City Health Practice logo

Venn PCN Providing NHS services

Privacy

Temporary Notice General Practice Solutions (GPS) is supporting Primary Care with patient document management and document coding. The patient privacy notice explains the details regarding the involvement of General Practice Solutions and their role in our patient liaison operations.

Privacy Notice

This privacy notice tells you what we do with your personal information when you contact us or use our services.

We are the controller for your information. A controller decides on why and how information is used and shared.

Data Protection Officer contact details

Our Data Protection Officer, Claire Attwood, is responsible for monitoring our compliance with data protection requirements. You can contact them with queries or concerns relating to the use of your personal data at CHCP.customercare@nhs.net

How do we get information and why do we have it?

The personal information we collect is provided directly from you for one of the following reasons:

  • You have provided information to seek care – this is used directly for your care, and also to manage the services we provide, to clinically audit our services, investigate complaints, or to be used as evidence as part of an investigation into care.
  • You have sought funding for continuing health care or personal health budget support.
  • You have signed up to our newsletter/patient participation group.
  • You have made a complaint. We also receive personal information about you indirectly from others, such as:
  • Other health and care organisations involved in your care so that we can provide you with care
  • From family members or carers to support your care

What information do we collect?

Personal information

The doctors, nurses and team of healthcare professionals caring for you keep records about your health and any treatment and care you receive. Personal information is any information that can be used to identify a living person. For example, an individual's name, address, date of birth, email address, telephone number, or NHS number.

We collect and use the following personal information:

  • Personal identifiers and contacts (for example, name and contact details)
  • Medical information, test results and diagnoses.
  • Notes and reports about your health, treatment and care
  • Relevant information from people who care for you and know you well such as health professionals and relatives.
  • Photographs, scans and/or x-rays
  • CCTV footage It is essential that your details are accurate and up to date. Always check that your personal details are correct when you visit us and please tell us about any changes as soon as possible.
More sensitive information

The UK GDPR gives extra protection to more sensitive information known as ‘special category data’. Information concerning health and care falls into this category and needs to be treated with greater care. Data that relates to criminal offences is also considered particularly sensitive.

We process the following more sensitive data (including special category data):

  • Data concerning physical or mental health (for example, details about your appointments or diagnosis)
  • Data revealing racial or ethnic origin
  • Data concerning a person’s sex life
  • Data concerning a person’s sexual orientation
  • Genetic data (for example, details about a DNA sample taken from you as part of a genetic clinical service)
  • Biometric data (where used for identification purposes)
  • Data revealing political opinions
  • Data revealing religious or philosophical beliefs
  • Data revealing trade union membership
  • Other [please state any other special category data]
  • Data relating to criminal or suspected criminal offences

Who do we share information with?

Primary Care Network (PCN)

CHPL is part of the VENN PCN. a group of practices working together to create more collaborative workforces which ease the pressure of GPs, leaving them better able to focus on patient care. This means the practice may share your information with other practices within the PCN to provide you with your care and treatment. Other members of the network are:

  • Bridge Group Practice
  • Sutton Manner Practice
  • CHCP
  • The Quays
  • Riverside
  • East Park The PCN also carries out service evaluations in order to improve the quality and accessibility of primary care services. This may be carried out in a number of ways including telephone surveys, online surveys and interviews. To process the survey information, we collect from you we will only do so with your consent.

Medicines Management

CHPL may conduct Medicines Management reviews of medications prescribed to its patients under a processing arrangement with the Medicines Management Team at the ICB. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments.

Who are our other partner organisations?

We may also share information with the following types of organisations:

  • Hospitals and NHS Trusts e.g. Hull University Teaching Hospital Trusts, Medical Examiner Service
  • Community Care Teams
  • Care homes
  • Local Authorities
  • NHS England
  • Third party data processors
  • Planners of health and care services (such as Integrated Care Boards)
  • Other ‘data processors’ which you will be informed of

We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor an appropriate contract (UKGDPR Article 24-28) will be established for the processing of your information.

You may be receiving care from other people as well as the NHS, for example Social Care services. We may need to share some information about you with them so we can all work together for your benefit if they have a genuine need for it or we have your permission. Therefore, we may also share your information, subject to strict agreement about how it will be used with:

  • Social care services
  • Education services
  • Local authorities
  • Voluntary and private sector providers working with the NHS.

  • In some circumstances we are legally obliged to share information. This includes:

  • When required by NHS England to develop national IT and data services
  • When registering births and deaths
  • When reporting some infectious diseases
  • When a court orders us to do so
  • Where a public inquiry requires the information

We will also share information if the public good outweighs your right to confidentiality. This could include:

  • Where a serious crime has been committed
  • Where there are serious risks to the public or staff
  • To protect children or vulnerable adults

We may also process your information in order to de-identify it, so that it can be used for purposes beyond your individual care whilst maintaining your confidentiality. These purposes will include to comply with the law and for public interest reasons.

What is our lawful basis for using information?

Personal information

Under the UK General Data Protection Regulation (UK GDPR), the lawful basis we rely on for using personal information is: a. We have a contractual obligation b. We have a legal obligation c. We need it to perform a public task d. We have a legitimate interest

More sensitive data

Under UK GDPR, the lawful basis we rely on for using information that is more sensitive (special category): e. We need for a legal claim or the courts require it. f. There is a substantial public interest (with a basis in law). g. To provide and manage health or social care (with a basis in law). h. To manage public health (with a basis in law).

