Privacy Policy
The healthcare professionals who provide your care maintain records about your health and any treatment or care you have received. This may include care received within GP practices, NHS Trusts, walk-in clinics, urgent care centres and GP practices we may operate. These records help to provide you with the best possible healthcare.
City & Hackney Integrated Primary Care (IPC) is a registered data controller and notifies the Information Commissioner’s Office (ICO) of all personal information processing activities. Our ICO Data Protection Register can be found on the ICO website.
What Type of Personal Data Is Used?
NHS health records may be electronic, paper-based, or a mixture of both. We use a combination of working practices and technology to ensure your information is kept confidential and secure.
Records we hold about you may include:
- Details about you, such as your address, carer, legal representative, emergency contact details and NHS number
- Any contact the organisation has had with you, such as appointments or clinic visits
- Notes and reports about your health
- Details about your treatment and care
- Results of investigations such as laboratory tests, X-rays or images
- Relevant information from other health professionals or those who care for you
- Sensitive information such as racial or ethnic origin, religious beliefs or sexual orientation
- Criminal offence information and/or safeguarding information
How Is Your Data Used?
Your records are used to facilitate the care and treatment you receive. Information may also be used to protect public health and help manage the NHS.
Information may be used within City & Hackney Integrated Primary Care (IPC) for clinical audits to monitor service quality and improve care.
Some information may be held centrally and used for statistical purposes. Where this occurs, strict measures are taken to ensure individual patients cannot be identified.
All patients who receive NHS care are registered on a national database held securely by NHS England, which has legal responsibilities to collect NHS data.
Purposes for Using Your Information
To Meet Your Healthcare Needs
In line with our statutory duty, information is processed to provide direct health or social care. When you agree to a referral for direct care, relevant information will be shared with other healthcare organisations to enable appropriate treatment and advice.
Quality and Clinical Audit
Your information may be used for clinical audit purposes to monitor and improve the quality of services provided.
Accessible Information Standard and Translation Services
In line with the Accessible Information Standard (AIS), introduced in July 2015, IPC ensures that people with a disability, impairment or sensory loss receive information in accessible formats such as large print, braille, email or with professional communication support (e.g. British Sign Language interpreter).
Safeguarding Adults and Children
In certain circumstances, information may be shared to protect individuals from risk of harm. These situations are rare and may not require consent where legally justified.
IPC works in partnership with local authorities and safeguarding teams to fulfil safeguarding responsibilities.
Staff and Job Applications
When individuals apply for employment at IPC, information is used to process applications and recruit staff. References and Disclosure and Barring Service checks may be obtained where appropriate and in line with legal requirements.
Once employed, a secure employment file is maintained and used only for purposes directly relevant to employment.
What Is the Lawful Basis for Processing Your Information?
The General Data Protection Regulation (GDPR) 2018 (Articles 6(1)(a), 6(1)(e) and 9(2)(h)) provides IPC with the legal basis to process your information.
The NHS Act 2006 and the Health and Social Care Act 2021 place statutory duties on IPC to provide health services, improve quality, reduce inequalities, conduct research and deliver education and training.
We process information to:
- Protect your vital interests
- Pursue legitimate interests as a healthcare provider
- Perform tasks in the public interest
- Deliver preventative medicine, diagnosis and research
- Manage the health and social care system
Healthcare staff also comply with the common law duty of confidence.
National Data Opt-Out
IPC complies with the National Data Opt-Out. Where applicable, this will be applied to your information.
Further information can be found at:
https://www.nhs.uk/your-nhs-data-matters/
How Do I Gain Access to My Personal Information?
You have the right to request access to information held about you and to request corrections if it is inaccurate. You may request copies in electronic or paper format.
To request access, please contact our Data Protection Officer.
Under GDPR, you have additional rights. To exercise these rights, please contact the Data Protection Officer.
Other Additional Information Rights
Medical records are kept in line with national guidance. Information on retention periods can be found at:
Records management: code of practice for health and social care
Corporate records are also retained in accordance with the Records Management Code of Practice.
How Long Do We Keep Your Information?
Records are retained in accordance with national NHS retention schedules and legal requirements.
What To Do If You Have Any Questions
If you have concerns about how your information is managed, please contact IPC.
If you remain dissatisfied, you may contact the Information Commissioner’s Office:
The Information Commissioner’s Office is the UK’s independent authority set up to uphold information rights.