This notice explains how St Martin’s Practice will collect, look after, use or otherwise process your personal data.

“Personal data” is information relating to you as a living, identifiable individual. This page of information is our "Privacy Notice" (also called "Fair Processing Notice").

Who is responsible for my information?

St Martin’s Practice is the data controller for your information and is responsible for looking after your record while you are a registered patient. The person with the key responsibility for data protection and security is Camilla Hawkes, Practice Manager.

The Data Protection Officer for St Martin’s Practice is Aaron Linden, Leeds Clinical Commissioning Group, Suites B5-B9, Wira House, Wira Business Park, Leeds LS16 6EB. Email address: Leedsccg.DPO@nhs.net

Any queries or concerns should be raised with the practice first.

Why do we collect information about you? As health professionals, we maintain records about you in order to support your direct care. By registering with the practice, your existing records will be transferred to us from your previous practice so that we can keep them up to date while you are our patient. If you do not have a previous medical record (a new-born child or coming from overseas, for example), we will create a medical record for you. We take great care to ensure that your information is kept securely, that it is up to date, accurate and used appropriately. All of our staff are trained to understand their legal and professional obligations to protect your information and will only look at your information if they need to.

What information do we hold about you?

• Details about you, such as your name, address, carers, biological gender, gender identity, ethnic origin, date of birth, legal representatives and emergency contact details
• Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.
• Notes and reports about your health
• Details about your treatment and care
• Results of investigations such as laboratory tests, x-rays, etc.
• Relevant information from other health professionals, relatives or those who care for you
• The surgery records all calls, both inbound and outbound. If you wish for the call recording to be deleted then please tell the member of staff at the time.
• Social care involvement
• Hospital correspondence and correspondence from other health and social care settings (including x-rays, discharge letters and referrals)
• Relationships/Next of Kin

How is my information stored? Our practice uses a clinical records programme called SystmOne which is where any electronic information about you will be stored. Any information held in paper records is stored securely at the practice. We use a combination of working practices and technology to ensure that your information is kept confidential and secure. Phone call recordings are stored securely on a system provided by our supplier Redcentric and are protected through the company’s GDPR Policy. These recordings will not usually be shared outside the practice.

What is the legal basis that we use to process your information?

We are required to tell you the legal basis that is used for the various ways we process and use your data. The following table sets the main ways your personal data may be used and the corresponding legal basis and category of data. Each purpose is covered in more detail within this notice to explain what these mean in more practical terms.

Purpose of using personal data	Legal basis of processing	Special category of data
Provision of direct care and related administrative purposes e.g., e-referrals to hospitals or other care providers	GDPR Article 6(1)(e) – the performance of a task carried out in the public interest	GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems.
For commissioning and healthcare planning purposes e.g., collection of mental health data set via NHS Digital or local	GDPR Article 6(1)(c) – compliance with a legal obligation	GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health
For planning and running the NHS (other mandatory flow) e.g., CQC powers to require information and records	GDPR Article 6(1)(c) – compliance with a legal obligation (the GP practice) Regulation 6(1)(e) – the performance of a task carried out in the public interest (CQC)	GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health
For planning & running the NHS – national clinical audits	GDPR Article 6(1)(e) – the performance of a task carried out in the public interest	GDPR Article 9(2)(h) – medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems. Special category 9(2)(i) – public interest in the area of public health
For research	GDPR Article 6(1)(f) – legitimate interests…except where such interests are overridden by the interest or fundamental rights and freedoms of the data subject. GDPR Article 6(1)(e) – the performance of a task carried out in the public interest GDPR Article 6(1)(a) – explicit consent	GDPR Article 9(2)(j) – scientific or historical research purposes or statistical purposes
For safeguarding or other legal duties	GDPR Article 6(1)(e) – the performance of a task carried out in the public interest Regulation 6(1)(c) – compliance with a legal obligation	GDPR Article 9(2)(b) – purposes of carrying out the obligations of ..social protection law.
When you request us to share your information e.g., subject access requests	GDPR Article 6(1)(a) – explicit consent	GDPR Article 9(1)(a) – explicit consent

 When is my information shared? We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

• Data Protection legislation
• Human Rights Act 1998
• Common Law Duty of Confidentiality
• Health and Social Care Act 2012
• NHS Codes of Confidentiality, Information Security and Records Management
• Information: To Share or Not to Share Review

How long does the practice hold my information? As long as you are registered as a patient with St Martin's Practice, your paper records are held at the practice along with your GP electronic record. If you register with a new practice, they will initiate the process to transfer your records. The electronic record is transferred to the new practice across a secure NHS data-sharing network and all practices aim to process such transfers within a maximum of 8 working days. The paper records are then transferred via Primary Care Services England (operated on behalf of NHS England by Capita) which can take longer. Primary Care Services England also look after the records of any patient not currently registered with a practice and the records of anyone who has died.

