Dr Dimitriou and CD Practice Limited, of whom he is a Director, understands that your privacy is important to you and that you care about how your personal data is used. We respect and value the privacy of all of our clients and will only use personal data in ways that are described here and in a way that is consistent with our obligations and your rights under the law.
1. Information About Us
CD Practice Limited, is registered in England and Wales with company number 08899166 and registered address at 925 Finchley Road, London, NW11 7PE.
Main trading address: 10 Harley Street London, W1G 9PF
Email address: email@example.com
Telephone number: 07720 558940 (Practice Manager, Sara St John Perry)
Postal Address: 10 Harley Street, London, W1G 9PF
2. What Does This Policy Cover?
3. What is Personal Data?
Personal data is any information about you that enables you to be identified. Personal data covers obvious information such as your name and contact details, but it also covers less obvious information such as identification numbers, electronic location data, and other online identifiers.
4. How CD Practice uses your information to provide you with healthcare?
This practice keeps medical records confidential and complies with the General Data Protection Regulation (GDPR) and Data Protection Act 2018.
We hold your medical record so that we can provide you with safe care and treatment.
We will also use your information so that this practice can check and review the quality of the care we provide. This helps us to improve our services to you.
The confidentiality of your information is very important to us and we comply with data protection legislation and medical confidentiality guidelines of our professional bodies (namely the General Medical Council).
We are also registered with the Care Quality Commission (CQC) whom will periodially inspect us. As part of that inspection the CQC may access our care records and other personal data as part of their regulatory activity. Further information on how the CQC handles data can be found in their privacy notice.
5. How and Where Do You Store or Transfer My Personal Data?
We will only store or transfer your personal data in the UK. If you require personal data to be transferred outside of the UK e.g. transferring medical notes or a referral letter to a new caregiver then we will forward such data directly to you, by secure email, and ask you to forward on personally as necessary.
We maintain physical, technical and procedural safeguards that are appropriate to the sensitivity of the personal information in question. These safeguards are designed to protect your personal information from loss and unauthorised access, copying, use, modification or disclosure.
All patients who receive care are registered on our computer system and/or in a locked manual filing system. This database holds your name, address, date of birth, telephone number, e-mail address, confirmation that ID has been checked and your regular (NHS) GP recorded – you will be asked to indicate if you consent to CD Practice sharing clinical information with your regular GP (please note you may change this decision at any time).
The database is held by CD Practice. Personal data about you is held in the practice’s computer system and/or in a locked manual filing system. The information is only accessible to authorised practice members. Our computer system and has secure audit trails and we back up information routinely. The practice has a confidentiality policy that all staff adhere to.
The locked manual filing system is located in alarmed premises with controlled access to buildings, rooms, cabinets where data, computers, media or hardcopy materials are held. Sensitive data is transported only under exceptional circumstances, even for repair purposes.
Network security includes firewall protection and security-related upgrades and patches to operating systems to avoid viruses and malicious code. Computer systems are locked with a password that is changed regularly and we ensure that computer software is up-to-date. We implement password protection and controlled access to data files, for example ‘no access’, ‘read only’, ‘read and write’ or ‘administrator-only’ permission. We control access to files, folders and hard drives with a password and no personal or confidential data shall be sent via email or other file transfer means without first encrypting them. We destroying data in a consistent manner when needed.
Cloud data storage should not be used for high-risk information such as files that contain personal or sensitive information.
6. What personal data do we hold apart from that collected when registering at CD Practice?
As a medical practice we will hold medical records and information about you in order to treat you appropriately and in a timely manner.
To provide patients with a high standard of medical care, we need to hold personal information. This personal data can include:
- Past and current medical conditions; personal details such as age, address, telephone number, e-mail, next of kin, NHS GP (as outlined above in the ‘Registering for care’ section)
- X-rays and clinical photographs
- Information about your treatment that we have provided or propose and its cost
- Notes of conversations or incidents that might occur for which a record needs to be kept
- Records of consent to treatment
- Any correspondence relating to you from yourself or other health care professionals
7. Why do we hold information about you?
We need to keep comprehensive and accurate personal data about patients to provide you with safe and appropriate medical care. We will ask you yearly to update your medical history and contact details.
8. Identifying patients who might be at risk of certain diseases
Your medical records may be reviewed and further questions asked in a consultation, so that we can identify patients who might be at risk from certain diseases or conditions such as diabetes or hypertension. This means we can offer patients additional care or support as early as possible.
For more information please speak to the Practice Manager.
Sometimes we need to share information so that other people, including healthcare staff, children or others with safeguarding needs, are protected from risk of harm. These circumstances are rare.
