Privacy

Privacy notice

As data controllers, GPs have fair processing responsibilities under the Data Protection Act 2018 and the General Data Protection Regulation (GDPR). This means ensuring that your personal confidential data (PCD) is handled in ways that are safe, transparent and what you would reasonably expect. Please find documents and links below (if you can't access the information in the documents please contact the surgery for help).

Data Protection Officer (DPO)

Our Data Protection Officers are responsible for monitoring our compliance with data protection requirements.

DPOs: Barry Moult & Tania Palmariellodiviney
Contact Email: [email protected]

You can contact them with queries regarding how your data is held, to request access to your information, or to make a complaint.

Bridgewater Surgeries Privacy Notice

We understand how important it is to keep your personal information safe and secure, and we take this very seriously. We are required by Law to provide you with this Privacy Notice. It explains how we collect, use, and share the personal and healthcare information we hold about you.

Our Contact Details

Main Address: Bridgewater Surgeries, 7 Printers Avenue, Watford, Herts WD18 7QR

Branch Sites: Meriden Surgery, North Approach Surgery, and St Albans Road

Website: www.bridgewatersurgeries.nhs.net

We are the Data Controller of your information. This means we are responsible for collecting, storing, and handling your personal and healthcare information when you register with us as a patient.

What Information We Collect

We collect and use the following information to provide you with healthcare services:

Personal Identifiers: Name, contact details, email, and next of kin details.
Demographics: Age range, gender, and ethnicity.
Health Records: Medical history, diagnosis details, and notes from consultations with our GPs and health professionals.
Sensitive Data: Racial or ethnic origin, genetic data, and data concerning health or sex life.

How We Get Information and Why We Have It

Most of the personal information we process is provided directly by you so that we can provide you with medical care. We also receive information indirectly from others, including:

Hospitals, consultants, or other healthcare professionals involved in your care.
Family members or carers supporting your care.
Insurance companies, police reports, or court orders where relevant.

Sharing Your Information

We share your information with approved organisations to ensure you receive the best possible treatment. These include:-

Direct Healthcare Providers: Hospital professionals, other GPs, pharmacists, nurses, dentists, and mental health professionals.
Service Partners: We use Anima for patient communications and Heidi Health (an AI-powered medical scribe) to assist in documenting consultations.
Legal Obligations: We may share data with the police, solicitors, or immigration enforcement if required by Law or court order.

Lawful Basis for Processing

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal bases:-

Public Task: We have a contract with NHS England to deliver healthcare services to the public.
Vital Interests: To protect your life in emergency situations where you cannot give consent.
Health or Social Care: To provide and manage medical treatment (with a basis in law).

National Data Opt-Out

Your confidential patient information can be used for research and planning to improve NHS services. Most of the time, this data is anonymised.

You have a choice about whether you want your information used this way.
To opt out, visit www.nhs.uk/your-nhs-data-matters.
Opting out will not affect your individual care.

Your Data Protection Rights

Under data protection law, you have the following rights:-

Right of Access: You can ask for copies of your personal information (Subject Access Request).
Right to Rectification: You can ask us to correct inaccurate or incomplete information.
Right to Erasure/Removal: You can ask for your information to be removed, though this may not be possible if the data is required for your medical care.
Right to Object: You can object to the processing of your data in certain circumstances.

We have one month to respond to your request, and there is usually no charge.

Storage and Security

We take the security of your information very seriously. Your information is securely stored for the time periods specified in the NHS Records Management Code of Practice. We regularly update our systems and train our staff to ensure your data is protected.

How to Complain

If you have concerns about our use of your personal information, please contact our Data Protection Officer.

You can also complain to the Information Commissioner’s Office (ICO):-

Address: Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Helpline: 0303 123 1113
Website: https://www.ico.org.uk

Your Privacy: A Guide for Young People

Bridgewater Surgeries

When you come to see a doctor or nurse, we need to keep information about you to help you stay healthy. This guide explains how we look after that information.

Who are we?
We are Bridgewater Surgeries. We have four different buildings where you might see us: 7 Printers Avenue, Meriden Surgery, North Approach Surgery, and St Albans Road. Our job is to keep your information safe and use it only when we need to.
What information do we have about you?
We keep things like:-
- Your name, where you live, and your phone number.
- Who your parents or guardians are.
- Notes about your health, including when you’ve been ill or what medicine you take.
- Results from any tests you have had.
Why do we need it?
We use this information to:-
- Make sure you get the right medicine or treatment when you are poorly.
- Talk to other people who help look after you, like hospital doctors or school nurses.
- Use helpful tools like Anima to message you and Heidi Health to help the doctor write notes during your visit.
Who else sees your information?
Sometimes we have to share your information with:-
- Other doctors or nurses looking after you.
- People who give you medicine, like a pharmacist.
- Occasionally, the law says we must share it (for example, to stop people from getting a serious disease).
Can you say "No"?
- Individual Care: We need your information to treat you, so we usually have to keep this record.
- Research: Sometimes doctors use information to learn how to help people better in the future.
- You can ask us not to share your information for this.
Your Rights
Even though you are young, you have "Data Rights." This means you can:-
- Ask to see what we have written about you.
- Ask us to fix something if it is wrong (like if we have your wrong phone number).
- Ask us questions about how we keep your data safe.
Who to talk to
If you have any questions or are worried about your information, you can talk to our Data Protection Officers, Barry and Tania.
You can email them at: [email protected].

Download Bridgewater Surgeries Privacy Notice as a document

Privacy Policy

This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you.

This privacy notice applies to personal information processed by or on behalf of the practice.