Once your records have been forwarded to your new practice (or after your death forwarded to Primary Care Services England), a cached version of your electronic record is retained in the practice and classified as “inactive”. If anyone has a reason to access an inactive record, they are required to formally record that reason and this action is audited regularly to ensure that all access to inactive records is valid and appropriate. We may access this for clinical audit (measuring performance), serious incident reviews, or statutory report completion (e.g., for HM Coroner).

In the case of phone call recordings: we will keep recordings for the period of our contract with our provider (Redcentric). Clinical data transcribed from your telephone or other electronic consultations may become part of your clinical record see "For provision of Direct Care" below.

Change of Details It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.

HOW IS MY INFORMATION USED?

For provision of direct care: In the practice, individual staff will only look at what they need in order to carry out such tasks as booking appointments, making referrals, giving health advice or provide you with care.

Sometimes your information may be used to run automated calculations. These can be as simple as calculating your Body Mass Index but they can be more complex and used to calculate some risks to your health that we should consider with you. The ones we use in practice include Qrisk (cardiovascular risk assessment – usually following an NHS Healthcheck), Qdiabetes (diabetes risk assessment) and eFI (electronic frailty index). Whenever we use these profiling tools, we assess the outcome on a case-by-case basis. No decisions about individual care are made solely on the outcomes of these tools but they are used to help us assess and discuss your possible future health and care needs with you.

The term Direct Care means a clinical health activity concerned with the prevention and investigation and treatment of illness. It includes supporting your ability to function and improve your participation in life and society. It also includes the assurance of safe and high quality care and treatment undertaken by one or more registered and regulated health or social care professionals and their team with whom you have a legitimate relationship for your care purposes. It does not include access to information for purposes such as insurance, advertising or marketing.

See also the other tab: "Privacy notice 2: sharing" .

We share information about you with other health professionals where they have a need for it to support your direct care, as follows.

Recipient of data	Reason
Leeds Hospital Foundation Trust	Secondary or emergency care
·         Other national providers of health care who you choose to be referred to, in consultation with your healthcare professional	Secondary or specialist care
Leeds & York Partnership Foundation Trust	Mental health & learning disability services
Mid-Yorkshire Hospitals Trust	Diabetic eye-screening services
Leeds Community Healthcare Trust	Neighbourhood Team services
NHS National Diabetes Prevention Programme	Information and lifestyle education
Local Care Direct	Out of Hours primary care provider
Leeds City Council	Social Care services
Connect Well	Social prescribing
Reed Momenta	Provider of One You Leeds services
Forward Leeds partnership	Provider of Forward Leeds drug & alcohol services
Leeds GP Confederation	Provider of extended access appointments over the telephone and at local hubs.
Chapeltown Primary Care Network	All practices in the UK are members of a Primary Care Network (PCN): a group of practices who work together and with local community, mental health, social care, pharmacy, hospital and voluntary services to provide care to their patients. Other members of Chapeltown are: Allerton Medical Centre, Newton Surgery, Westfield Medical Centre, Chapeltown Family Surgery, Woodhouse Medical Practice. We may share data with other practices within our PCN, for the purpose of patient care (such as extended hours appointments and other services). We have a formal agreement which means that all patient data shared is treated with the same obligations of confidentiality and data security.
Accurx (text and video consultation provider) and Whereby (host video consultations on behalf of accurx)	Provision of direct patient care. See below Data Protection for remote consulting.
eConsult Health Ltd	Online consultation provider for direct patient care
Healthy.Io	Direct patient care. Provider of a smartphone app which helps people with diabetes monitor their kidney function at home. See below Healthy.Io

 For commissioning and healthcare planning purposes:

In some cases, for example when looking at population healthcare needs, some of your data may be shared (usually in such a way that you cannot be identified from it). The following organisations may use data in this way to inform policy or make decisions about general provision of healthcare, either locally or nationally.

