Privacy Policy

We have updated our Privacy Notice in accordance with the GDPR Regulations to clarify how we collect, share and retain personal data, including;

• What personal information we hold
• How we use your personal information
• How we share information
• Our Partner organisations
• How we keep your information secure
• Your rights
• Use of cookies on our website
• Objections and Further information

You can read our Privacy Notice in Full below as it provides more details on how we manage your information.

Privacy Notice

This privacy notice describes the data, the practice holds about you, why we hold it, where and how we store it, how long for and how we protect it. It also tells you about your rights under the Data Protection Legislation and how the law protects you.

Who are we and what we do

Peverell Park Surgery, The Stables Pounds House, Peverell, Plymouth PL2 3PX. The contact number for the Surgery is 01752 766644 and the email address is administration.peverellpark@nhs.net . Peverell Park Surgery is a Data Controller for the data we hold about you. We hold your data in order to provide you with health and social care.

What personal information we hold

• Name, address, date of birth, gender, contact information including telephone number and email address
• Clinical consultation entries, either face-to-face or on the telephone
• Relevant information from people who care for you such as relatives and carers
• Your current and past medical history (e.g. medical problems, investigations, medication)
• Documents from other NHS organisations relating to your health
• Your current and past referrals

We may also hold the following information about you

• Religion or other beliefs of a similar nature
• Family, lifestyle and/or social circumstances
• Employment details
• Financial details

When we collect your mobile number we use it to text you to remind you of appointments, notifying you about temporary changes to our opening hours (for example for staff training) and any changes or campaigns. If you no longer wish to receive communication this way, please let a member of staff know who will be able to update your preferences. When we collect your email address, we use it to reply to communications from you, notify you or any changes or request additional information. If you no longer wish to receive communication this way, please let a member of staff know who will be able to update your preferences.

 How we share information

• Your information may be shared with other NHS Organisations in relation to your healthcare and to audit services
• Your information may be shared with outside organisations in relation to your healthcare
• Your information may be shared to help investigate and complaints or concerns you have about your healthcare
• Some information is held centrally for statistical purposes. In these instances, strict measures are in place to ensure individual patients cannot be identified

The law requires us to share information from your medical records in certain circumstances. Information is shared so that the NHS or Public Health England can, for example:

• Plan and manage services
• Check that the care being provided is safe
• Prevent infectious diseases from spreading

We will share information with NHS Digital the Care Quality Commission and Public Health England when the law requires us to do so. We must also share your information if a court orders us to do so.

Health and social care services in Devon and Cornwall have developed a system to share patient data efficiently and quickly and, ultimately, improve the care you receive.

This shared system is called the Devon and Cornwall Care Record.

It’s important that anyone treating you has access to your shared record so they have all the information they need to care for you. This applies to your routine appointments and also in urgent situations such as going to A&E, calling 111 or going to an out-of-hours appointment.

It’s also quicker for staff to access a shared record than to try to contact other staff by phone or email.

Only authorised health and care staff can access the Devon and Cornwall Care Record and the information they see is carefully checked so that it relates to their job. Also, systems do not share all your data – just data that services have agreed is necessary to include.

For more information about the Devon and Cornwall Care Record, please go to https://www.devonandcornwallcarerecord.nhs.uk/

We also use a system called GP Connect which allows authorised clinical staff to share and view GP practice clinical information and data between IT systems, quickly and efficiently.

GP Connect makes patient information available to all appropriate clinicians when and where they need it, leading to improvements in both care and outcomes. GP Connect can only be used to share patient information for direct care purposes, not for any other reasons such as planning or research.

GP Connect helps clinicians gain access to GP patient records during interactions away from a patient’s registered practice and makes their medical information available to appropriate health and social care professionals when and where they need it, to support the patient’s direct care.

From a privacy, confidentiality and data protection perspective, GP Connect provides a method of secure information transfer and reduces the need to use less secure or less efficient methods of transferring information, such as email or telephone.

For more information about GP Connect, please go to https://digital.nhs.uk/services/gp-connect/gp-connect-in-your-organisation/transparency-notice

We use the NHS Account Messaging Service provided by NHS Digital to send you messages relating to your health and care. You need to be an NHS App user to receive these messages.

Further information about the service can be found at the privacy notice for the NHS App managed by NHS Digital at https://www.nhs.uk/using-the-nhs/nhs-services/the-nhs-app/privacy/.

Why do we process your data and what legal basis do we have to process your data?

In order to process your personal data or share your personal data outside of the practice, we need a legal basis to do so. If we process or share special category data, such as health data, we will need an additional legal basis to do so.

We rely upon Article 6(1)(e) (public interest task) and Article 9(2)(h) (health and social care) for most of our processing and sharing, in particular to:

• Provide you with health and social care,
• Share data from, or allow access to, your GP record, for healthcare professionals involved in providing you with health and social care,
• Receive data from or access your data on other NHS organisation clinician systems,
• Work effectively with other organisations and healthcare professionals who are involved in your care,
• Ensure that your treatment and advice, and the treatment of others is safe and effective,
• Participate in National Screening Programmes,
• Use a computer program to identify patients who might be at risk from certain diseases or unplanned admissions to Hospitals,
• Help NHS Digital and the practice to conduct clinical audits to ensure you are being provided with safe, high quality care,
• Support medical research when the law allows us to do so,
• Supply data to help plan and manage services and prevent infectious diseases from spreading.

