Privacy Notice

Data Controller

Willow Green Surgery is the data controller for the personal information it holds about its registered patients and other individuals whose data it processes. This means the practice determines how and why your personal data is used.

• Practice address: Station Road, East Preston, Littlehampton, West Sussex, BN16 3AH
• Telephone: 01903 785152
• ODS code: H82059
• ICO registration number: Z6620850

Verify our registration on the ICO's public register

Your Information: What You Need to Know

This privacy notice explains why we collect information about you, how that information will be used, how we keep it safe and confidential, and what your rights are in relation to it.

Why We Collect Information About You

Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you have received. These records help to provide you with the best possible healthcare and help us to protect your safety.

We collect and hold data for the purpose of providing healthcare services to our patients and running our organisation, which includes monitoring the quality of care that we provide. In carrying out this role we will collect information about you which helps us respond to your queries or secure specialist services. We will keep your information in written form and/or in digital form.

Our Commitment to Data Privacy and Confidentiality

All of our GPs, staff and associated practitioners are committed to protecting your privacy and will only process data in accordance with data protection legislation. This includes the UK General Data Protection Regulation (UK-GDPR), the Data Protection Act (DPA) 2018, and any applicable national laws as amended from time to time. The legislation requires us to process personal data only if there is a legitimate basis for doing so and to ensure that any processing is fair and lawful.

Consideration will also be given to all applicable law concerning privacy, confidentiality, the processing and sharing of personal data, including the Human Rights Act 1998, the Health and Social Care Act 2012 as amended by the Health and Social Care (Safety and Quality) Act 2015, the common law duty of confidentiality, and the Privacy and Electronic Communications (EC Directive) Regulations.

Data We Collect About You

The practice holds the following categories of information about you:

• Your name, date of birth, address, telephone number(s), email address and NHS number
• Your registered GP and any previous GP registrations
• Medical history, diagnoses, medications and allergies
• Consultation notes, referral letters, and clinical correspondence
• Test results, imaging reports and screening outcomes
• Prescription records
• Vaccination history
• Information about your lifestyle where relevant to your care (for example, smoking status, alcohol intake)
• Communications with and about you (including telephone call recordings)
• Next of kin and emergency contact details
• Information received from other health and care providers involved in your care

Under the UK-GDPR, much of this information falls within the definition of "special category data" because it relates to your health. This means it is subject to additional protections. Where the practice processes data revealing racial or ethnic origin, religious beliefs, or other special category data, additional safeguards apply.

How We Use Your Information

Your information is primarily used to provide you with safe, effective healthcare. Improvements in information technology also make it possible for us to share data with other healthcare organisations for the purpose of providing you, your family and your community with better care.

In certain circumstances, other healthcare professionals (for example, out-of-hours services or accident and emergency departments) may access your record when the practice is closed, where this is necessary for your direct care. Where your record is accessed in this way, there will be a lawful basis under the UK-GDPR for doing so, and access is limited to authorised professionals who need it for your treatment.

Whenever you use a health or care service, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.

The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:

• Improving the quality and standards of care provided
• Research into the development of new treatments and care pathways
• Preventing illness and diseases
• Monitoring safety
• Planning services
• Risk stratification
• Population health management

A full list of the organisations we share data with, the purposes for sharing, and the lawful basis relied upon is set out in Appendix A/

Safeguarding of Children or Vulnerable Adults

If we have significant concerns about an individual child or vulnerable adult being at risk of harm, we may share relevant information with other organisations (such as local authorities and the police) involved in ensuring their safety. Consent is not always required for this type of sharing, as there is a clear legal basis and overriding public interest in protecting those at risk.

Statutory Disclosures

In some circumstances we are required by law to disclose information to organisations such as the Care Quality Commission, the Driver and Vehicle Licensing Agency, the General Medical Council, His Majesty's Revenue and Customs, and counter-fraud services. In these circumstances we will always try to inform you before we are required to disclose, and we only disclose the minimum information that the law requires.

Pseudonymised or anonymised data is generally used for research and planning purposes so that you cannot be identified.

How Long Do We Hold Information For?

All records held by the practice will be kept for the duration specified by national guidance from the Records Management Code of Practice for Health and Social Care (2021). Once information has been identified for destruction it will be disposed of in the most appropriate way for the type of information it is. Personal confidential and commercially confidential information will be disposed of by approved and secure confidential waste procedures. We keep a record of retention schedules within our information asset registers, in line with the Records Management Code of Practice.

Your Rights Under the UK-GDPR

The UK-GDPR provides you with a number of rights in relation to your personal data

Right to be informed (Art. 13/14)

• What It Means: To know how and why we use your data.
• Limitations: None: this notice fulfils this right.
• How to Exercise: By reading this notice.

