This Privacy Notice explains and describes how this GP Practice uses and manages the information it holds about its patients and service users. This includes how the information may be shared with other NHS organisations and with non-NHS organisations, and how the confidentiality of information is maintained.
Our contact details
Practice Name | The Blandford Group Practice |
Address | Whitecliff Mill Street, Blandford DT11 7BH |
Phone number SystmConnect | 01258 452501 https://systmonline.tpp-uk.com/2/OnlineConsultation?OrgId=J81019 |
Website | |
Data Protection Officers | In the first instance of any data protection related query, please submit an online administration request here or contact us by post/in surgery addressed to: Helen Williams & Lynda Bennett |
Data Protection Registration Number | Z5368999 |
How we contact you
SMS communications: if you have provided us with your mobile telephone number, we may use this to send you SMS messages relating to your healthcare. These may include automatic appointment reminders or cancellations, reminders of clinics, invitations to screening, medication reviews, vaccination appointments, requests to complete surveys or to make you aware of services provided by the surgery that we feel will be to your benefit, or to update you about local and national health promotions. If you do not wish to receive these messages, please let the reception team know.
Email communications: where you have provided your email addresses for communication purposes, we may contact you when necessary to do so for direct health care purposes or to provide you with service updates that relate to the essential task and function of the Practice. Electronic communication is a more efficient and cost-effective method of communicating with you. The Practice aims to keep communication to a minimum, but if you do not wish to receive these messages, please let the reception team know.
Recorded telephone calls: where we contact you or you contact us by telephone, we record all incoming and outgoing telephone calls to and from the Practice for the following purposes:
Recordings of telephone calls will only be accessed where necessary by the Practice management team. Recordings are stored in accordance with the NHS Records Management Code of Practice Retention Schedule, after which they are deleted.
What type of personal information do we hold about our patients?
We currently collect and process the following information about our patients:
We work with several Health and Social care organisations and independent treatment centres to provide you with the best possible care and options for treatment. Your information may therefore be shared securely to provide continuity of care.
Sharing patient information
We know that good communication with other healthcare professionals involved in your care is beneficial to you, and so we work closely with many organisations to provide you with the best possible care. This means that if another healthcare professional or service is involved in your care, it might be appropriate to share information with them for you to receive the required care.
Your information will be shared between those involved in providing health care services and treatments to you. This includes doctors, nurses, and allied health professionals, but may also include administrative staff who deal with booking appointments or typing clinic letters.
Health and care professionals may look at confidential patient information about the care they gave you to understand and learn from their work. This is called ‘reflective practice’ and is done to help staff provide better and safer care. Only regulated health or social care professionals who cared for you are allowed to access your information for this reason.
Access to information is strictly controlled and restricted to those who need it to do their jobs. All our staff receive annual mandatory training on confidentiality and data security and have strict contractual clauses within their employment contracts which oblige them to respect data protection and confidentiality.
Who we share with
The Practice shares and receives patient information from a range of organisations or individuals for a variety of lawful purposes, including:
Confidential patient identifiable information is only shared with other organisations where there is a legal basis to do so, such as:
Patient identifiable information is only shared on a need to know basis, where there is a direct purpose to do so, limited to what is necessary for that purpose. Patient information may be shared, for the purposes of providing direct patient care, with other NHS provider organisations such as NHS Acute Trusts (hospitals), NHS Community Health, other NHS General Practitioners (GPs), NHS Ambulance services in order to maintain patient safety; this data will always be identifiable. For the purposes of commissioning and managing healthcare, patient information may also be shared with other types of NHS organisations such NHS Dorset and NHS England. In such cases, the shared data is made anonymous or pseudonymised, wherever possible, by removing all patient identifiable details, unless the law requires the patient’s identity to be included.
Patients are not legally or contractually obliged to share information with their healthcare provider however, your care will be affected if your clinicians do not have the relevant information necessary to diagnose and treat you. If you have set sharing and opt-out preferences these will be respected where there is no lawful obligation to share the information.