Common law duty of confidentiality

In our use of health and care information, we satisfy the common law duty of confidentiality because:

  • You have provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses).
  • We have support from the Secretary of State for Health and Care following an application to the [Confidentiality Advisory Group (CAG)](https://www.hra.nhs.uk/about-us/committees-and-services/confidentiality-advisory-group/#:~:text=The%20Confidentiality%20Advisory%20Group%20(CAG,Health%20for%20non-research%20uses.) who are satisfied that it isn’t possible or practical to seek consent.
  • We have a legal requirement to collect, share and use the data.
  • For specific individual cases, we have assessed that the public interest to share the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime). This will always be considered on a case by case basis, with careful assessment of whether it is appropriate to share the particular information, balanced against the public interest in maintaining a confidential health service.

How do we store your personal information?

Your information may be stored both electronically or by paper, there are technical and organisational security measures in place to protect personal data, this can be through appropriate access controls in place. Everyone working within CHPL has a legal duty to keep information about you confidential. Similarly, anyone who receives information from us has a legal duty to keep it confidential.

Your information is securely stored for the time periods specified in the Records Management Code of Practice. Adult records are held for 8 years after being discharged from the service. We will then dispose of the information as recommended by the Records Management Code, for example, we will:

  • Securely dispose of your information by shredding paper records, or putting your electronic hard drive data to ‘beyond use’ until the retention period of backups are written over. Medical records are deducted from the system.
  • Archive your information at a historically significant service’s record may be archived with the local Archive Service, which is run by the Local Authority].

What are your data protection rights?

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information (known as a subject access request). Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete. Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances. Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances. Your right to object to processing - You have the right to object to the processing of your personal information in certain circumstances. Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

If you wish to make a right of access request email CHPL.secretaires@nhs.net

National data opt-out

We are applying the national data opt-out because we are using confidential patient information for planning or research purposes. The information collected about you when you use health and care services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

  • Improving the quality and standards of care provided
  • Research into the development of new treatments
  • Preventing illness and diseases
  • Monitoring safety
  • Planning services

This may only take place when there is a clear lawful basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential health and care information is only used like this when allowed by law.

Whenever possible data used for research and planning is anonymised, so that you cannot be identified and your confidential information is not accessed.

You have a choice about whether you want your confidential information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential information will still be used to support your individual care.

To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters.

You can change your mind about your choice at any time.

Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.

Summary Care Record

During the Covid 19 pandemic changes were made to the Summary Care Record (SCR) to make additional patient information available to all appropriate clinicians when and where they needed it, to support direct patients care, leading to improvements in both care and outcomes.

These changes to the SCR will remain in place unless you decide otherwise.

Regardless of your past decisions about your Summary Care Record preferences, you will still have the same options that you currently have in place to opt out of having a Summary Care Record, including the opportunity to opt-back in to having a Summary Care Record or opt back in to allow sharing of Additional Information.

You can exercise these choices by doing the following:

  1. Choose to have a Summary Care Record with all information shared. This means that any authorised, registered and regulated health and care professionals will be able to see a detailed Summary Care Record, including Core and Additional Information, if they need to provide you with direct care.
  2. Choose to have a Summary Care Record with Core information only. This means that any authorised, registered and regulated health and care professionals will be able to see limited information about allergies and medications in your Summary Care Record if they need to provide you with direct care.
  3. Choose to opt-out of having a Summary Care Record altogether. This means that you do not want any information shared with other authorised, registered and regulated health and care professionals involved in your direct care. You will not be able to change this preference at the time if you require direct care away from your GP practice. This means that no authorised, registered and regulated health and care professionals will be able to see information held in your GP records if they need to provide you with direct care, including in an emergency.

To make these changes, you should inform your GP practice.

How do I complain?

If you have any concerns about our use of your personal information, you can make a complaint to us, please ask to speak to the Practice Admin Manager or call our complaints telephone number, 01482 236098. Following this, if you are still unhappy with how we have used your data, you can then complain to the ICO.

The ICO’s address is:
Information Commissioner’s Office Wycliffe House Water Lane Wilmslow Cheshire SK9 5AF Helpline number: 0303 123 1113 ICO website: https://www.ico.org.uk

Freedom Of Information (FOI)

The Freedom of Information Act 2000 does apply to CHPL, if you wish to make a FOI request, email CHPL.secretaires@nhs.net or call us on telephone number, 01482 236098

You may wish to direct your FOI to one of our commissioners who may be able to support your request for information:

Humber and North Yorkshire Integrated Care Board Email: hnyicb.foi@nhs.net Address: Freedom of Information, Humber and North Yorkshire ICB Team, Health House Grange Park Lane, Willerby, HU10 6DT

NHS England Email: england.contactus@nhs.net Address: NHS England, PO Box 16738, Redditch, B97 9PT

Date of last review July 2025 Next Review Date July 2026_

Cookies

Cookies are small files saved on your phone, tablet, or computer when you visit a website.

This website stores one cookie on your computer, which is used for the purposes of improving performance of the website. It expires after thirty minutes. It is not used for the purposes of analytics, tracking, or advertising, and it is not used to gather any information about your browsing behaviour nor shared with any third parties.