At Crocus Medical Practice, we are committed to protecting your personal information and ensuring it is handled securely, fairly, and transparently.

The General Data Protection Regulation (GDPR) and the Data Protection Act 2018 set out the standards that organisations must follow when collecting, using, storing, and sharing personal information. These regulations strengthen patients' rights and provide additional safeguards for sensitive health information.

What is Patient Data?

Patient data is any information that can identify you, either directly or indirectly. This may include:

• Your name, address, and contact details
• Date of birth
• NHS number
• Medical history and diagnoses
• Test results and treatments
• Appointment information
• Medication records

As healthcare information is classified as sensitive personal data, it is subject to enhanced legal protections.

How We Use Your Information

We collect and use information about you to provide safe, effective, and high-quality healthcare.

Your information may be used to:

• Deliver your care and treatment
• Maintain accurate medical records
• Coordinate care with other healthcare providers involved in your treatment
• Monitor and improve the quality of services
• Meet legal and regulatory requirements
• Support NHS planning, auditing, and service improvement where appropriate

Information sharing is governed by strict confidentiality and data-sharing agreements.

We will only share your information outside organisations involved in your care where there is a lawful basis to do so, such as your consent, a legal requirement, safeguarding concerns, or where necessary to carry out NHS statutory functions.

Your Consent and Choices

Where consent is required, it will be:

• Freely given
• Specific
• Informed
• Unambiguous

You have the right to withdraw your consent at any time.

If you are happy with the way your information is used to support your healthcare, you do not need to take any action.

If you do not wish your information to be used for purposes beyond your direct care, please contact the Practice and we can discuss the options available to you.

You may also object to certain types of information sharing; however, we will explain if this could affect the care or treatment available to you.

Keeping Your Information Secure

Crocus Medical Practice takes data security seriously.

We:

• Store information using secure NHS-approved systems
• Restrict access to authorised staff only
• Provide regular confidentiality and data protection training
• Monitor and protect against data breaches
• Follow NHS and Information Commissioner's Office (ICO) guidance

Our guiding principle is that your information is held in the strictest confidence.

Your Right to Access Your Records

Under data protection legislation, you have the right to request access to information held about you. This is known as a Subject Access Request (SAR).

If you would like to access your health records:

• Requests should be made in writing.
• You may be asked to provide proof of identity.
• Providing details about the information you require may help us process your request more efficiently.

In most cases, there is no charge for accessing your records. A fee may only be charged where requests are manifestly unfounded, excessive, or repetitive, as permitted by law.

Further Information

For more information about how Crocus Medical Practice uses and protects your information, please refer to our Privacy Notice or speak to a member of the Practice team.