Tel: 0207 467 8556 Email: email@example.com
10 Harley Street London W1G 9PF
Dr Dimitriou and CD Practice Limited, of whom he is a Director, understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of our clients and will only use personal data in ways that are described here and in a way that is consistent with our obligations and your rights under the law.
This Privacy Notice may vary from time to time so please check it regularly. We updated this privacy Notice on 19th January 2020.
CD Practice Limited, is registered in England and Wales with company number 08899166 and registered address at 925 Finchley Road, London, NW11 7PE.
Main trading address: 10 Harley Street London, W1G 9PF
Email address: firstname.lastname@example.org
Telephone number: 07720 558940 (Practice Manager, Sara St John Perry)
Postal Address: 10 Harley Street, London, W1G 9PF
This Privacy Information explains how we use your personal data: how it is collected, how it is held, and how it is processed. It also explains your rights under the law relating to your personal data.
Personal data is defined by the General Data Protection Regulation (EU Regulation 2016/679) (the “GDPR”) as ‘any information relating to an identifiable person who can be directly or indirectly identified in particular by reference to an identifier’.
Personal data is, in simpler terms, any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
This practice keeps medical records confidential and complies with the General Data Protection Regulation (GDPR) and Data Protection Act 2018.
We hold your medical record so that we can provide you with safe care and treatment.
We will also use your information so that this practice can check and review the quality of the care we provide. This helps us to improve our services to you.
The confidentiality of your information is very important to us and we comply with data protection legislation and medical confidentiality guidelines of our professional bodies (namely the General Medical Council).
We will only store or transfer your personal data in the UK. This means that it will be fully protected under the GDPR. If you require personal data to be transferred outside of the UK e.g. transferring medical notes or a referral letter to a new caregiver then we will forward such data directly to you, by secure email, and ask you to forward on personally as necessary.
We maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of the personal information in question. These safeguards are designed to protect your personal information from loss and unauthorised access, copying, use, modification or disclosure.
All patients who receive care are registered on our computer system and/or in a locked manual filing system. This database holds your name, address, date of birth, telephone number, e-mail address, confirmation that ID has been checked and your regular (NHS) GP recorded – you will be asked to indicate if you consent to CD Practice sharing clinical information with your regular GP (please note you may change this decision at any time).
The database is held by CD Practice. Personal data about you is held in the practice’s computer system and/or in a locked manual filing system. The information is only accessible to authorised practice members. Our computer system and has secure audit trails and we back up information routinely. The practice has a confidentiality policy that all staff adhere to.
The locked manual filing system is located in alarmed premises with controlled access to buildings, rooms, cabinets where data, computers, media or hardcopy materials are held. Sensitive data is transported only under exceptional circumstances, even for repair purposes.
Network security includes firewall protection and security-related upgrades and patches to operating systems to avoid viruses and malicious code. Computer systems are locked with a password that is changed regularly and we ensure that computer software is up-to-date. We implement password protection and controlled access to data files, for example ‘no access’, ‘read only’, ‘read and write’ or ‘administrator-only’ permission. We control access to files, folders and hard drives with a password and no personal or confidential data shall be sent via email or other file transfer means without first encrypting them. We destroying data in a consistent manner when needed.
Cloud data storage should not be used for high-risk information such as files that contain personal or sensitive information.
As a medical practice we will hold medical records and information about you in order to treat you appropriately and in a timely manner.
To provide patients with a high standard of medical care, we need to hold personal information. This personal data can include:
We need to keep comprehensive and accurate personal data about patients to provide you with safe and appropriate medical care. We will ask you yearly to update your medical history and contact details.
Your medical records may be reviewed and further questions asked in a consultation, so that we can identify patients who might be at risk from certain diseases or conditions such as diabetes or hypertension. This means we can offer patients additional care or support as early as possible.
For more information please speak to the Practice Manager.
Sometimes we need to share information so that other people, including healthcare staff, children or others with safeguarding needs, are protected from risk of harm. These circumstances are rare.
We do not need your consent or agreement to do this. Please see our safeguarding policies for more information:
You have the following rights:
Please see our safeguarding policy for more details.
For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided in Part 11.
Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.
If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.
We collect and maintain different types of personal information in respect of those individuals who seek to be, are, or were patients, including the personal information contained in:
In addition to the examples listed above, personal information also includes information such as Name; Date of birth; Gender; Address; Email address; Telephone and mobile number; Business name; Job title; Profession; Payment information; marital status; Insurance details and any other information necessary to CD Practice business purposes, which is disclosed in the Terms and Conditions.
