GDPR & Privacy
Privacy Notice
Shefford Health Centre is committed to protecting your privacy and keeping your personal information secure.
We use your information to provide safe and effective healthcare, manage appointments, communicate with you about your care, and meet our legal and NHS obligations.
We process personal information in accordance with:
- Article 6(1)(e) UK GDPR – performance of a task carried out in the public interest.
- Article 6(1)(c) UK GDPR – compliance with legal obligations.
- Article 9(2)(h) UK GDPR – provision of health or social care and treatment.
- Article 9(2)(i) UK GDPR – public health purposes where required.
We do not generally rely on consent to provide healthcare services.
Who We Are
Shefford Health Centre is the Data Controller for the personal information we process.
If you have questions about how your information is used, please contact the Practice.
Website: https://www.sheffordhealthcentre.nhs.uk/
The Practice also has access to a Data Protection Officer (DPO) for advice and oversight regarding information governance and data protection matters.
Email: [email protected]
Telephone: 07810 858088
What Information We Hold
We may collect and process:
- personal details such as your name, address, date of birth and NHS number
- contact details
- medical records and consultation notes
- test results and referrals
- appointment and communication records
- information received from hospitals and other healthcare providers
- prescription information
- safeguarding information where relevant
- website and online service information
How We Use Your Information
Your information may be used for:
- providing direct patient care
- managing appointments and recalls
- referrals to hospitals and community services
- prescriptions and pharmacy services
- safeguarding and public health requirements
- NHS service planning and quality improvement
- responding to complaints or legal obligations
- approved audit and research purposes where permitted
The Practice uses a clinical system called SystmOne to maintain patient records securely. Other NHS healthcare organisations involved in your care may be able to access relevant parts of your record where appropriate and permitted.
Healthcare professionals involved in emergency or urgent care may access relevant information through systems such as the Summary Care Record where appropriate for your care and safety.
The Practice may also participate in approved NHS data analytics and research programmes, including the NHS OpenSAFELY Data Analytics Service, which uses pseudonymised GP data within secure NHS environments for health and care research purposes.
Online Services and Communication Systems
The Practice uses digital systems including:
- Rapid Health
- NHS App
- SystmOnline
- Anima
These services support patient communication, online requests, appointment management, care navigation and access to healthcare services.
Patients may submit medical or administrative requests electronically. Information submitted may include personal and special category health data and may form part of the patient medical record where appropriate.
Some providers maintain their own privacy notices regarding how they process information on behalf of the Practice.
International Transfers
Where suppliers process information outside the UK, appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or adequacy regulations are used.
Even if no transfers occur:
We do not routinely transfer patient information outside the UK.
NHS App and NHS Login
Patients may access certain services using NHS login and the NHS App.
If you use NHS login:
- identity verification is managed by NHS England
- some information may be shared with the Practice to support access to services
- information is only used for the purposes of providing NHS services
Further information is available through NHS England regarding NHS login and NHS App privacy information.
Telephone Calls and Call Recording
The Practice uses Surgery Connect telephony systems to support patient communication and access to services.
Call recordings are processed under the Practice’s legitimate healthcare and service management functions and may be used where necessary for patient safety, complaint investigation, safeguarding and staff training.
Call recordings are stored securely and access is restricted to authorised staff only.
Recordings are retained in accordance with the NHS Records Management Code of Practice and the Practice’s information governance procedures.
Who We Share Information With
We may share information where appropriate with:
- NHS hospitals and community providers
- Pharmacies
- NHS England
- Integrated Care Boards (ICB)
- Social care services
- Approved healthcare professionals involved in your care
- Organisations providing services on behalf of the Practice
The Practice also uses approved service providers including secure document, communication and records management providers to support healthcare delivery and administration.
Information is only shared where there is a lawful basis to do so.
Records Management and Storage
Records are retained in accordance with the NHS Records Management Code of Practice for Health and Social Care.
The Practice uses secure storage arrangements for both electronic and paper medical records, including secure off-site storage providers where appropriate.
Data Security
We take information security seriously and use:
- Secure NHS clinical systems
- Role-based access controls
- Encrypted communications
- Staff confidentiality agreements
- Cybersecurity protections
- Secure storage arrangements
All staff receive confidentiality and information governance training and are required to maintain patient confidentiality at all times.
The Practice may use NHS approved digital and artificial intelligence (AI) supported technologies. AI tools may assist staff with administrative tasks, transcription, workflow management or document preparation. Clinical decisions are made by appropriately qualified healthcare professionals and are not based solely on automated processing.
Your Rights
Under UK GDPR you have the right to:
- request access to your records
- request correction of inaccurate information
- request restriction of processing in certain circumstances
- object to some processing activities
- raise a concern or complaint
Requests will be considered in accordance with UK GDPR and NHS requirements.
Your Choices and Opt-Outs
Patients may have the right to object to certain types of information sharing or secondary use of data.
This may include:
- National Data Opt-Out
- Type 1 Opt-Out requests
- local shared care record objections
https://www.nhs.uk/using-the-nhs/about-the-nhs/opt-out-of-sharing-your-health-records/
Please contact the Practice for further information.
Cookies and Website Information
Our website may use cookies and website analytics…
UK PECR (Privacy and Electronic Communications Regulations) requires more detail.
Non-essential cookies are only used where consent has been provided through our website cookie banner.
Contact Us
If you have any questions regarding how your information is used, please contact the Practice.
Shefford Health Centre
Website: https://www.sheffordhealthcentre.nhs.uk/
Information Commissioner’s Office (ICO)
If you remain dissatisfied with how your information has been handled, you may contact the Information Commissioner’s Office (ICO):
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Telephone: 0303 123 1113
Website: https://ico.org.uk/
