Practice Privacy Policy
Introduction
At Newburn Health Centre, we are committed to protecting your privacy and keeping your personal information safe. Other practice policy documents are also available online.
This privacy policy explains how we collect, use, store and share your personal information when providing NHS healthcare services.
It also explains your rights under data protection law and how you can contact us if you have any questions or concerns.
We handle personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and other relevant healthcare and confidentiality requirements.
This policy applies to patients registered with our practice, people who contact us and visitors to our website.
Who we are
Newburn Health Centre provides NHS primary care services in Scotland.
Our practice details are:
Practice name: Newburn Health Centre
Address: Carden House, Carden Place, Aberdeen AB10 1UT
Telephone: 0345 013 0740
Data Controller: Newburn Health Centre
NHS Board: NHS Grampian
The Data Controller is responsible for deciding how and why personal information is processed.
Different NHS Scotland organisations are responsible for the personal information they hold. In some circumstances, organisations may share responsibility for particular processing activities.
If you have questions about how your information is used, please contact the Practice Manager.
Data Protection Officer: The Practice Manager, Newburn Health Centre.
What information we collect
To provide appropriate healthcare, we collect and maintain information about you.
This may include:
- Your name, address, date of birth and contact details.
- Your Community Health Index (CHI) number.
- Details of your medical history and existing health conditions.
- Information about appointments, consultations and treatments.
- Prescriptions and medication records.
- Test results, investigations and referrals.
- Allergies, vaccinations and immunisations.
- Information received from hospitals and other healthcare professionals.
- Relevant information about your family, carers or next of kin.
- Information you provide through telephone calls, letters and online services.
We may also record information about your communication needs and preferences to help us provide appropriate care.
We only collect and use information that is necessary and relevant to the services we provide.
How we use your information
We use your personal and medical information to provide safe and effective healthcare.
This includes:
- Registering you as a patient.
- Maintaining accurate medical records.
- Arranging appointments and consultations.
- Diagnosing and treating medical conditions.
- Issuing prescriptions and managing medication.
- Referring you to hospitals and specialist services.
- Communicating with other healthcare professionals involved in your care.
- Providing screening and vaccination services.
- Contacting you about appointments, test results and healthcare services.
- Supporting patient safety and safeguarding.
- Improving the quality of healthcare services.
- Meeting our legal and regulatory responsibilities.
Where appropriate and legally permitted, information may also be used to support NHS planning, clinical audits, public health activities and approved research.
Our legal basis for using your information
We do not normally need your consent under data protection law to use your personal information when providing NHS healthcare.
The legal bases we rely upon depend on why the information is being used.
Public task
Article 6(1)(e) of the UK GDPR allows us to process information where necessary to perform tasks in the public interest.
This includes providing NHS healthcare services.
Legal obligation
Article 6(1)(c) of the UK GDPR allows us to process information where necessary to meet a legal requirement.
Health and social care
Article 9(2)(h) of the UK GDPR allows us to process health information where necessary for medical diagnosis, treatment, preventative medicine or the management of health and social care services, subject to applicable safeguards.
Other legal bases may apply in particular circumstances, including public health, safeguarding, emergencies and approved research.
Where consent is the appropriate legal basis for a particular activity, we will explain this and ask for your consent.
Consent to medical treatment is separate from the legal basis used to process your personal information.
How we share your information
We may share relevant information with other organisations and healthcare professionals when necessary for your care or where permitted or required by law.
These may include:
- NHS hospitals and specialist services.
- Other GP practices.
- NHS Boards and NHS Scotland services.
- Community nurses and other healthcare professionals.
- Community pharmacies.
- Mental health services.
- Social care providers.
- NHS National Services Scotland.
- Public Health Scotland.
- Emergency and out-of-hours healthcare services.
- Other organisations where sharing is legally required or authorised.
We only share information where there is an appropriate legal basis and, where applicable, a valid basis under the duty of confidentiality.
We take steps to ensure information is shared securely and that only relevant information is disclosed.
We do not sell your personal or medical information.
Your Emergency Care Summary
NHS Scotland operates an Emergency Care Summary (ECS) to help healthcare professionals provide safe treatment when you need urgent care.
Your Emergency Care Summary may contain important information, including:
- Your name and date of birth.
- Details of your GP practice.
- Your prescribed medication.
- Known allergies and adverse reactions.
Authorised healthcare professionals may access this information when necessary for your care, in accordance with NHS Scotland access and consent requirements.
You can find more information about your Emergency Care Summary on the NHS inform health records page.
Using information to improve NHS services
Information from GP practices may be used by authorised NHS organisations to support healthcare planning, service improvement, public health and research.
Where possible, information used for these purposes will be anonymised or de-identified.
Where identifiable information is required, its use must have an appropriate legal basis and safeguards.
Some uses of patient information may offer choices or opportunities to object.
If you have concerns about your information being used for purposes other than your direct care, please contact the practice.
You can find more information about how NHS Scotland uses personal health information on the NHS inform privacy and data protection page.
How we keep your information secure
We take the security and confidentiality of patient information seriously. Medical records may be held electronically, on paper or in a combination of formats.
We use appropriate security measures to protect personal information against unauthorised access, loss, alteration or disclosure.
These measures may include:
- Secure clinical computer systems.
- Access controls and user authentication.
