Privacy Notice

How we use your information

This privacy notice explains why the Palace Gate Practice collects information about you, and how that information may be used.

As data controllers, GPs have fair processing responsibilities under the Data Protection Act 1998. In practice, this means ensuring that your personal confidential data (PCD) is handled in ways that are transparent and that you would reasonably expect. The law will change again when the General Data Protection Regulations come into force in May 2018. Therefore it is important that patients are made aware of, and understand these changes and that you have an opportunity to object and know how to do so.

The health care professionals who provide you with care maintain records about your health and any treatment or care you have received within the private sector. (e.g. GP or Consultant consultations, hospital scans and tests, blood tests etc). These records help to provide you with the best possible healthcare.

Health records may be processed electronically, on paper or a mixture of both, and a combination of working practices and technology are used to ensure that your information is kept confidential and secure. Records held by the Palace Gate Practice may include the following information:

Details about you, such as address and next of kin
Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
Notes and reports about your health
Details about your treatment and care
Results of investigations, such as laboratory tests, x-rays, etc.
Relevant information from other health professionals, relatives or those who care for you
Financial records pertaining to your treatment

The Practice collects and holds data for the sole purpose of providing healthcare services to our patients and we will ensure that the information is kept confidential.

We can disclose personal information if:

It is required by law
You consent – either implicitly or for the sake of their own care or explicitly for other purposes
It is justified in the public interest

Under the new GDPR regulations which come into force in May 2018, the Practice’s reason for fair and lawful processing is that which is articulated in the new Act.

The GDPR creates a lawful basis for processing special category health data when it is for the provision of direct care and this does not require explicit consent. However, in addition to the GDPR, the Practice as data controllers must also satisfy the common law duty of confidentiality. In order to satisfy the common law the Practice can continue to rely on implied consent to share confidential health data for the provision of direct care.

On some occasions it may be necessary to undertake clinical audits of records to ensure that the best possible care has been provided to you or to prevent the spread of infectious disease – this will be done in anonymised form.

A patient can object to their personal information being processed or shared with other health care providers but if this limits the treatment that you can receive then the doctor will explain this to you at the time. This right applies unless the Practice can demonstrate ‘compelling legitimate grounds for the processing’.

Financial Administration

The Practice out-sources financial administration and patient billing. Data is therefore shared as part of this process. Information such as your name, address and date of treatment may be passed on to enable the billing process. These details are held in a secure environment and kept confidential.

How do we maintain the confidentiality of your records?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with the Data Protection Acts 1998 and 2018, (which are overseen by the Information Commissioner’s Office), the new and impending GDP Regulations 2018Human Rights Act, the Common Law Duty of Confidentiality, and the NHS Codes of Confidentiality and Security.

All of our staff, contractors and associated healthcare professionals receive appropriate and on-going training to ensure they are aware of their personal responsibilities and have contractual obligations to uphold confidentiality, enforceable through disciplinary procedures.

Only a limited number of authorised staff have access to personal information where it is appropriate to their role and is strictly on a need-to-know basis. We maintain our duty of confidentiality to you at all times. We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), or where the law requires information to be passed on.

Medical records are held securely in electronic form and appropriate safeguards are in place to help prevent accidental loss.

To protect your privacy, we will not disclose information over the telephone unless we are certain that we are talking to you. Information will not be disclosed to spouses, families or friends unless we have your prior written consent. We will not leave messages with others.

Access to personal information

You have a right under the Data Protection Act 1998 to access/view information the Practice holds about you, and to have it amended or removed should it be inaccurate. This is known as ‘the right of subject access’. If we do hold information about you we will:

give you a description of it;
tell you why we are holding it;
tell you who it could be disclosed to; and
let you have a copy of the information in an intelligible form.

If you would like to make a ‘subject access request’. please contact the Practice in writing. Requests should be made to Dr Paul Wiseman.

Under the new GDP Regulations, no charges will be levied for the provision of this information unless

Under GDPR, the timeframe for supplying copies of medical records has been reduced to one month
Charging a fee is now removed
The Practice can refuse (or charge) for requests which are deemed to be manifestly unfounded or excessive
In the instance of refusal, The Practice will give reasons and inform that there is a right to complain. This will be communicated within one month.

Additional Rights

Patients also have the following rights under the new GDP Regulations:

The right to have inaccurate records corrected
The right to lodge a complaint with the ICO (Information Commissioner’s Office).
The right to erasure, although it is difficult to envisage the circumstances when this right would apply to medical records. The right to erasure applies only in specific circumstances, for example, when the processing is no longer necessary or when the processing has been unlawful. It is extremely unlikely that these circumstances will be relevant in a health context.
Patients have the right not to be subject to decisions made solely on the basis of automated decision-making processes (for example risk stratification or artificial intelligence) and which has a significant effect on them. The data controller is responsible for the automated decision-making tools, such as algorithmic decision support systems, which they deploy including the consequences of any such processing.

Further information on GDPR and its implications for your medical records are available upon request from the surgery.

Any changes to this notice will be published on our website and on the Practice notice board.