Right of access (Art. 15)

• What It Means: To obtain a copy of the personal data we hold about you.
• Limitations: Information may be redacted if disclosure would cause serious harm to you or others, or would breach a third party's confidentiality.
• How to Exercise: Submit a Subject Access Request to the practice (see below).

Right to rectification (Art. 16)

• What It Means: To have inaccurate personal data corrected.
• Limitations: Clinical entries may carry a note of correction rather than deletion, to maintain clinical record integrity.
• How to Exercise: Clinical entries may carry a note of correction rather than deletion, to maintain clinical record integrity.

Right to erasure (Art. 17)

• What It Means: To request that your personal data be deleted.
• Limitations: This is not an absolute right. It does not apply where processing is necessary for healthcare purposes or where we have a legal obligation to retain records.
• How to Exercise: Contact the practice in writing. We will assess whether an exemption applies.

Right to restrict processing (Art. 18)

• What It Means: To limit how we use your data in certain circumstances.
• Limitations: Applies only while accuracy is being contested, processing is unlawful, or we no longer need the data but you need it for legal claims.
• How to Exercise: Contact the practice in writing.

Right to data portability (Art. 20)

• What It Means: To receive your data in a structured, commonly used, machine-readable format.
• Limitations: Only applies to data you provided to us and which we process by automated means on the basis of consent or contract.
• How to Exercise: Contact the practice in writing.

Right to object (Art. 21)

• What It Means: To object to processing carried out on the basis of public interest or official authority.
• Limitations: We may continue processing if we can demonstrate compelling legitimate grounds that override your interests.
• How to Exercise: Contact the practice or apply a Type 1 Opt Out or National Data Opt-Out (see below).

Automated decision-making (Art. 22)

• What It Means: Not to be subject to decisions based solely on automated processing that produce legal or similarly significant effects.
• Limitations: Applies only where such processing takes place.
• How to Exercise: Contact the practice.

Your Right to Opt Out of Data Sharing

Type 1 Opt Out: This prevents your personal confidential information from being shared outside of your general practice, except where it is being used for your individual direct care or in particular circumstances required by law (such as public health screening or a pandemic outbreak). If you wish to apply a Type 1 Opt Out to your record, please contact the practice.

National Data Opt-Out (NDOO): The national data opt-out enables you to opt out of the use of your data for research or planning purposes. Any patient who had a previous "Type 2" opt-out recorded on or before 11 October 2018 had it automatically converted to a national data opt-out.

To find out more or to register your choice to opt out, please visit NHS Your data matters. On this page you will be able to:

• See what is meant by confidential patient information
• Find examples of when your information is used for individual care and when it is used for purposes beyond individual care
• Find out more about the benefits of sharing data
• Understand more about who uses the data and how it is protected
• View, set or change your opt-out setting
• Find a contact telephone number if you wish to set or change your opt-out by phone
• See the situations where the opt-out will not apply

Access to Your Information (Subject Access Request)

Under data protection legislation, you have the right to access, or request a copy of, the personal information we hold about you, including your medical records. You do not need to give a reason to see your data, and requests can be made verbally or in writing (although we may ask you to complete a form to ensure we provide the correct information).

There are some safeguards regarding the information you will receive. Information may be redacted or withheld if:

• Disclosure may risk causing serious harm to you or others
• The information relates to a third party who is entitled to confidentiality and has not given permission for the information to be shared

Where multiple copies of the same information are requested, the practice may charge a reasonable fee for the additional copies.

You will need to provide proof of identity to receive this information. We will not share information relating to you with other individuals without your explicit instruction or a legal basis for doing so.

You may also request online access to your medical record via the NHS App or via the practice's clinical system. Please contact the practice for details.

Change of Details

It is important that you tell the practice if any of your contact details (such as your name, address or telephone number) have changed, or if any of your other details are incorrect, including third-party emergency contact details. Please inform us of any changes as soon as possible so that no information is shared in error.

Mobile Telephone Number

If you provide us with your mobile phone number, we will use this to send you text reminders about your appointments or other health-related information. It is within our legal duty as a healthcare provider to keep our patients updated with important information.

Email Address

Where you have provided us with your email address, we will use this to send you information relating to your health and the services we provide. If you do not wish to receive communications by email, please let us know.

International Transfers

The practice does not routinely transfer your personal data outside the United Kingdom. If any of our processors or sub-processors process data outside the UK, we will ensure that appropriate safeguards are in place (such as UK International Data Transfer Agreements or adequacy regulations) to protect your information in accordance with the UK-GDPR. Details of any such transfers will be made available on request.

Automated Decision-Making

The practice does not currently carry out any automated decision-making or profiling that produces legal or similarly significant effects on patients. If this changes, this notice will be updated accordingly.

Data Protection Officer

Should you have any data protection questions or concerns, please contact our Data Protection Officer, Richard Newell, (Your-DPO Ltd) via the Practice Manager or Operations Manager.