Purposes of processing
Our Practice processes patient data for the following primary purposes:
We keep records to:
iGPR Managed Service
We use a processor, iGPR Technologies Limited (“iGPR”), to assist us with responding to requests relating to your patient data, such as subject access requests that you make (or someone acting on your behalf) and report requests that insurers send to us under the Access to Medical Reports Act 1988 in relation to an insurance policy that you hold or that you are applying for. iGPR manages the reporting process for us by reviewing and responding to requests in accordance with our instructions and all applicable laws, including UK data protection laws. The instructions we issue to iGPR include general instructions on responding to requests and specific instructions on issues that will require further consultation with the GP responsible for your care.
Summary Care Record (SCR)
There is a national NHS healthcare records database provided and facilitated by NHS England, which holds your Summary Care Record (SCR). Your SCR is an electronic record which contains information about the medicines you take, allergies you suffer from and any bad reactions to medicines you have had. Storing information in one place makes it easier for healthcare staff to treat you in an emergency, or when your GP Practice is closed. This information could make a difference to how a doctor decides to care for you, for example which medicines they choose to prescribe for you.
Only healthcare staff involved in your care will access your Summary Care Record. When you are registered with a GP Practice in England your Summary Care Record is created automatically. It is not compulsory to have a Summary Care Record. If you choose to opt-out, you need to inform the Practice. For further information about SCR, visit the NHS England website.
Following the covid pandemic, a change has been made to the way Summary Care Records are made available, to enable health and care professionals to have better medical information about the patient they are treating at the point of care. If you have not previously expressed a preference with regard to your SCR, both the core information set out above, and additional information below will be included in your SCR by default. The additional information includes:
Specific sensitive information such as any fertility treatments, sexually transmitted infections, pregnancy terminations or gender reassignment will not be included, unless you specifically ask fir any of these items to be included.
Enhanced Summary Care Record (eSCR)
With your consent, additional information can be added to your Summary Care Record to provide more tailored care to you. Other information that you can choose to include could be:
Additional information is only included in your SCR when you request it, for further information about including additional information on your SCR, visit the NHS Digital website.
Somerset Integrated Digital eRecord (SIDeR)
The SIDeR is a secure shared care record which makes your information available to clinicians in Somerset, should you need to be treated there. As with the DCR, the SIDeR provides access to authorised professionals to obtain as full a picture as possible of your medical history, needs, support and service contacts. Due to our proximity to Yeovil District Hospital, and the number of patients who receive care there, your information is available within the SIDeR. If you have opted out of the DCR, you will also be opted out of the SIDeR.
National Care Records Service (NCRS)
See more about this via the National Care Records Service – NHS England Digital webpage.
GP Connect Access Document Capability – Pilot
NHS England is running a pilot in partnership with South Western Ambulance Service which enables selected clinicians to securely view GP-held documents via the National Care Records Service (NCRS). This is to support safer and faster clinical decision making in urgent and pre-hospital care, reducing the need to contact the GP surgery directly for patient information.
GP Connect
We use a facility called GP Connect to support your direct care. GP Connect makes patient information available to all appropriate clinicians when and where they need it, to support direct patient care, leading to improvements in both care and outcomes. GP Connect is not used for any purpose other than direct care.
Authorised Clinicians such as GPs, NHS111 Clinicians, Care Home Nurses (if you are in a Care Home), Secondary Care Trusts, Social Care Clinicians are able to access the GP records of the patients they are treating via a secure NHS England service called GP connect.
The NHS 111 service (and other services determined locally e.g. other GP Practices in a Primary Care Network) will be able to book appointments for patients at GP Practices and other local services. For additional information about the GP Connect facility, visit the GP Connect – NHS England Digital website.
OpenSAFELY
NHS England has been directed by the government to establish and operate the OpenSAFELY COVID-19 Service and the OpenSAFELY Data Analytics Service. These services provide a secure environment that supports research, clinical audit, service evaluation and health surveillance for COVID-19 and other purposes. Each GP practice remains the controller of its own GP patient data but is required to let approved users run queries on pseudonymised patient data. This means identifiers are removed and replaced with a pseudonym. Only approved users are allowed to run these queries, and they will not be able to access information that directly or indirectly identifies individuals. Patients who do not wish for their data to be used as part of this process can register a type 1 opt out with their GP. You can find additional information about OpenSAFELY here.