- Staff confidentiality obligations.
- Information governance training.
- Secure methods of sharing information.
- Procedures for reporting and managing information security incidents.
Access to patient information is restricted to authorised individuals who have a legitimate reason to use it.
How long we keep your information
We retain patient records and other personal information in accordance with applicable NHS Scotland records management requirements, professional guidance and legal obligations.
The length of time information is retained depends on the type of record and the purpose for which it is held.
Medical records may need to be retained for extended periods to support ongoing healthcare and meet legal requirements.
Information will be securely disposed of when it is no longer required and the applicable retention period has ended.
You can read more about NHS Scotland’s approach to retaining health records on the NHS inform health records page.
Your data protection rights
Under UK data protection law, you have rights relating to your personal information.
These include the following rights.
The right to be informed
You have the right to know how your personal information is collected and used.
The right of access
You can request access to personal information held about you, including your medical records.
The right to rectification
You can ask us to correct inaccurate personal information.
The right to erasure
In certain circumstances, you may request the deletion of personal information.
This right is not absolute and may not apply to information we must retain for healthcare or legal reasons.
The right to restrict processing
You may request that the use of your personal information is restricted in certain circumstances.
The right to object
You may object to certain uses of your personal information.
Whether an objection can be upheld depends on the circumstances and applicable legal requirements.
Rights relating to automated decision-making
You have rights relating to certain decisions made solely through automated processing where those decisions have legal or similarly significant effects.
Not all rights apply in every situation.
You can find more information about your rights on the Information Commissioner’s Office website.
Accessing your medical records
- You have the right to request access to your personal medical information.
- This is known as a Subject Access Request (SAR).
- You can make a request by contacting the practice.
- We may need to verify your identity before releasing information.
- Requests are normally handled within one calendar month. This period may be extended where permitted by law.
- There is usually no charge for accessing your personal information.
- In limited circumstances, information may be withheld where an applicable legal exemption applies.
- You can find further information about accessing your records on the NHS inform health records page.
Information about children and young people
We take particular care when handling personal information relating to children and young people.
Parents or guardians may be able to request information on behalf of a child. This depends on the child’s age, capacity, confidentiality rights and the circumstances of the request.
Young people may have their own rights to confidentiality and access to their medical information. Requests are considered in accordance with applicable law and professional guidance.
You can find further guidance on the NHS inform information for young people page.
Website privacy and cookies
When you visit our website, certain technical information may be collected to help the website operate securely and effectively.
This may include:
- Your IP address.
- Browser and device information.
- Pages visited.
- Technical information relating to website performance and security.
Our website may use cookies to support essential functions and, where enabled, additional services.
Non-essential cookies will be subject to the applicable consent requirements.
Further information about the cookies used on this website and how you can manage your preferences is available in our Cookie Policy.
Please do not submit confidential medical information through general website contact forms unless the practice has specifically provided a secure service for that purpose.
Online services and third-party websites
Our website may contain links to external NHS services, online consultation systems, appointment services and other third-party websites.
These services may have their own privacy notices explaining how they collect and process personal information. We recommend reviewing the privacy information provided by any external service before submitting personal information.
Where an external provider processes information on our behalf, appropriate data protection arrangements must be in place.
Transfers of personal information
Where personal information is transferred outside the United Kingdom, appropriate legal safeguards must be in place.
These may include UK adequacy regulations or other approved transfer mechanisms.
We will ensure that any international transfers for which we are responsible comply with applicable data protection requirements.
Questions or concerns about your information
If you have questions about this privacy policy or how your personal information is handled, please contact the practice.
You can ask to speak to the Practice Manager or contact the Data Protection Officer using the details provided in the Who we are section.
If you believe your personal information has not been handled appropriately, you can raise a data protection complaint with the practice.
We will consider your concerns and respond in accordance with applicable data protection requirements.
Complaints to the Information Commissioner’s Office
If you remain dissatisfied with how your personal information has been handled, you have the right to complain to the Information Commissioner’s Office (ICO).
The ICO is the UK’s independent data protection regulator. You can contact the ICO using the following details.
Website: Information Commissioner’s Office complaints guidance
Telephone: 0303 123 1113
You can contact the ICO for advice about your information rights or to make a complaint.
Compliance and Your Rights
We take our legal obligations seriously. This privacy policy is designed to comply with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Our goal is to be as clear and transparent as possible. If you have questions about how your local jurisdiction’s laws apply to our services, or if you feel our policy could be improved, please contact our Data Protection Officer.
Understanding How Your Data is Used
We believe patients should be in control of their information. To help you understand how health data supports your care and fuels medical research, we recommend visiting Understanding Patient Data.
This resource explains:
- How and why health data is used for care and research.
- The strict rules governing what is and isn’t allowed.
- The safeguards in place to keep your personal information secure.
Visit the Understanding Patient Data website
Changes to this privacy policy
We may update this privacy policy to reflect changes in legislation, NHS guidance, technology or the services we provide.
The latest version will be published on this website.
Our website is provided by GenPra GP Websites Ltd. Data submitted via standard website forms is encrypted, sent directly to our secure practice inbox, and never stored by GenPra. If you subscribe to our e-newsletter, your email address is securely stored on the website to send you updates. For full details, read the GenPra Patient Privacy Notice.