As a general rule, we collect personal information directly from you. In most circumstances where the personal information that we collect about you is held by a third party, we will obtain your permission before we seek out this information from such sources (such permission may be given directly by you, or implied from your actions). An example of this would be sending information to your insurance company to process your medical expenses claim.
From time to time, we may use the services of third parties and may also receive personal information collected by those third parties in the course of the performance of their services for us. In that case, we will take reasonable steps to ensure that such third parties have represented to us that they have the right to disclose your personal information to us.
Where permitted or required by applicable law or regulatory requirements, we may collect information about you without your knowledge or consent.
Under the GDPR, we must always have a lawful basis for using personal data. This may be because the data is necessary for our performance of a contract with you, or because you have consented to our use of your personal data, or because it is in our legitimate business interests to use it.
a) Purpose of the processing
Your personal data will be used for the following purposes:
b) Lawful basis for processing
These purposes are supported under the following sections of the GDPR:
To provide proper and safe medical care we may need to disclose personal information about ou including to:
Disclosure will take place on a ‘need-to-know’ basis. Only those individuals or organisations who need to know to provide care for you will be given the information.
In very limited circumstances or when required by law or a court order, personal data may have to be disclosed to a third party not connected with your health care. Where possible you will be informed of these requests for disclosure.
We will continue to obtain consent from you as a patient be it implied, verbal or written for the treatment or procedures undertaken at CD Practice. This will be in line with the General Medical Council’s guidelines and will be recorded appropriately in your medical records.
In addition to this we will ask you to opt-in to any marketing or other communications, offer choices as to how to communicate with you should you so wish and offer you the option to withdraw consent to that communication at any time.
You can access most of the pages on our website without giving us your personal information although you may choose to do so, for example when you submit an enquiry. Users are requested not to send confidential details or debit/credit card numbers by e-mail unless specifically asked by us to do so.
When you submit personal information, you consent to our use of the information as set above under ‘Requesting your consent under GDPR’.
We may receive information about your health from other organisations who are involved in providing you with health following a referral from CD Practice. For example, if you go to hospital for treatment or an operation, the hospital will send us a letter to let us know what happens. This means your medical record at this practice is kept up-to date when you receive care from other parts of the health service.
Although obliged to share patient information with your NHS GP (with your consent) currently independent doctors do not have access to care and treatment records you receive elsewhere (NHS or private).
If you do not wish personal data that we hold about you to be disclosed or used in the way that is described in this Privacy Notice, please discuss the matter with your doctor. You have the right to object; however, this may affect our ability to provide you with medical care.
When you visit our website, our server will record your computer's IP address (the unique numerical address given to every computer connected to the Internet) and the time and duration of your visit.
From time to time our website may contain links to other sites. We are not responsible for the content or privacy practices of third parties that run other websites.
It is important that the personal data we hold about you is accurate and current and we take all reasonable precautions to ensure that this is the case but we do not undertake to check or verify the accuracy of personal data provided by you. Please keep us informed if your personal data changes during your relationship with us either by logging onto your account on the website or by contacting us. We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us.
We will not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected. We will store your personal data for the time period which is appropriate in accordance with the following criteria:
We keep the length of time that we hold your personal data for under review. These reviews take place annually. Your medical records will be kept in line with the law and national guidance. Information on how long records are kept can be found at: https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.
All subject access requests should be made in writing and sent to the email or postal addresses shown.
If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) fees may be charged to cover our administrative costs in responding.
We will respond to your subject access request within 14 working days and, in any case, not more than one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of progress.
When requesting access to your personal information, please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you.
Your right to access the personal information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you. In addition, the personal information may have been destroyed or erased in accordance with our record retention obligations and practices.
If we cannot provide you with access to your personal information, we will try to inform you of the reasons why, subject to any legal or regulatory restrictions.
To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details (for the attention of Sara St John Perry Practice Manager):
Email address: email@example.com
Telephone number: 07720 558940
Postal Address: 10 Harley Street, London, W1G 9PF
We may change this Privacy Notice from time to time. This may be necessary, for example, if the law changes, or if we change our business in a way that affects personal data protection.
Information relating to any changes will be made available via email.
Please contact us for more informationContact