The NHS England OpenSAFELY COVID-19 service – privacy notice – NHS England Digital
SurgeryConnect – Telephone and digital communication system
The practice uses Surgery Connect as its telephony system provider. Surgery Connect is a cloud-hosted telephony and patient communication system provided by X-on Health, designed specifically for primary care and GP practices. The service is used to facilitate and manage communications between the practice, patients, and external organisations, including healthcare providers. The system integrates with the practice’s electronic patient record system (SystmOne) and enables the processing and auditing of personal data through caller identification, telephone calls, SMS messaging, video consultations, image sharing, call recordings, and intelligent call routing. These functions support effective communication, efficient service delivery, and an enhanced patient experience, while providing comprehensive audit and reporting capabilities.
GP clinical system – electronic patient records
Our Practice uses an electronic patient record to securely process and share information between NHS staff. This means that the healthcare professional who is caring for you can see your medical history, including any allergies and current medications, to provide you with safe care.
Our Practice uses SystmOne as our Electronic Patient Record. You can find out more about SystmOne on the TPP Website here: https://www.tpp-uk.com/products/systmone, or further details on sharing in SystmOne can be found here.
SystmConnect – Triage system
SystmConnect is a triage system created by TPP which allows the practice to manage patient requests within the existing electronic patient records system (SystmOne). Whenever you contact our practices, either by completing an online request on our website, via our patient services staff in our practice receptions, or via the telephone, our staff will use SystmConnect to record your needs. Requests will be triaged by our staff, with a clinician ultimately deciding how to respond to a clinical request. SystmConnect will save your request directly onto your medical record.
Patients do not need to register with SystmConnect to allow online requests to be submitted, they can enter their details as part of the request submission. Patients who do not have online access can still use our services via the telephone or in person at our practice receptionists. A proxy request will be submitted for those patients who do not wish to submit themselves. They may however receive SMS/email communication sent via the SystmConnect/Communications Annexe which can be viewed without the need for an account.
You can find out more about SystmConnect’ s privacy policy here, or via the TPP website https://tpp-uk.com/systmconnect-privacy-policy/.
Use of Tablets for SystmConnect Requests: Some of our sites provide tablets to help patients submit SystmConnect requests. These devices are offered solely for your convenience. Any information you enter is transmitted securely to our clinical systems and is not stored on the tablet once your session ends. Our IT company Trusted Technology Partnership (TTP) will set-up, maintain, and update the devices. By using these tablets, your information will be processed in the same secure manner as if you submitted the request from your own device. We do not accept responsibility for any information left visible on screens as a result of incomplete submissions. Patient’s are to clear the screen once the submission is complete.
Ortus Health
The practice outsources the scanning & coding of clinical letters onto the patient record to a 3rd party company – Ortus Health. Ortus employ trained staff with an NHS background who process patient letters alongside our in-house Clinical Coding Team in line with internal policies. They operate directly within our clinical system, SystmOne. Access to the clinical system is provided to authorised professionals and is strictly controlled and restricted to those who need it to do their jobs. The work processed by Ortus is audited by our in-house Clinical Coding Team Lead.
Serious Mental Illness Health Checks
This programme supports patients with serious mental illnesses to book physical health checks where they have not attended previous appointments or have declined their health check. Community Action Network (CAN) will be providing this service on behalf of the Practice and may contact you by telephone to assist you in making an appointment. Your details may be entered into Beacon, a customer relationship management system, but only with your agreement.
Enhanced data sharing model (EDSM) in SystmOne
We are able to share clinical information about your health and care requirements held on your SystmOne electronic patient record with other health organisations including other GP practices, child health services, community health services, hospitals, out of hours, continuing healthcare team at NHS Dorset and other similar organisations. This means that the healthcare professional looking after you has the most relevant information to enable them to provide you with the most appropriate care. We automatically set up the sharing facility in our electronic patient record system to allow your information to be shared out to other health organisations for the purpose of direct patient care.
Local trusted organisations that we work with on a regular basis can access your record immediately once they have asked your permission. If you say “no” they will not be able to see any information. An audit log is maintained, showing who accessed your record and when it was accessed. You are entitled to request a copy of this log.