The Practice is registered as a data controller under the Data Protection Act 1998. The registration number is Z5232435 and can be viewed online in the public register at http://ico.org.uk/what_we_cover/register_of_data_controllers

Our contact details are:
Dr P Wiseman
Palace Gate Practice Ltd
The Universal Building
364 Kensington High Street
London W14 8NS

Cookies Policy

Our website uses cookies. We will ask you to consent to our use of cookies in accordance with the terms of this policy when you first visit our website. By using our website and agreeing to this policy, you consent to our use of cookies in accordance with the terms of this policy.

About cookies

A cookie is a file containing an identifier (a string of letters and numbers) that is sent by a web server to a web browser, and stored by the browser. The identifier is then sent back to the server each time the browser requests a page from the server.

Cookies can be used by web servers to identity and track users as they navigate different pages on a website and to identify users returning to a website.

Cookies may be either ‘persistent’ cookies or ‘session’ cookies. A persistent cookie consists of a text file sent by a web server to a web browser, which will be stored by the browser and will remain valid until its set expiry date (unless deleted by the user before the expiry date). A session cookie, on the other hand, will expire at the end of the user session, when the web browser is closed.

The key piece of legislation in the UK relating to cookies is the Privacy and Electronic Communications (EC Directive) Regulations 2003. This cookies policy will also help you to comply with the Data Protection Act 1998 insofar as it affects the use of web cookies.

Regulation 6 of the Privacy and Electronic Communications (EC Directive) Regulations 2003 (as amended) provides that:

(1) Subject to paragraph (4), a person shall not store or gain access to information stored, in the terminal equipment of a subscriber or user unless the requirements of paragraph (2) are met.

(2) The requirements are that the subscriber or user of that terminal equipment – (a) is provided with clear and comprehensive information about the purposes of the storage of, or access to, that information; and (b) has given his or her consent.

(3) Where an electronic communications network is used by the same person to store or access information in the terminal equipment of a subscriber or user on more than one occasion, it is sufficient for the purposes of this regulation that the requirements of paragraph (2) are met in respect of the initial use.

(4) Paragraph (1) shall not apply to the technical storage of, or access to, information – (a) for the sole purpose of carrying out or facilitating the transmission of a communication over an electronic communications network; or (b) where such storage or access is strictly necessary for the provision of an information society service requested by the subscriber or user.”

This cookies policy should be used in conjunction with or as a part of a full Palace Gate Practice privacy policy.

The inclusion of this statement in your privacy policy will not necessarily satisfy the requirements of the Privacy and Electronic Communications (EC Directive) Regulations 2003 as regards consent to the use of cookies. Guidance concerning methods of obtaining such consent is included on the Information Commissioner’s website (http://www.ico.gov.uk).

How we use cookies

Cookies do not contain any information that personally identifies you, but personal information that we store about you may be linked, by us, to the information stored in and obtained from cookies.

We may use the information we obtain from your use of our cookies for the following purposes:

To recognise your computer when you visit our website;
To track you as you navigate our website, and to enable the use of the [specify feature – e.g. shopping cart] on our website;
To improve the website’s usability;
To analyse the use of our website;
In the administration of this website;
To prevent fraud and improve the security of the website;
To personalise our website for you, including targeting advertisements which may be of particular interest to you.

Third party cookies

When you use our website, you may also be sent third party cookies.

Our [advertisers/service providers] may send you cookies. They may use the information they obtain from your use of their cookies:

To track your browser across multiple websites;
To build a profile of your web surfing;
To target advertisements which may be of particular interest to you.

In addition, we use Google Analytics to analyse the use of this website. Google Analytics generates statistical and other information about website use by means of cookies, which are stored on users’ computers. The information generated relating to our website is used to create reports about the use of the website. Google will store this information. Google’s privacy policy is available at: http://www.google.com/privacypolicy.html.

Our advertising services providers may send you cookies for the purpose of enabling the service of advertisements based on your previous visits to our website.

Cookie preferences

You can manage your preferences relating to the use of cookies by visiting the preferences in your web browser.

Blocking cookies

Most browsers allow you to refuse to accept cookies. For example:

In Internet Explorer you can refuse all cookies by clicking ‘Tools’, ‘Internet Options’, ‘Privacy’, and selecting ‘Block all cookies’ using the sliding selector;
In Firefox you can block all cookies by clicking ‘Tools’, ‘Options’, and un-checking ‘Accept cookies from sites’ in the ‘Privacy’ box.

Blocking all cookies will, however, have a negative impact upon the usability of many websites. [If you block cookies, you will not be able to use the many features on this website.

Deleting cookies

You can also delete cookies already stored on your computer:

In Internet Explorer, you must manually delete cookie files you can find instructions for doing so at http://support.microsoft.com/kb/278835;
In Firefox, you can delete cookies by, first ensuring that cookies are to be deleted when you ‘clear private data’ this setting can be changed by clicking ‘Tools’, ‘Options’ and ‘Settings’ in the ‘Private Data’ box and then clicking ‘Clear private data’ in the ‘Tools’ menu.

This document was created based on a template supplied by SEQ Legal.