• Leeds City Council: Public Health, Adult or Child Social Care Services
• Embed Health Consortium (NHS commissioning support unit)
• Leeds Clinical Commissioning Group
• Leeds Community Healthcare Trust
• NHS Digital (Formerly known as (HSCIC)
• ResearchOne Database
• Other data processors which you will be informed of as appropriate.

In order to comply with its legal obligations we may send data to NHS Digital when

directed by the Secretary of State for Health under the Health and Social Care Act 2012.

This practice contributes to national clinical audits and will send the data which are required

by NHS Digital when the law allows. This may include demographic data, such as date of birth,

and information about your health which is recorded in coded form, for example, the clinical

code for diabetes or high blood pressure.

For research purposes:

Research data is usually shared in a way that individual patients are non-identifiable. Occasionally where research requires identifiable information you may be asked for your explicit consent to participate in specific research projects. The surgery will always gain your consent before releasing any information for this purpose.

Where specific information is asked for, such as under the National Diabetes audit, you have the choice to opt of the audit.

Further details of these audits are available here: [practice list to follow]

For safeguarding purposes, life or death situations or other circumstances when we are required to share information:

We may also disclose your information to others in exceptional circumstances (ie life or death situations) or in accordance with Dame Fiona Caldicott’s information sharing review (Information to share or not to share).

For example, your information may be shared in the following circumstances:

• When we have a duty to others e.g. in child protection cases
• Where we are required by law to share certain information such as the birth of a new baby, infectious diseases that may put you or others at risk or where a Court has decided we must.

Data Protection for remote consulting

At St Martins we, like many other practices, have now offer care via SMS services and video consultations. We know that patients will be concerned about data protection and we take this seriously. The software provider we are using for this is called AccuRx. We have scrutinised their data protection and security policies and sought advice from our Data Protection Officer. AccuRx is a UK company based in London and Whereby (the video consultation host) is based within the European Economic Area. This means that they are bound by GDPR. In addition, AccuRx have been approved by NHS digital and the Leeds CCG for use by GP practices.

How secure are video consultations?

Audio/visual data from video calls is not recorded or stored anywhere. AccuRx do need to obtain and process some demographic information from patients and healthcare professionals which you can read about on their website here; https://www.accurx.com/privacy-policy They also explain how they keep your data secure here; https://www.accurx.com/security

Why are we using this service for text messaging as well?

The Accurx SMS service is instant, and it allows us to share documents such as sick notes or patient information leaflets. We can invite patients to reply to messages, including sending us photos for remote assessment (e.g. of a skin rash).

Healthy.Io

A programme sponsored by NHS Digital to monitor urine albumin:creatinine ratio (ACR) annually for patients with diabetes. This enables patients with diabetes to test their kidney function from home. We will share your contact details with Healthy.io to enable them to contact you and confirm that you wish them to send you a test kit. This will help identify patients at risk of kidney disease and help us agree any early interventions that can be put in place for the benefit of your care. If you do not wish to take part in the service, you have the opportunity to decline when Healthy.io contact you. If you do not wish to receive any further information from Healthy.io then they will delete any data that they hold about you and we will continue to manage your care within the Practice. Further information about this is available at: https://lp.healthy.io/minuteful-info/.

When you request to see your information or ask us to share it with someone else: If you ask us to share your data, often with an insurance company, solicitor, employer or similar third party, we will only do so with your explicit consent. Usually the requesting organisation will ask you to confirm your consent, often in writing or electronically. We check that consent before releasing any data and you can choose to see the information before we send it.

Please see the section Sharing your information for more details of how your personal data is shared electronically within the NHS locally & nationally and your choices about being included in these sharing agreements.

OBJECTIONS/CONCERNS/COMPLAINTS If you are happy for your data to be extracted and used for the purposes described in this notice then you do not need to do anything.

You have the right to object to some or all the information being processed under Article 21. Please contact the Data Controller or the practice. You should be aware that this is a right to raise an objection, that is not the same as having an absolute right to have your wishes granted in every circumstance

You have the right to access the data that is being shared and have any inaccuracies corrected. We can provide copies of recordings if they have not been deleted. There is no right to have accurate medical records deleted except when ordered by a court of Law. The easiest way for you to see your recent records is to register with us to view your records online. See also subject access requests on the next tab. If you wish to access a phone call recording, then please make a Subject Access Request.

Should you have any concerns about how your information is managed at the practice, please contact Camilla Hawkes, Practice Manager. If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website www.ico.org.uk, casework@ico.org.uk, telephone: 0303 123 1113 (local rate) or 01625 545 745

Page last updated: 13.11.2023