We do not need your consent or agreement to do this. Please see our safeguarding policies for more information:
10. What Are My Rights?
You have the following rights:
- The right to be informed about our collection and use of your personal data. This Privacy Notice should tell you everything you need to know, but you can always contact us to find out more or to ask any questions.
- The right to access the personal data we hold about you and to receive a copy. Parents may access their child’s records if this is in the child’s best interests and not contrary to a competent child’s wishes. Formal applications for access must be in writing to the Practice Manager
- The right to have your personal data rectified if any of your personal data held by us is inaccurate or incomplete. We are not aware of any circumstances in which you will have the right to delete correct information from your medical record, although you are free to obtain your own legal advice if you believe there is no lawful purpose for which we hold the information and contact us if you hold a different view. Please contact us to find out more.
- The right to be forgotten, i.e. the right to ask us to delete or otherwise dispose of any of your personal data that we have. Please contact us to find out more.
- The right to restrict (i.e. prevent) the processing of your personal data.
- The right to object to us using your personal data for a particular purpose or purposes including the right to object to information being shared between those who are providing you with direct care.
- this may affect the care you receive – please speak to the practice.
- You are not able to object when information is legitimately shared for safeguarding reasons.
- In appropriate circumstances it is a legal and professional requirement to share information for safeguarding reasons. This is to protect people from harm.
- The information will be shared with the local safeguarding service. Tel: 020 7641 2176 / 020 7641 1444 / 020 7641 1175 (9am to 5pm) Tel: 020 7641 6000 (out-of-office-hours).
Please see our safeguarding policy for more details.
- The right to data portability. This means that, if you have provided personal data to us directly, we are using it with your consent or for the performance of a contract and that data is processed using automated means, you can ask us for a copy of that personal data to re-use with another service or business in many cases.
- Rights relating to automated decision-making and profiling. We do not use your personal data in this way.
For more information about our use of your personal data or exercising your rights as outlined above, please contact us using the details provided in Part 11.
Further information about your rights can also be obtained from the Information Commissioner’s Office or your local Citizens Advice Bureau.
If you have any cause for complaint about our use of your personal data, you have the right to lodge a complaint with the Information Commissioner’s Office.
11. What Personal Data Do You Collect?
We collect and maintain different types of personal information in respect of those individuals who seek to be, are, or were patients, including the personal information contained in:
- Booking appointments
- Adding details to the clinic patient list or waiting list
- Medical reports/letters
In addition to the examples listed above, personal information also includes information such as Name; Date of birth; Gender; Address; Email address; Telephone and mobile number; Business name; Job title; Profession; Payment information; marital status; Insurance details and any other information necessary to CD Practice business purposes, which is disclosed in the Terms and Conditions.
As a general rule, we collect personal information directly from you. In most circumstances where the personal information that we collect about you is held by a third party, we will obtain your permission before we seek out this information from such sources (such permission may be given directly by you, or implied from your actions). An example of this would be sending information to your insurance company to process your medical expenses claim.
From time to time, we may use the services of third parties and may also receive personal information collected by those third parties in the course of the performance of their services for us. In that case, we will take reasonable steps to ensure that such third parties have represented to us that they have the right to disclose your personal information to us.
Where permitted or required by applicable law or regulatory requirements, we may collect information about you without your knowledge or consent.
12. How Do You Use My Personal Data?
Under the GDPR, we must always have a lawful basis for using personal data. This may be because the data is necessary for our performance of a contract with you, or because you have consented to our use of your personal data, or because it is in our legitimate business interests to use it.
a) Purpose of the processing
Your personal data will be used for the following purposes:
- Providing and managing your account.
- Supplying our services to you and to give direct health to you. For example, when a patient agrees to a referral for direct care, such as to a hospital, relevant information about the patient will be shared with the other healthcare staff to enable them to give appropriate advice, investigations, treatments and/or care.
- To check and review the quality of care. (This is called audit and clinical governance.)
- Communicating with you. This may include responding to emails or calls from you.
- To advise patients of changes to services or new services.
b) Lawful basis for processing
These purposes are supported under the following sections of the GDPR:
- Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’; and
- Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…’
13. Who we share your personal data with
To provide proper and safe medical care we may need to disclose personal information about ou including to:
- Healthcare professionals and staff in this practice
- Hospitals (if required, e.g. referral or emergency transfer)
- Out of hours services
- Diagnostic and treatment centres
- Other organisations involved in the provision of direct care to individual patients
- Regulatory bodies e.g. Care Quality Commission, HMRC
- third party data processers who may process data on our behalf to enable us to carry out our usual business practices.
- HMRC, legal and other regulators or authorities, including those who request your personal data or to report any potential or actual breach of applicable law or regulation
- law enforcement agencies, courts or other relevant party, to the extent necessary for the establishment, exercise or defence of legal rights
- third parties where necessary for the purposes of prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties;
- third parties which are considering or have decided to acquire some or all of our assets or shares, merge with us or to whom we may transfer our business (including in the event of a reorganisation, dissolution or liquidation);
Disclosure will take place on a ‘need-to-know’ basis. Only those individuals or organisations who need to know to provide care for you will be given the information.
