Privacy Notice

This is the privacy notice of West Hampstead Medical Centre. In this document, “we”, “our”, or “us” refers to West Hampstead Medical Centre, 9 Solent Road, London, NW6 1TP

Telephone number: 0207 431 1588

We are required by law to provide you with information on how we use your data. There is a highly detailed privacy notice available, but this simplified notice is provided for clarity. 

Introduction

The Data Protection Regulations in the UK include two key pieces of law:

• The Data Protection Act 2018
• The UK GDPR which was adapted from the EU version at Brexit and now applies to processing for people based in the UK

There are other regulations in specific areas which need to be considered. This Privacy Notice has been written within the legislative framework as of July 2020. It will be revised as the framework and case law change.

What is this Privacy Notice about? 

This Privacy Notice is part of the information to data subjects about how personal data is used. 

Being transparent and providing accessible information to individuals about how organisations will use their personal information is a key element of Data Protection Regulations. 

This Privacy Notice is part of our programme to make the data processing activities we are carrying out in order to meet our healthcare obligations transparent.

The Privacy Notice tells you about information we collect and hold about you, the legal basis for collecting and holding the information, what we do with it, how we keep it secure (confidential), who we might share it with and what your rights are in relation to your information.

Who we are

We are the West Hampstead Medical Centre. We provide medical services to you as a patient as part of the NHS.

Types of information we use

We use the following types of information/data:

Personal data or sensitive personal/special categories of personal data such as: 

• Demographics – name, address, date of birth, postcode, NHS number
• Racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying a natural person, medical/health data, sexual life or sexual orientation data.
• Pseudonymised - about individuals but with identifying details (such as name or NHS number) replaced with a unique code.
• Anonymised - about individuals but with identifying details removed.
• Aggregated - anonymised information grouped together so that it doesn't identify individuals.

What we use your personal data and special categories of personal data (known as or sensitive personal) for

We use and share information about you in a number of ways. These include:

• Primary uses - information from your GP medical record which can be made available to other NHS and public sector organisations, including doctors, nurses and care professionals in order to help them make the best-informed decision, and provide you with the best possible direct care delivery.
• Secondary uses - information from your GP medical record involves extracting identifiable data and (usually) sharing that data with other NHS organisations, for the purpose of indirect care. Examples include using your information for research, auditing, and healthcare planning (population health management).

A national opt-out for some secondary uses exists for your data, please see section below. National data opt-out - NHS Digital. This gives everyone the ability to stop health and adult social care organisations from sharing  confidential patient information for reasons other than providing their individual care and treatment.

The national data opt-out was introduced on 25 May 2018, enabling patients to opt out from the use of their data for research or planning purposes, in line with the recommendations of the National Data Guardian in her Review of Data Security, Consent and Opt-Outs. 

Patients can view or change their national data opt-out choice at any time by using the online service at Your NHS Data Matters webpage or by clicking on "Your Health" in the NHS App, and selecting "Choose if data from your health records is shared for research and planning".

Further Information: Understanding Patient Data

Understanding Patient Data’ supports better conversations about the uses of health information. Our aim is to explain how and why data can be used for care and research, what’s allowed and what’s not, and how personal information is kept safe. We work with patients, charities and Healthcare Professionals to champion responsible use of data.

Further Information and Guidance

General Practice Data for Planning and Research (GPDPR)

NHS Digital are developing a new, more secure and more efficient way to collect patient data, called the General Practice Data for Planning and Research data collection. There is no set start date for this collection and will only do so when we, and our partners, are confident that we have engaged, listened, learned and made changes as a result.

See the NHS Digital website for further information

How long will you keep my data

This depends on a number of factors such as how long you stay with our practice and the type of data. Generally, when you leave our practice, your data is transferred to the new practice or to central records; we retain access to the data up to when you left our practice for medico-legal reasons and only access it for a complaint, clinical audit purposes or we are required to do so by law.

Full details of how long different types of data are held can be found in the NHS Records Management Code of Practice.

Identity and Contact details of the Data Controller and Data Protection Officer  

Practice Contact Details

West Hampstead Medical Centre, 9 Solent Road, London, NW6 1TP

Practice ICO Reference Number: Z6994021

Data Protection Officer

You can contact the data protection officer by post at the practice address, addressed for the attention of the Data Protection Officer.

The Data Protection Officer service is provided across NCL practices by:

• Name: Steve Durbin
• Email: dpo.ncl@nhs.net

Please quote the practice name in any communication.

Organisations we share your personal information with

We share information about you with other GPs, NHS acute or mental health Trusts, local authorities, community health providers, pharmacists, commissioning organisations, medical research organisations and some specific non-NHS organisations for the purposes of direct and indirect care delivery of care. 

We are required under the law to provide you with the following information how we process your personal data, the purpose of proposing, recipient/categories of your personal data, the identity of our Data Protection Officer (DPO), how long we retain personal information about you, the legal basis and justification for the processing, and your right to view, request access copies of your personal information, or object to the processing.

Included below is a table of the organisations we share information about you with split into the following categories. In all cases, the data controller and Data Protection Officer (DPO) are as listed in section 6 above:

• a) Direct Medical Care and Administration
• b) Other primary care services delivered for the purposes of direct care
• c) Statutory Disclosures of Information
• d) Processing for the Purposes of Commissioning, Planning, Research and Risk Stratification
• e) Data Sharing Databases
• f) Data Processors

Freedom of Information

Information about the General Practitioners and the practice required for disclosure under this act can be made available to the public. All requests for such information should be made to the practice manager.

Freedom of Information Act 2000

The Freedom of Information Act, gives the general right of access to all types of recorded information held by the practice. The intention of the Act is to encourage a spirit of openness and transparency in the NHS and the whole public sector. Our practice aims to fully support this.

National Screening Programmes

The NHS provides national screening programmes so that certain diseases can be detected at an early stage.
These screening programmes include bowel cancer, breast cancer, cervical cancer, aortic aneurysms and a diabetic eye screening service.
The law requires us to share your contact information with Public Health England so that you can be invited to the relevant screening programme.