Your Information, Your Rights

At Crocus Medical Practice, we are committed to protecting the privacy and confidentiality of your personal information.

This Privacy Notice explains how we collect, use, store, and share information about you in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, NHS guidance, and other relevant legislation.

We believe it is important that you understand:

• What information we hold about you
• Why we collect and use it
• Who we may share it with
• How we keep it secure
• Your rights regarding your personal information

Data Controller

Crocus Medical Practice is the Data Controller for the personal information we hold about our patients.

As a healthcare provider, we are responsible for ensuring that your personal information is processed lawfully, fairly, securely, and transparently.

Information We Collect

To provide healthcare services, we collect and maintain records containing personal and sensitive information, including:

Personal Information

• Name
• Date of birth
• Address and postcode
• NHS number
• Contact details
• Next of kin or emergency contact information

Special Category (Sensitive) Information

• Medical history
• Details of appointments and consultations
• Diagnoses and treatments
• Prescriptions and medications
• Test results and investigations
• Hospital admissions and discharges
• Social care information
• Ethnic origin and demographic information
• Information relevant to your health and wellbeing

Your healthcare record may include information received from hospitals, community services, mental health providers, social care organisations, pharmacies, and other healthcare professionals involved in your care.

Records may be held electronically, in paper format, or as a combination of both.

Why We Collect and Use Your Information

We process your information to:

• Provide safe and effective healthcare.
• Support diagnosis and treatment.
• Protect your vital interests.
• Manage healthcare services.
• Coordinate care with other healthcare providers.
• Improve the quality and safety of services.
• Carry out clinical audits and service evaluations.
• Support healthcare planning and commissioning.
• Meet our legal and regulatory obligations.
• Participate in approved medical research where appropriate and lawful.

Our lawful basis for processing information includes the provision of healthcare, compliance with legal obligations, performance of tasks carried out in the public interest, and the management of health and social care services.

How We Collect Information

Information may be collected:

• Directly from you.
• From healthcare professionals involved in your care.
• From NHS organisations and hospitals.
• Through referrals and discharge summaries.
• Through secure NHS electronic systems.
• Via secure NHS Mail and encrypted communication networks.

All information is stored securely within approved healthcare systems and medical records.

Who We Share Information With

To provide coordinated healthcare, we may share relevant information with organisations involved in your care, including:

• NHS hospitals and trusts
• Community healthcare services
• Mental health services
• Social care services
• Out-of-hours and NHS 111 services
• Community pharmacies
• Care homes
• Other GP practices involved in your care
• NHS England and associated NHS organisations where required by law

Information is only shared where there is a legitimate and lawful basis to do so and only when necessary for your care, service management, safeguarding, public health, or legal obligations.

Third-Party Service Providers

The Practice uses a number of trusted service providers to help us deliver healthcare services safely and effectively.

Examples include providers of:

• Clinical systems and electronic patient records
• Appointment booking systems
• Online consultation services
• Prescription services
• IT support and data hosting
• Document management and scanning services

Where third parties process information on our behalf, appropriate contractual agreements and security requirements are in place to protect your information.

Keeping Your Information Secure

We take the security of your information seriously.

Measures include:

• Secure NHS-approved systems
• Staff confidentiality agreements
• Mandatory annual data protection training
• Controlled access to records
• Secure passwords and network protection
• Regular audits and monitoring

All staff are legally required to keep patient information confidential.

Records are retained in accordance with the NHS Records Management Code of Practice.

Clinical Audit and Service Improvement

We may use your information as part of clinical audits, service reviews, and quality improvement programmes.

These activities help us:

• Monitor patient outcomes
• Improve safety and quality
• Identify areas for improvement
• Ensure best clinical practice

Where possible, information used for these purposes is anonymised or pseudonymised.

Research

The NHS supports medical research to improve healthcare and develop new treatments.

Where information is used for research purposes, strict legal and ethical safeguards apply.

Most research uses information that does not directly identify patients. Where identifiable information is required, additional legal permissions or patient consent may be necessary.

Risk Stratification

Risk stratification is a process used by the NHS to identify patients who may benefit from additional support or preventative healthcare interventions.

This process helps healthcare professionals:

• Identify patients at higher risk of illness
• Prevent avoidable hospital admissions
• Improve long-term condition management
• Plan appropriate services

Risk stratification uses secure electronic systems and operates under strict NHS governance arrangements.

If you have concerns about how your information is used for risk stratification, please contact the Practice.

Shared Care Records

Your electronic record may be shared securely with other healthcare professionals involved in your direct care.

This may include:

• GP practices
• Hospitals
• Community nursing teams
• Mental health services
• Urgent care services
• Care homes
• Pharmacies
• Social care providers

Shared records help ensure that healthcare professionals have access to the information they need to provide safe and effective treatment.

You can discuss shared record preferences with the Practice if you have concerns about information sharing.

National Data Opt-Out

The NHS may use confidential patient information for research and planning purposes beyond direct care where permitted by law.

You have the right to choose whether your confidential information is used in this way.

Your choice will not affect your medical care or treatment.

To find out more or register your preference, visit:

https://www.nhs.uk/your-nhs-data-matters

Your Rights

Under UK GDPR, you have the right to:

• Be informed about how your information is used.
• Request access to your records.
• Request correction of inaccurate information.
• Request restriction of processing in certain circumstances.
• Object to certain types of processing.
• Request information about how your data is shared.

Some rights may be limited where healthcare or legal obligations apply.

Subject Access Requests

You have the right to request access to the information we hold about you.

Requests should be made in writing to:

Practice Manager
Crocus Medical Practice

The Practice will respond within the timeframes set out under data protection legislation.

Complaints

If you are unhappy with how we have handled your personal information, please contact the Practice Manager in the first instance.

If you remain dissatisfied, you can contact:

Information Commissioner's Office (ICO)
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk

Telephone: 0303 123 1113

Further Information

For more information about how health and care information is used across the NHS, please visit:

• https://www.nhs.uk/your-nhs-data-matters
• https://www.hra.nhs.uk
• https://understandingpatientdata.org.uk