If you see a healthcare professional outside your local geographic area (who also uses SystmOne), and you agree that they can have access to your medical records, you will be asked to provide additional security details in the form of a verification code which is sent to you either as a text, email or via your SystmOnline account. It is therefore important that we always have your up-to-date contact details.
If you do not wish us to share your information in this way, please let us know at Reception and we will ensure that your information is not shared.
Primary care networks
Primary Care Networks (PCNs) are groups of GP Practices working closely together with their local partners (e.g. other primary and community care staff, mental health, social care, pharmacy, hospital, and voluntary services) for the benefit of patients and the local community. Our Practice is part of The Blandford PCN.
Working as part of a network rather than a stand-alone business means that the GP Practices in our PCN can share expertise and resources which means that we can offer a wide range of services to suit the needs of our local community to give you the best possible care. You may be seen by clinicians from anywhere in our PCN, at any of our Practices. In order that they can give you the best possible care, they will have access to your health data. Only healthcare staff involved in your care will have access to your record.
Health Innovation Wessex (HIW)
Health Innovation Wessex (HIW) has been commissioned by NHS Dorset Integrated Care Board to evaluate the Mental Health Practitioner (MHP) role across Dorset. This includes MHP staff type, available/booked MHP slots, DNAs, and cancellations. Health Innovation Wessex will work alongside the MHP service leads in Dorset to extract the data for the evaluation, up until planned end date 31/03/2025.
The data sharing agreement describes one element of the evaluation, the MHP utilisation analysis. The quantitative data extraction requests of MHP utilisation data from the six Primary Care Networks (PCNs) in Dorset collecting MHP utilisation data. The data requested is limited to only a few variables, which are not patient/person identifiable but do identify the PCN and practice from which the data came.
Health Innovation Wessex’s policy is to retain anonymised and pseudo-anonymised data for 6 years after the publication of the final report. We retain identifiable data in accordance with the Data Protection Act (DPA) and General Data Protection Regulation (GDPR) and for a period of 12 months after the publication of the data / final report.
Obesity Medication pathway
To aid the new obesity medication pathway introduced in 2025, the practice has agreed to share data with the Modality LLP Services to enable records to be shared easily for patient management purposes. The Weight Management Referral Hub, operated by LiveWell Dorset, triage referrals and divert to the appropriate medicated/non-medicated pathway.
Social Prescribing
Social prescribing enables GPs, nurses, and other primary care professionals to refer patients to a range of local, non-clinical community services to help patients to improve their health, wellbeing, and social welfare. This can include advice and information on local services and connecting individuals to social activities, clubs, groups, and like-minded individuals in the community. For example, signposting people who have been diagnosed with dementia to local dementia support groups. The Practice will do this by employing someone to act as a ‘link’ between the Practice, the patient, and the non-clinical services within the community, or by using a local provider to deliver this service. Current providers in our area include:
Where we will refer you to one of these providers and will send basic information such as name, NHS number, address, date of birth and background to your health and wellbeing needs. The providers are bound by confidentiality in the same way that Practice staff are, and there is a Data Sharing Agreement in place to ensure that personal data is used in a lawful and appropriate way. More information about social prescribing can be found on the NHS England website.
Dorset care record (DCR)
Health and social care organisations in Dorset may hold different sets of records about you, and not every organisation uses SystmOne. The Dorset Care Record is a confidential computer record that joins up all these different records to create one complete and up to-date record. This provides direct access for authorised health and social care professionals to obtain as full a picture as possible of your history, needs, support and service contacts.
If you do not wish your information to be shared in this way, you will need to opt-out of the Dorset Care Record. You can do this by contacting the Data Protection Officer (details provided on the DCR ebsite). There is a Privacy Notice for the Dorset Care Record which sets out how they use your information.
Dorset Integrated Care Board (ICB)
Dorset’s integrated care board, named ‘NHS Dorset’, undertakes the statutory responsibilities of the previous Clinical Commissioning Group (CCG) and is responsible for healthcare planning to meet the needs of people and communities in Dorset. NHS Dorset will work more closely with other NHS organisations and local authorities in Dorset’s integrated care system, known locally as ‘Our Dorset’ to improve services to meet the needs of local people and deliver better outcomes. The partnership includes:
NHS Dorset have a ‘Dorset Intelligence and Insight’ (DiiS) Business Intelligence platform which uses pseudonymised data to reveal important insights into local and community health care, in order to inform the future of health care for communities. Information is pseudonymised so that when a new service is introduced to help with a particular long term condition in a particular community, the Practice can ask for any of their own patients to be re-identified from the data in order to invite you to use the new service.
