If you send us information in connection with a job application, we may keep it for up to three years in case we decide to contact you at a later date.

If we employ you, we collect information about you and your work from time to time throughout the period of your employment. This information will be used only for purposes directly relevant to your employment. After your employment has ended, we will keep your file for six years before destroying or deleting it.

Invoice validation is an important process. It involves using your NHS number to check which CCG is responsible for paying for your treatment. Section 251 of the NHS Act 2006 provides a statutory legal basis to process data for invoice validation purposes. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly.

An ‘Individual Funding Request’ is a request made on your behalf, with your consent, by a Clinician, for funding of specialised healthcare which falls outside the range of services and treatments that CCG has agreed to commission for the local population. An Individual Funding Request is taken under consideration when a case can be set out by a patient’s Clinician that there are exceptional clinical circumstances which make the patient’s case different from other patients with the same condition and who are at the same stage of their disease, or when the request is for a treatment that is regarded as new or experimental and where there are no other similar patients who would benefit from this treatment. A detailed response, including the criteria considered in arriving at the decision, will be provided to the patient’s Clinician.

• Your medical records will be searched by a computer programme so that we can identify patients who might be at high risk from certain diseases such as heart disease or unplanned admissions to hospital.

• This means we can offer patients additional care or support as early as possible.

• This process will involve linking information from your GP record with information from other health or social care services you have used.

• Information which identifies you will only be seen by this practice.

• Contact us if you require more information on this.

Our Practice is legally required to provide anonymised data on patients who have been issued with a fit note under the Fit for Work scheme. The purpose is to provide the Department for Work and Pensions with information from Fit Notes to improve the monitoring of public health and commissioning and quality of health services.

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to
request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

• Your request should be made to the Practice – for information from the hospital you should write direct to them
• There is no charge to have a copy of the information held about you
• We are required to respond to you within one month
• You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.

We manage patient records in line with the Records Management NHS Code of Practice for Health and Social Care, which sets the required standards of practice in the management of records for those who work within or under contract to NHS organisations in England.

This is based on current legal requirements and professional best practice.

If you transfer to another GP and we are asked to transfer your records we will do this to ensure your care is continued. Currently the NHS is required to keep GP records for 10 years after a patient has died. Exceptions to these rules are detailed in the code of practice.

The Data Protection Officer is responsible for ensuring the Practice remains compliant at all times with Data Protection, Privacy & Electronic Communications Regulations, Freedom of Information Act and the Environmental Information Regulations. The Data Protection Officer shall:

• Lead on the provision of expert advice to the Practice on all matters concerning the Data Protection Act, compliance, best practice and setting and maintaining standards
• Inform and advise the organisation and its employees of their data protection obligations under the GDPR
• Monitor the organisation’s compliance with the GDPR and internal data protection policies and procedures. This will include monitoring the assignment of responsibilities, awareness training, and training of staff involved in processing operations and related audits
• Advise on the necessity of data protection impact assessments (DPIAs), the manner of their implementation and outcomes
• Serve as the contact point to the data protection authorities for all data protection issues, including data breach reporting.

The DPO will be independent and an expert in data protection. The DPO will be the Practice’s point of contact with the Information Commissioner’s Office. The DPO can be contacted via the contact details at the top of this notice. Please address your request for the attention of the Data Protection Officer (DPO).

Please contact the Data Protection Officer if:

• You have any questions about how your information is being held
• If you require access to your information or if you wish to make a change to your
• information
• If you wish to make a complaint about anything to do with the personal and healthcare
• information we hold about you
• Or any other query relating to this Policy and your rights as a patient.

Data processors are responsible for the processing of personal data on behalf of the data controller. Processors must ensure that processing is lawful and that at least one of the following applies:

• The data subject has given consent to the processing of his/her personal data for one or more specific purposes
• Processing is necessary for the performance of a contract to which the data subject is party, or in order to take steps at the request of the data subject prior to entering into a contract
• Processing is necessary for compliance with a legal obligation to which the controller is subject
• Processing is necessary in order to protect the vital interests of the data subject or another natural person
• Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller
• Processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child

At our Practice all staff are classed as data processors as their individual roles will require them to access and process personal data.

The Data Protection Act 2018 requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information.
We are registered as the data controller and our registration can be viewed online in the public register at: Register of fee payers.

Any changes to this notice will be published on our website and in a prominent area at the Practice.