How We Use Your Data - Practice Privacy Notice

 

Your information – what you need to know

This privacy notice explains why Binscombe Medical Centre collects information about you, how we use and share that information, how we keep it safe and confidential, and your rights in relation to your personal data.

More detailed information about the individual ways in which we use and share patient information can be found here in our Patient Privacy Notice and Appendix A.

 

Who is responsible for your information?

Binscombe Medical Centre is the Data Controller for the personal information we hold about our patients. This means that we are responsible for deciding how your information is used and for ensuring that it is handled in accordance with data protection legislation.

​

Our Data Protection Officer is:

 

Dan Clement
Associate Director ICS Information Governance/Data Protection Officer (NHS Kent & Medway Integrated Care Board)

NHS Kent & Medway

2nd Floor, Gail House

Lower Stone Street

Maidstone

ME15 6NB

kmicb.ig@nhs.net  

01634 335095

 

If you have any questions or concerns about how we use your personal information, you can contact the Practice Manager or our Data Protection Officer.

 

What information do we hold?

Health and care professionals who provide you with care are required to maintain records about your health and any treatment or care you have received.

The information we hold may include:

• your name, address, date of birth and contact details;

• your NHS number;

• details of appointments and consultations;

• medical conditions, diagnoses and treatment;

• medications, allergies and immunisations;

• test results and investigations;

• referrals and correspondence from other health and care organisations;

• information about your family or carers where this is relevant to your care; and

• other information necessary to provide healthcare and operate our services.

 

Health information is classed as special category data under UK data protection law and is subject to additional protection.

 

Where does our information come from?

Most of the information we hold is provided by you or created when we provide you with healthcare.

We also receive information from other health and care organisations involved in your care, such as hospitals, community services and other healthcare providers. This enables us to maintain an accurate and up-to-date GP medical record and provide you with appropriate care.

 

Why do we use your information?

We collect and use information primarily to provide you with healthcare and to maintain an accurate record of the care you receive.

We may also use information for other legitimate purposes connected with the provision and management of NHS services. These can include:

• managing and improving our services;

• clinical audit and quality improvement;

• safeguarding;

• public health;

• commissioning and planning NHS services;

• responding to legal and regulatory requirements;

• research, where the appropriate legal and confidentiality requirements have been met; and

• processing payments and claims relating to NHS services.

 

We do not rely on your consent as the legal basis for most of the information we process as part of providing NHS healthcare.

 

The lawful basis we rely upon will depend on the particular purpose for which information is being used. Details of the relevant UK GDPR Article 6 and Article 9 conditions are contained in our Patient Privacy Notice and Appendix A.

 

Who do we share information with?

To provide your care, we may need to share relevant information with other health and care professionals and organisations involved in your treatment.

We may also be required or permitted to share information for other purposes, for example with NHS organisations, regulators, public health bodies or other organisations where there is a lawful basis for doing so.

We only share information where there is an appropriate legal basis and, where applicable, in accordance with the common law duty of confidentiality.

Where information is used for purposes such as research and planning, anonymised or pseudonymised information will be used where appropriate.

Further details about the organisations with which we share information, the reasons for doing so and the relevant lawful bases can be found in our Patient Privacy Notice and Appendix A.

 

Sharing your information and your choices

There is an important distinction between information used for your individual care and information used for other purposes, such as research and planning. Different rules and patient choices may apply depending on why the information is being used.

You can find further information about how NHS organisations use and share patient information here:

NHS England – Consent to using and sharing patient information

For independent guidance about the legal requirements which apply when organisations share personal information, you can also read:

Information Commissioner's Office – Data sharing: a code of practice

 

How long do we keep your information?

We retain health records and other personal information in accordance with the NHS Records Management Code of Practice and other applicable legal and regulatory requirements.

Different types of information may need to be retained for different periods. Information which has reached the end of its required retention period is disposed of securely and appropriately.

 

Keeping your information secure

We are committed to protecting the confidentiality and security of your information.

We have appropriate technical and organisational measures in place to protect personal information against unauthorised access, loss, alteration or disclosure.

Everyone working for the NHS is subject to legal and professional duties of confidentiality.

 

Keeping your details up to date

It is important that you tell us if your contact details change, including your name, address, telephone number or email address.

Please also let us know if details we hold for a carer, next of kin or other contact are no longer correct. Keeping this information up to date helps us to communicate with you safely and reduces the risk of information being sent to the wrong person.

 

Mobile telephone numbers and electronic messaging

If you provide us with a mobile telephone number or email address, we may use these to communicate with you about your healthcare. This may include appointment reminders, invitations, messages from the practice and other relevant health information.

We may also use NHS-approved messaging services, including services which allow messages to be delivered through the NHS App.

Please ensure that you tell us if your contact details change or if there are particular circumstances which mean that it is not safe or appropriate for us to contact you in a particular way.