Diabetic eye screening
The Dorset Diabetic Eye Screening Programme is provided by NEC Care, commissioned by NHS England South (Wessex) as part of the National Diabetic Eye Screening Programme. The programme supports your invitation for eye screening and ongoing care by the screening programme. Your information may be shared with any Hospital Eye Services you are under the care of to support further treatment, and with other healthcare professionals involved in your care. We also share information with InHealth Intelligence in order to provide diabetic retinopathy screening for our diabetic patients.
Diabetes prevention programme
The Healthier You: NHS Diabetes Prevention Programme is provided in Dorset by ‘Live Well Taking Control (LWTC)’, commissioned by NHS England, as part of the National Diabetes Prevention Programme. This programme identifies those at high risk of Type 2 diabetes and refers them onto a behaviour change programme run by ‘Live Well Taking Control’.
You can find out more about the Diabetes Prevention Programme on their website.
Lifestyle Audit Tool
This tool supports the surgery regarding prescribing Lifestyle Medicine. This will be discussed with the patient if they meet the criteria and if the clinician and patient agree a Lifestyle Prescription can be started. The clinician will fill out the appropriate agreed steps in consultation with the patient. Once the template has been completed it will auto-populate a patient information leaflet, which can be given to the patient.
The ANP running this project has undertaken the relevant “Prescribing lifestyle medicine course” and will have access to the information extracted from the clinical system. The audit tool automatically extracts our PLM data, which enables them to track and view our progress with PLM appointments.
Numed Healthcare – ECG software integration with patient record
Numed holdings Ltd is a health equipment supplier who also provide services which use integration software facilitating the exchange of data between the patient record system and a range of diagnostic medical devices (ECGs) supplied by Numed Healthcare.
The nature of processing means any operation including collection, accessing, recording, use, disclosure by transmission and other processing of Personal Data (whether or not by automated means) necessary to provide the Services. Purpose of the data processing is strictly necessary to facilitate the provision of the functions set out above, to the extent they support the provision of the Services. Types of personal data processed includes, identity, contact and technical. Types of sensitive data processed includes data concerning health and race or ethnic Origin. Categories of data subject includes service users, patients, and customer employees. Data protection contact for Numed Healthcare – dpo@numed.co.uk.
Infected Blood Compensation Authority
If you have made a claim for compensation through the Infected Blood Compensation Authority (IBCA), we may provide IBCA with relevant information from your medical records to support your claim. You can read more about how IBCA uses your information in their privacy notice. Further information for patients about sharing your information with IBCA can also be found here.
Immedicare Telemedicine Service – Clinical support
Immedicare is a service provided by Airedale NHS Foundation Trust and delivered by NHS clinicians for elderly residents in selected care homes across the country. It provides care homes with 24/7 access to specialist NHS clinicians to deal with urgent care issues. Care is delivered remotely via video call (secure video links), providing rapid assessment, advice and treatment if required. This is aimed at improving patient outcomes while reducing pressure on emergency services and GPs. The initial project will go live in December 2022 and run for 12 months.
Immedicare Team will work closely with the Care home managers and staff ensuring that all residents and relative are fully informed about the service and their right to opt in or out at any time. They can only access information for residents in care homes who are signed up for this service. If support is required, appropriate consent is obtained at the time.
BP at Home – Luscii app
BP at home is a self-management solution for patients at risk of hypertension in Dorset to improve their health by monitoring blood pressure readings, lifestyle factors (smoking, alcohol consumption, exercise), existing medication, and medication adherence. The patient is onboarded on an opt in basis via an app. Patients can enter their latest blood pressure readings, record when they have taken their medication, and answer health and lifestyle related questionnaires. Data entered by patients is stored by the Luscii app and is viewable by the Healthcare practitioner in the Luscii Dashboard.