We rely upon Article 6(1)(d) (vital interest) and Article 9(2)(c) (vital interests) to share information about you with another healthcare professional in a medical emergency.

We rely upon Article 6(1)(e) (public interest task) and Article 9(2)(g) (substantial public interest) to support safeguarding for patients who, for instance, may be particularly vulnerable to protect them from harm or other forms of abuse.

We rely upon Article 6(1)(c) (legal obligation) and Article 9(2)(h) to share your information for mandatory disclosures of information (such as NHS Digital, CQC and Public Health England).

We rely upon Article 6(1)(c) (legal obligation) and Article 9(2)(f) (legal claims) to help us investigate legal claims and if a court of law orders us to do so.

We rely upon Article 6(1)(a) (consent) and Article 9(2)(a) (explicit consent), in order to:

• Help the practice investigate any feedback, including patient surveys, complaints or concerns you may have about contact with the practice,
• Help manage how we provide you with services from the practice, for example, when you nominate individuals to contact the practice on your behalf,
• Share your information with third parties, for example, insurance companies and medical research organisations.

We also use anonymised data to plan and improve health care services. Specifically, we use it to:

• Review the care being provided to make sure it is of the highest standard,
• Check the quality and efficiency of the services we provide,
• Prepare performance reports on the services we provide.

Healthcare staff will respect and comply with their obligations under the common law duty of confidence.

We are required by law to provide you with the following information about how we handle information and our legal obligations to share data:

 Our Partner Organisations

 GP practices within Waterside PCN

• Other GP surgeries
• NHS Trusts
• Emis Health
• Independent contractors such as dentists, opticians and pharmacists
• Private sector providers
• Voluntary sector providers
• Ambulance trusts and emergency services
• Clinical Commissioning Groups
• NHS Commissioning Support Units (CSUs)
• Health and Social Care Information Centre (HSCIC)
• Local authorities
• Education services
• Police and judicial services
• Public Health England and Screening
• Non-NHS providers
• NHS 111
• Research providers*
• Other data processors
• Accurx

 *As a practice we are supported in the set up and delivery of research by experienced NIHR CRN staff who work as part of our practice team. These staff, as part of the practice team, will be able to access your patient record to identify if you would be eligible to participate in research opportunities, support recruitment and follow up activity related to clinical trials.

How we keep your information secure

•  All staff are DBS checked upon commencing employment
• All staff are trained in their responsibilities to protect your information
• All access to our systems is password protected
• Information is not shared with unauthorised bodies

We maintain a duty of confidentiality to you at all times. We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances or where the law requires information to be passed on.

We also ensure that the information we hold is kept in secure locations, restrict access to information to authorised personnel only and protect personal and confidential information held on equipment.

Your rights

•  To obtain access and copies of your medical records
• To request information is corrected if it is factually incorrect
• To have information updated where it is no longer accurate
• To withdraw consent for information sharing

 COVID-19

 The Practice may collect, hold and share information about you in relation to the COVID-19 pandemic in order to plan and manage services, check that care is being provided and prevent COVID-19 from spreading.

Information about your COVID-19 status may be shared within the NHS and with other partners involved in your care and treatment, along with:

• NHS England,
• NHS Digital,
• Public Health England,
• CCG,
• The Department of Health,
• Other Government Departments where it’s legally required, or where it is necessary for the protection of public health or management of the outbreak.

We do not need your consent or agreement to do this.

More information can be found at: https://digital.nhs.uk/news-and-events/latest-news/data-and-services-supporting-coronavirus and https://www.gov.uk/guidance/notifiable-diseases-and-causative-organisms-how-to-report

Please find our supplementary Privacy Notice for COVID-19 here.

Use of Cookies on our website

We use Google Analytics software on our website to anonymously track how visitors interact with this website. This includes identifying:

• the pages visited on our website
• how long the visitor spends on each page on our website
• how visitors got to our website
• what visitors click on while visiting our website

We do this to help make sure our website is meeting the needs of visitors and help us make improvements, for instance improving site search. We don’t use cookies to track the identity of visitors or the information they have entered into the site.

You give us consent to using cookies for analytic purposes if you continue to use our website site. Alternatively, you can switch off cookies in your browser and the site will still work normally.

 Objections

Should you have any concerns about how your information is managed by Peverell Park Surgery, please contact the Data Protection Officer. If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website (www.ico.gov.uk).

If you are happy for your data to be extracted and used for the purposes described in this privacy notice then you do not need to do anything. If you have any concerns about how your data is shared then please contact the practice.

 Further Information

• Our Data Protection Officer Bex Lovewell lovewell@nhs.net
• Our organisation is registered with the Information Commissioner. Our registration number is Z6658182 and can be viewed on the register of data controllers at www.ICO.org.uk.
• For independent advice, please contact the Information Commissioners Office on 0303 123 1113, text phone 01625 545860or email casework@ico.org.uk.