in section ‘When does the right apply’.

These rights are:

Under the NHS Constitution you have the right to privacy and to expect the NHS to keep your information confidential and secure.

You have the right to be informed about how your information is used.

Supporting these rights patients in England also have the right under the NHS Constitution to request that their personal confidential data is not used for reasons other than their individual care and treatment. The process for applying this right is called the ‘National Patient Data Opt-out’ this gives patients and the public the opportunity to make an informed choice about whether they wish their personally identifiable data to be used just for their individual care and treatment or also used for research and planning purposes.

However, there are exemptions to this, the national patient data opt-out applies unless:

There is a mandatory legal requirement or an overriding public interest for the data to be shared e.g. Adults and Children safeguarding.

The opt-out does not apply when the individual has consented to the sharing of their data; or

Where the data is anonymised in line with the Information Commissioner’s Office (ICO) Code of Practice on Anonymisation.

To be compliant with the national data opt-out policy the Practice has put procedures in place to review uses or disclosures of confidential patient information against the national data opt-out operational policy guidance.

If you believe the Practice is using your personal information in a way you would object to or contrary to your National Patient Data Opt-Out request, you have the right to object and have your objections considered and where your wishes cannot be followed, to be told the reasons including the legal basis.

For further details of the national patient data opt out can be found here: https://www.nhs.uk/your-nhs-data-matters/

Access to your personal information

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

Your request should be made to the Practice – for information from the hospital you should write direct to them
There is no charge to have a copy of the information held about you
We are required to respond to you within one month
You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.

WHAT SHOULD YOU DO IF YOUR PERSONAL INFORMATION CHANGES?

You should tell us so that we can update our records please contact the Practice Manager as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), the practice will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.

QUERIES/COMPLAINTS

Should you have any concerns about how your information is managed at the GP, please contact the GP Practice Manager or the Data Protection Officer. If you are still unhappy following a review by the GP practice, you have a right to lodge a complaint with a supervisory authority: You have a right to complain to the UK supervisory Authority as below.

Information Commissioner:

Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Tel: 0303 1231113 or 01625 545745

https://ico.org.uk/

If you would like to know more about your rights in respect of the personal data we hold about you, please contact the Data Protection Officer as below.

DATA PROTECTION OFFICER

This Practice have appointed Caroline Million to be the designated Data Protection Officer. She can be contacted on caroline.million@outlook.com

CHANGES

It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Practice Data

Patient Requests (Anima)