In very limited circumstances or when required by law or a court order, personal data may have to be disclosed to a third party not connected with your health care. Where possible you will be informed of these requests for disclosure.
14. Requesting your consent under GDPR
We will continue to obtain consent from you as a patient be it implied, verbal or written for the treatment or procedures undertaken at CD Practice. This will be in line with the General Medical Council’s guidelines and will be recorded appropriately in your medical records.
In addition to this we will ask you to opt-in to any marketing or other communications, offer choices as to how to communicate with you should you so wish and offer you the option to withdraw consent to that communication at any time.
15. Collection of personal information when visiting our website
You can access most of the pages on our website without giving us your personal information although you may choose to do so, for example when you submit an enquiry. Users are requested not to send confidential details or debit/credit card numbers by e-mail unless specifically asked by us to do so.
When you submit personal information, you consent to our use of the information as set above under ‘Requesting your consent under GDPR’.
16. Data we get from other organisations
We may receive information about your health from other organisations who are involved in providing you with health following a referral from CD Practice. For example, if you go to hospital for treatment or an operation, the hospital will send us a letter to let us know what happens. This means your medical record at this practice is kept up-to date when you receive care from other parts of the health service.
Although obliged to share patient information with your NHS GP (with your consent) currently independent doctors do not have access to care and treatment records you receive elsewhere (NHS or private).
If you do not wish personal data that we hold about you to be disclosed or used in the way that is described in this Privacy Notice, please discuss the matter with your doctor. You have the right to object; however, this may affect our ability to provide you with medical care.
17. Cookies and Internet Protocol (IP) logging
When you visit our website, our server will record your computer’s IP address (the unique numerical address given to every computer connected to the Internet) and the time and duration of your visit.
From time to time our website may contain links to other sites. We are not responsible for the content or privacy practices of third parties that run other websites.
18. Accuracy Of Your Personal Information
It is important that the personal data we hold about you is accurate and current and we take all reasonable precautions to ensure that this is the case but we do not undertake to check or verify the accuracy of personal data provided by you. Please keep us informed if your personal data changes during your relationship with us either by logging onto your account on the website or by contacting us. We will not be responsible for any losses arising from any inaccurate, inauthentic, deficient or incomplete personal data that you provide to us.
19. How Long Will You Keep My Personal Data?
We will not keep your personal data for any longer than is necessary in light of the reason(s) for which it was first collected. We will store your personal data for the time period which is appropriate in accordance with the following criteria:
- the on-going business operation / relationship that we have with you;
- the completion of the purpose for which the personal data was given;
- our legal obligations in relation to that personal data and other legal requirements;
- the type and size of the data held and whether any if it is deemed to be special category personal data; or
- our accounting requirements in relation to that personal data.
We keep the length of time that we hold your personal data for under review. These reviews take place annually. Your medical records will be kept in line with the law and national guidance. Information on how long records are kept can be found at: https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016
20. How Can I Access My Personal Data?
If you want to know what personal data we have about you, you can ask us for details of that personal data and for a copy of it (where any such personal data is held). This is known as a “subject access request”.
All subject access requests should be made in writing and sent to the email or postal addresses shown.
If your request is ‘manifestly unfounded or excessive’ (for example, if you make repetitive requests) fees may be charged to cover our administrative costs in responding.
We will respond to your subject access request within 14 working days and, in any case, not more than one month of receiving it. Normally, we aim to provide a complete response, including a copy of your personal data within that time. In some cases, however, particularly if your request is more complex, more time may be required up to a maximum of three months from the date we receive your request. You will be kept fully informed of progress.
When requesting access to your personal information, please note that we may request specific information from you to enable us to confirm your identity and right to access, as well as to search for and provide you with the personal information that we hold about you.
Your right to access the personal information that we hold about you is not absolute. There are instances where applicable law or regulatory requirements allow or require us to refuse to provide some or all of the personal information that we hold about you. In addition, the personal information may have been destroyed or erased in accordance with our record retention obligations and practices.
If we cannot provide you with access to your personal information, we will try to inform you of the reasons why, subject to any legal or regulatory restrictions.
21. How Do I Contact You?
To contact us about anything to do with your personal data and data protection, including to make a subject access request, please use the following details (for the attention of Sara St John Perry Practice Manager):
Email address: firstname.lastname@example.org
Telephone number: 07720 558940
Postal Address: 10 Harley Street, London, W1G 9PF
Information relating to any changes, that affect your personal data protection, will be made notified to you by email.