Data will be stored by the Luscii app, on Amazon Web Services’ clouds within the European Economic Area (EEA), and log information (usage information / audit trail of events that occur in the system) on Google Firebase, Google Cloud Platform and Google Data Studio Patient data, will also be run through a pseudonymisation tool by Omron before transferring it to the Dorset Intelligence & Insight Service (DiiS).
Our practice website
Our website does not use cookies to track your activity online but the “remember these details” feature on our on-line prescription form uses first party cookies on your computer to store your information. This information is only used to remember your details and is never passed to any third party. Cookies must be enabled in your browser for this feature to work. Using this feature means you agree to the use of cookies.
Individual funding request
An ‘Individual Funding Request’ is a request made on behalf of a patient, by a clinician, for funding of specialised healthcare which falls outside the range of services and treatments that NHS Dorset has agreed to commission for the local population.
An Individual Funding Request is taken under consideration when a case can be set out by a patient’s clinician that there are exceptional clinical circumstances which make the patient’s case different from other patients with the same condition who are at the same stage of their disease, or when the request is for a treatment that is regarded as new or experimental, and where there are no other similar patients who would benefit from this treatment. A detailed response, including the criteria considered in arriving at the decision, will be provided to the patient’s clinician.
Invoice validation
Invoice validation is an important process. It involves using your NHS number to check which ICB is responsible for paying for your treatment. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly.
Incident management
If you are involved in an incident, for example you slip and fall whilst in the Practice, your information may be included in the incident report and used as part of the investigation process.
CCTV – Video Recording
As a practice we use CCTV imaging to increase the security of our buildings. These images are collected at the entrances, surrounding grounds and in the reception areas at all three of our premises. These CCTV images are used solely for the purpose of security, to assist with either in-house or Police investigation of an incident. Access to the CCTV images is restricted to necessary senior members of staff and footage is stored for 30 days. However, in the event of an incident requiring investigation, the necessary footage will be saved securely until the investigation has concluded.
Closed-circuit television (CCTV) operates INSIDE & OUTSIDE of the Practice for the following purposes:
Complaints and queries
If you raise a complaint or query with the Practice, the team will hold information about you within their secure database to ensure that your complaint or query is answered appropriately by the relevant person or department. Details of complaints or queries will not be stored within your medical records.
Medical Defence Union (MDU) / The Medical Protection Society (MPS) / Medical and Dental Defence Union of Scotland (MDDUS)
Some of our clinical and non-clinical staff are members of one of the following; the Medical Defence Union (MDU), the Medical Protection Society (MPS) or Medical and Dental Defence Union of Scotland (MDDUS). These organisations help healthcare professionals navigate legal, ethical, and professional challenges. Where a complaint is made against a member, or concerns are raised with a regulatory or law enforcement body (such as the GMC, GDC or the police), the appropriate company may support its member in responding to those matters.
To provide this support, they may request copies of relevant information, including extracts from your medical record where necessary. Any information disclosed to one of these organisations will be anonymised and limited to information that is relevant and proportionate to the matter being investigated with redactions applied where appropriate. Meaning patient-identifiable information will be removed before disclosure, including names, dates of birth, NHS numbers, addresses, telephone numbers, and any other information that could reasonably identify an individual.
Further information about how they process personal data can be found below:
MDU Privacy policy on their website
MPS Privacy Policy on their website
MDDUS Privacy Policy on their website
Secondary uses
We may also process data for the following secondary uses:
These secondary uses help the NHS to:
Our Practice values the concept of data minimisation and will use anonymised or pseudonymised information as much as possible. We rely on UK GDPR Articles 6(1)(e) and Articles 9(2)(h) for lawfully processing identifiable data. Where you have opted-out of the use of identifiable data for secondary purposes, your data will not be used unless it is anonymised or unless there is a legal obligation for us to process it.
Cross Border Transfers between the UK, the EU, other third countries or international organisations
Following the UK’s exit from the European Union the UK has now become a third country under the EU GDPR. An adequacy decision for the UK has been approved by the EU Commission under Article 45(3) of the EU GDPR, allowing the free flow of personal data between the EU and the UK to continue. The Practice does not routinely transfer data outside of the European Economic Area and will assess any adhoc transfers against adequacy (UK GDPR Article 45) and appropriateness of safeguards and data protection (UK GDPR Article 46) of the country of transfer.