 

Access to your medical record

You have the right to request access to the personal information we hold about you. This is known as a Subject Access Request (SAR).

You can contact the practice to request a copy of your records. We will normally respond within one month, although data protection law allows this period to be extended in certain circumstances.

There is normally no charge for making a Subject Access Request.

Patients can also access parts of their GP record online through the NHS App or other services made available by the practice.

​

Your other data protection rights

Depending on the circumstances and the lawful basis on which your information is being processed, you may have rights to:

• have inaccurate personal information corrected;

• request the deletion of information;

• request that the use of your information is restricted;

• object to certain uses of your information;

• receive certain information you have provided to us in a portable format; and

• have appropriate safeguards in relation to automated decision-making.

These rights do not apply in every circumstance and some are limited in relation to medical records. For example, information forming part of an accurate medical record will not normally be deleted simply because a patient would prefer it to be removed.

If you wish to exercise any of your data protection rights, please contact the practice.

 

Your right to object

You have the right to object to certain types of processing of your personal information.

Whether we can stop processing your information will depend on the purpose for which it is being used and the lawful basis on which we rely. In some circumstances we may need to continue processing information despite an objection, for example where there is a legal requirement or an overriding reason for doing so.

Please contact the practice or our Data Protection Officer if you wish to object to a particular use of your information.

 

Artificial intelligence and automated decision-making

We may use digital and AI-assisted tools to support administrative and clinical processes. Where these tools are used, appropriate safeguards are put in place and further information about relevant systems can be found in our Patient Privacy Notice.

AI-assisted tools may help healthcare professionals and staff with particular tasks, but this does not necessarily mean that decisions about your care are being made automatically.

We do not use solely automated decision-making to make decisions about patients which have legal or similarly significant effects without appropriate human involvement, unless there is a lawful basis and appropriate safeguards for doing so.

 

Data processed outside the UK

Where personal information is transferred outside the UK, we will ensure that appropriate safeguards are in place in accordance with UK data protection law.

Further information about relevant processing arrangements can be found in our Patient Privacy Notice or obtained from the practice or our Data Protection Officer.

 

Type 1 Opt-out and National Data Opt-out

There are two main opt-outs relating to the use of confidential patient information for purposes beyond your individual care.

 

Type 1 Opt-out

A Type 1 Opt-out can be registered with your GP practice. It prevents confidential patient information held by your GP practice from being shared for purposes such as research and planning, except where the law permits or requires the information to be shared.

If you wish to register a Type 1 Opt-out, you need to complete the appropriate form and return it to the practice.

 

National Data Opt-out

The National Data Opt-out allows you to choose whether your confidential patient information can be used by NHS England and other health and care organisations for certain research and planning purposes.

Your choice does not affect the use of information required to provide your individual care, and there are some circumstances in which an opt-out does not apply, for example where information is required by law.

 

You can find more information about both Type 1 and National Data Opt-outs, including how to register your choices, here:

Opt out of sharing your health records – NHS

 

NHS Federated Data Platform

The NHS Federated Data Platform (FDP) is an NHS England programme which provides NHS organisations with software to help them connect and use information they already hold for purposes including coordinating and improving patient care and managing NHS services.

The National Data Opt-out does not apply to the Federated Data Platform itself. An opt-out applies to particular uses of confidential patient information rather than to an individual IT system or platform. Whether an opt-out applies therefore depends upon the purpose for which information is being processed.

Further information about the Federated Data Platform, including information about the use of patient data, privacy and security, is available directly from NHS England:

NHS Federated Data Platform – NHS England

If you have questions about the NHS Federated Data Platform as a national NHS England programme, you can also contact NHS England directly:

Contact NHS England

 

Complaints about how we use your information

If you have concerns about the way we have collected, used or shared your personal information, please contact the Practice Manager in the first instance.

We will investigate your concerns and respond in accordance with our data protection complaints procedure.

 

You can also contact our Data Protection Officer:

Dan Clement
Associate Director ICS Information Governance/Data Protection Officer (NHS Kent & Medway Integrated Care Board)

NHS Kent & Medway

2nd Floor, Gail House

Lower Stone Street

Maidstone

ME15 6NB

kmicb.ig@nhs.net 

01634 335095

​

You also have the right to complain to the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Telephone: 0303 123 1113

Make a complaint to the ICO

 

You do not have to raise your concern with us before contacting the ICO, although we would welcome the opportunity to investigate and resolve any concerns you have.

 

Data protection legislation

We process personal information in accordance with applicable UK data protection legislation, including the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, as amended by the Data (Use and Access) Act 2025.

Binscombe Medical Centre is registered with the Information Commissioner's Office; ICO registration reference Z7040599

 

Further information

 Appendix A provides further information about:

• the specific purposes for which we process personal information;

• the lawful bases we rely upon;

• organisations with which information may be shared;

• organisations which process information on our behalf; and

• particular systems and services used by the practice.

​