This Notice explains

Who we are, how we use your information and our Data Protection Officer
What kinds of personal information about you do we process?
What are the legal grounds for our processing of your personal information (including when we share it with others)?
What should you do if your personal information changes?
For how long your personal information is retained by us?
What are your rights under data protection laws?

The General Data Protection Regulation (GDPR) was incorporated into the UK’s Data Protection Act on 25th May 2018. This is a single EU-wide regulation on the protection of confidential and sensitive information.

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (EU) 2016/679) (the “GDPR”), and the Data Protection Act 2018 (currently in Bill format before Parliament) the practice responsible for your personal data.

This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights.

How we use your information and the law

The practice will be what’s known as the ‘Controller’ of the personal data you provide to us.

We collect basic personal data about you which does not include any special types of information or location-based information. This does however include name, address, contact details such as email and mobile number etc.

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sex during the services we provide to you and or linked to your healthcare through other health providers or third parties.

Why do we need your information?

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which the Practice hold about you may include the following information;

Details about you, such as your address, carer, legal representative, emergency contact details
Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
Notes and reports about your health
Details about your treatment and care
Results of investigations such as laboratory tests, x-rays etc
Relevant information from other health professionals, relatives or those who care for you

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided.

How do we lawfully use your data?

We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services as a General Practice, under the General Data Protection Regulation we will be lawfully using your information in accordance with: –

Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;”

Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members.

Risk Stratification

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts and from this GP Practice. A risk score is then arrived at through an analysis of your de-identified information is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way.

Medicines Management

The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

How do we maintain the confidentiality of your records?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

Data Protection Act 2018
The General Data Protection Regulations 2016
Human Rights Act 1998
Common Law Duty of Confidentiality
Health and Social Care Act 2012
NHS Codes of Confidentiality, Information Security and Records Management
Information: To Share or Not to Share Review

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles.

Our practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the General Data Protection Regulations (GDPR) and all UK specific Data Protection Requirements. Our policy is to ensure all personal data related to our patients will be protected.

All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for the practice an appropriate contract (art 24-28) will be established for the processing of your information.

In certain circumstances you may have the right to withdraw your consent to the processing of data. Please contact the Data Protection Officer in writing if you wish to withdraw your consent. If some circumstances we may need to store your data after your consent has been withdrawn to comply with a legislative requirement.

Some of this information will be held centrally and used for statistical purposes. Where we do this, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes.

With your consent we would also like to use your information to

We would however like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions were authorised research facilities would like you to take part on innovations, research, improving services or identifying trends.

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place. This information is not shared with third parties or used for any marketing and you can unsubscribe at any time via phone, email or by informing the practice DPO as below.

Where do we store your information Electronically?

All the personal data we process is processed by our staff in the UK however for the purposes of IT hosting and maintenance this information may be located on servers within the European Union.

No 3rd parties have access to your personal data unless the law allows them to do so and appropriate safeguards have been put in place. We have a Data Protection regime in place to oversee the effective and secure processing of your personal and or special category (sensitive, confidential) data.

Who are our partner organisations?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations;

NHS Trusts / Foundation Trusts
GP’s
eMBED Health
Independent Contractors such as dentists, opticians, pharmacists
Private Sector Providers
Voluntary Sector Providers
Ambulance Trusts
Clinical Commissioning Groups
Social Care Services
NHS England (NHSE) and NHS Digital (NHSD)
Local Authorities
Education Services
Fire and Rescue Services
Police & Judicial Services
Voluntary Sector Providers
Private Sector Providers
Other ‘data processors’ which you will be informed of

You will be informed who your data will be shared with and in some cases asked for consent for this to happen when this is required.

We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor for the practice an appropriate contract (art 24-28) will be established for the processing of your information.

Anima and Heidi Health

We are committed to providing you with the highest quality of care. To enhance our service, we have introduced Anima which is a communication platform that allows patients to seek care from their GP practice and Heidi Health, an AI-powered medical scribe, to assist in documenting our consultations.

Below are links to Anima and Heidi Health privacy policies which will explain how your data will be managed, and the benefits it brings to your care and our practice

Visit Anima Health page for more detailed information.

Visit Heidi Health AI page for more detailed information.

How long will we store your information?

We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements. More information on records retention can be found online at (https://digital.nhs.uk/article/1202/Records-Management-Code-of-Practice-for-Health-and-Social-Care-2016)

How can you access, amend move the personal data that you have given to us?

Even if we already hold your personal data, you still have various rights in relation to it. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise.

Right to object: If we are using your data because we deem it necessary for our legitimate interests to do so, and you do not agree, you have the right to object. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases). Generally, we will only disagree with you if certain limited conditions apply.

Right to withdraw consent: Where we have obtained your consent to process your personal data for certain activities (for example for a research project), or consent to market to you, you may withdraw your consent at any time.

Right to erasure: In certain situations (for example, where we have processed your data unlawfully), you have the right to request us to “erase” your personal data. We will respond to your request within 30 days (although we may be allowed to extend this period in certain cases) and will only disagree with you if certain limited conditions apply. If we do agree to your request, we will Delete your data but will generally assume that you would prefer us to keep a note of your name on our register of individuals who would prefer not to be contacted. That way, we will minimise the chances of you being contacted in the future where your data are collected in unconnected circumstances. If you would prefer us not to do this, you are free to say so.

Right of data portability: If you wish, you have the right to transfer your data from us to another data controller. We will help with this with a GP to GP data transfer and transfer of your hard copy notes

Access to your personal information

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following:

Your request should be made to the Practice – for information from the hospital you should write direct to them
There is no charge to have a copy of the information held about you
We are required to respond to you within one month
You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time.

What should you do if your personal information changes?

You should tell us so that we can update our records please contact the Practice Manager as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), the practice will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date.