National data opt-out
Whenever you use a health or care service, important information about you is collected in your patient record for that service to ensure you get the best possible care and treatment. The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:
This may only take place when there is a clear legal basis to use this information. Confidential patient information about your health and care is only used like this where allowed by law. Most of the time, anonymised data is used for research and planning so that you cannot be identified in which case your confidential patient information isn’t needed. You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information you do not need to do anything. If you do choose to opt out your confidential patient information will still be used to support your individual care.
Patients can view or change their national data opt-out choice at any time by using the online service at www.nhs.uk/your-nhs-data-matters, or by calling 0300 3035678. Further information is available at: https://understandingpatientdata.org.uk/what-you-need-know (which covers how and why patient information is used, the safeguards and how decisions are made). Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes and data would only be used in this way with your specific agreement.
Our Practice is compliant with the national data opt-out policy which means that we have systems and processes in place to comply with the national data opt-out so that your choice can be applied to any confidential patient information we use or share for purposes beyond your individual care.
Type 1 opt-out
Patients can opt out of their confidential patient information being used for purposes beyond their individual care without their explicit consent. This opt-out applies to flows of data under the Health and Social Care Act 2012, section 259. If you do not want your personally identifiable patient data to be shared outside of the Practice for purposes other than your own care, you can register a Type 1 opt-out by completing a Type 1 opt-out form available at reception.
The Practice works to the NHS Records Management Code of Practice Retention Schedule fir the retention of our patient information.
The law gives you certain rights to your personal healthcare information that we hold:
You have the right to request a copy of the personal information that we hold about you; this is known as a Subject Access Request. We have one month to reply to you and give you the information that you require. This can be extended by two further months if the request is complex or we have received several requests from you. Subject Access Requests can be made by you the patient, by a legal representative; a solicitor acting on your behalf, a carer, parent, guardian, or appointment representative, with appropriate consent. A personal representative also has the right of access to deceased records.
If you would like a copy of the information, we hold about you, please contact:
The Blandford Group Practice Secretaries – via our SystmConnect platform (available between 8am-3pm) which can be found on our website.
We will provide this information free of charge however, we may in some limited and exceptional circumstances make an administrative charge for any extra copies if the information requested is excessive, complex, or repetitive.
We can restrict disclosure of your information if your doctor feels that granting access would disclose information likely to cause serious harm to your physical or mental health or that of another individual, and where you do not already know the information. Or where granting access would disclose information relating to or provided by a third party who could be identified from the information, and who has not provided consent for it to be released.
NB: Patient online access
All GP surgeries are required to give all patients in England online access to new information as it is added to their GP health record. Patients with online accounts, such as through the NHS App, should be able to read new entries, including free text, in their health record. This applies to future (prospective) record entries and not historic data. More information about accessing online patient GP health records can be found here.
We cannot share your information with anyone else for a purpose that is not directly related to your health without your consent. Patients have the right to restrict the processing of your personal information for secondary purposes through NHS England’s National Data Opt-Out. More information is available here.
The right to restrict processing of healthcare data can only be exercised in the following circumstances:
If you feel that information held about you is incorrect, you have the right to ask for it to be corrected. This applies to matters of fact, not opinion. Incorrect contact information such as your address will be corrected immediately. If the information is of a clinical nature, this will need to be reviewed and investigated by the Practice, which will result in one of the following outcomes:
This right only applies where the original processing is based on the data subject’s consent or fulfilment of a contract that they are party to, and if the processing is automated. However, in the spirit of the Regulations, you have the right to request that your personal and/or healthcare information is transferred in an electronic or other form to another organisation.
The right to appropriate decision making applies to automated processing, including profiling, which produces legal outcomes, or that significantly affects you. The Practice has not identified any automated processing which is solely automated and without human involvement in the outcome of the processing.
This is sometimes known as ‘the right to be forgotten’, but it is not an absolute right. You cannot ask for this right of erasure in relation to records which the Practice is legally bound to retain. The Practice has an obligation, not only to retain information for a specified time, but also not to retain information for longer than is necessary and to dispose of information securely.
Please see above section on retention.
If you are dissatisfied with the handling of your personal information, you have the right to make a complaint. In the first instance, formal complaints should be addressed to:
Whitecliff Surgery, Whitecliff Mill Street, Blandford DT11 7BH or Whitecliff.complaints@dorsetgp.nhs.uk
For the attention of The Practice Complaints Manager/Patient Access and Experience Administrator
You also have the right to make a complaint to the Information Commissioner’s Office – the independent regulator of data protection:
Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF
Or using their online service: https://ico.org.uk/global/contact-us/
Data Protection Principles
There are six core principles to data protection legislation:
Data controller and processors
The Practice is the Data Controller of the data which we gather, hold and create about you.
The Practice engages with data processors who may process your data. All Data Processors are held to strict contractual obligations, which specify the limitations, any access arrangements, storage and retention of data on our behalf as well as strict confidentiality and information handling clauses. All data processors are also held to high information security standards and are asked to provide evidence of how they meet Data Protection legislation. These processors may be software suppliers or specialist and support services.
Lawful basis
From 1 January 2021, the ‘UK GDPR’ has replaced the GDPR as the UK’s data protection law. The Practice processes personal data for primary purposes under the following legal basis:
“processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”
For the processing of personal data for secondary purposes the Practice may rely on one of the following legal bases depending on the circumstances:
“processing is necessary for compliance with a legal obligation to which the controller is subject”
There are some National Audits and patient registers which require the Practice to process your information under Article 6(1)(c) in accordance with UK legislations such as the National Health Service Act 2006 and Health and Social Care (Safety and Quality) Act 2015.
There are also obligations within the Crime and Disorder Act 1998, Terrorism Act, Children’s Act(s) 1989 and 2004, Mental Health Act 1983 and 2007 to share information with the Police or Social Services.
The Practice processes special categories of data (health data) for primary purposes under the following legal bases:
“Processing is necessary for the purposes of preventative or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health and social care systems and services on the basis of Union or Member State law or pursuant to contact with a health professional and subject to the conditions and safeguards referred to in paragraph 3”
Paragraph 3: “Personal data referred to in paragraph 1 [special categories of data] may be processed for the purposes referred to in point (h) of paragraph 2 when those data are processed by or under the responsibility of a professional subject to the obligation of a professional secrecy under Union or Member State law or rules established by national competent bodies or by another person also subject to an obligation of secrecy under Union or Member State law or rules established by national competent bodies.”
“Processing is necessary for the purposes of carrying out the obligations and exercising specific rights of the controller or of the data subject in the field of employment and social security and social protection law in so far as it is authorised by Union or Member State law or a collective agreement pursuant to Member State law providing for appropriate safeguards for the fundamental rights and interests of the data subject”
The Practice processes special categories of data for secondary purposes under the following legal bases:
“Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subjects”
“Processing is necessary for reasons of public interest in the areas of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.”
Where data has been anonymised, it is not considered to be personal data and the UK General Data Protection Regulation and Data Protection Act 2018 will not apply. The Practice will use anonymous data for audit and population health management.
Occasionally, the Practice may rely on consent as a legal basis:
“the data subject has given consent to the processing of his or her personal data for one or more specific circumstances”
Where you are asked for your consent to take part in Research, Clinical Trials or Audits, your care will not be affected if you decline to take part. Research and Audit are vital for the NHS to evaluate and improve Healthcare for everyone.
“the data subject has given explicit consent to the processing of those personal data for one of more specified purposes”
However, these circumstances will be few, and the Practice will not rely on consent where there is another lawful basis that we should use.
“should not provide a valid legal ground for the processing of personal data in a specific case where there is a clear imbalance between the data subject and the controller, in particular where the controller is a public authority and it is therefore unlikely that consent was freely given in all the circumstances of that specific situation.”
Our Practice upholds transparency and fairness through the use of this privacy notice. We uphold data minimisation techniques like pseudonymisation and anonymisation where possible to protect data and ensure that the purpose of processing is relevant and adequate.
The Practice holds data security in the highest importance; our systems have role-based access and clinical systems are auditable to ensure transparency in the use of systems by staff. Devices are encrypted and all our staff undertake annual mandatory data security training.
Reviewed August 2026