Right to Complain

If you have concerns or are unhappy about how your personal data has been handled, please contact the practice in the first instance. You also have the right to lodge a complaint with the Information Commissioner's Office:

• The Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
• Phone: 0303 123 1113
• Contact the ICO online

The NHS Constitution

The NHS Constitution establishes the principles and values of the NHS in England. It sets out the rights patients, the public and staff are entitled to, covering how patients access health services, the quality of care received, the treatments and programmes available, confidentiality, information, and the right to complain if things go wrong.

Read the full NHS Constitution for England

Appendix A: Data Sharing and Lawful Basis

The practice shares patient information with the organisations listed below, where there is a lawful basis to do so.

Commissioning, planning and performance

• Purpose: Anonymous and pseudonymised data used by the ICB for planning, performance and commissioning purposes.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h)
• Condition: Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: NHS Surrey and Sussex Integrated Care Board (processor)

Summary Care Record

• Purpose: Key information from your GP record shared to support emergency or unplanned care.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: NHS England (processor)

Research

• Purpose: Anonymous data shared to explore new treatments and care pathways. Identifiable data shared only with consent or section 251 support.
• Lawful Basis: Art. 6(1)(a) and Art. 9(2)(a) - Consent (personal data) and explicit consent (special category data), Art. 6(1)(c) - Necessary to comply with a legal obligation. & Art. 9(2)(j) Necessary for scientific research or statistical purposes. or Section 251, NHS Act 2006 - Processing with the support of the Confidentiality Advisory Group under the Health Service (Control of Patient Information) Regulations 2002.
• Recipient / Processor: NHS England (processor)

Individual Funding Requests

• Purpose: Processing required where we must fund specific treatment not covered by the standard NHS contract. Explicit consent will be sought.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: NHS Surrey and Sussex Integrated Care Board (processor)

Safeguarding: Adults

• Purpose: Information shared to assess safeguarding concerns and protect safety. Consent is not required.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: West Sussex Safeguarding Adults Team (processor)

Safeguarding: Children

• Purpose: Information shared to assess safeguarding concerns and protect children's safety. Consent may not be required.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: West Sussex Safeguarding Children's Team (processor)

Risk stratification (preventive care)

• Purpose: Analysis of de-identified data to identify patients at risk of certain conditions and offer additional services.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: SCW CSU (processor)

Public health screening, notifiable diseases, vaccinations

• Purpose: Contact information and screening-related data shared to enable invitations to screening programmes. Identifiable data shared for notifiable diseases.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: UK Health Security Agency, Surrey and Sussex (processor)

Direct care (NHS Trusts, community providers, pharmacies, enhanced care, nursing homes)

• Purpose: Personal information shared to provide individual direct care services.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Sussex Community NHS FT; University Hospitals Sussex NHS FT; Sussex Partnership NHS FT; South East Coast Ambulance Service NHS FT (processors)

Care Quality Commission

• Purpose: The CQC may access identifiable data as part of its regulatory inspection role.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Care Quality Commission (controller)

Population health management

• Purpose: De-identified and identifiable data shared within the ICS to understand population needs, address health inequalities, and plan joined-up care. Only organisations providing your care see identifiable data.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Optum; Cerner (processors)

Payments

• Purpose: Basic demographic data shared with payment services to enable capitation, QOF and enhanced service payments.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: NHS England; ICB; Public Health (processors)

Patient record database

• Purpose: Your medical record is maintained on a secure clinical system and follows you as you change surgeries.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: TPP / SystmOne (processor); PCSE (processor)

Medical reports and Subject Access Requests

• Purpose: Records shared with solicitors or insurers acting on your instruction and with your consent.
• Lawful Basis: Art. 6(1)(a) and Art. 9(2)(a) - Consent (personal data) and explicit consent (special category data).
• Recipient / Processor: iGPR (processor)

Medicines management and optimisation

• Purpose: Medical record shared with medicines management pharmacists to keep your medication up to date.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: NHS Surrey and Sussex ICB Medicines Management Team (processor)

GP Federation

• Purpose: Record shared with Alliance for Better Care Ltd to provide direct care services (video consultations, minor injuries clinics, extended access)
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Alliance for Better Care Ltd (processor)

Primary Care Network

• Purpose: Record shared within the AiC PCN to provide direct care services.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Record shared within the AiC PCN to provide direct care services.

Smoking cessation

• Purpose: Personal information shared to deliver smoking cessation services. Only patients who participate will have data shared.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: West Sussex County Council (processor)

Social prescribers

• Purpose: Record access provided to social prescribers to deliver services based on your health and social care needs. Only patients who participate will have data shared.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Citizens Advice (processor)

Police

• Purpose: Personal confidential information may be shared with the police where there is a legal basis (for example, court order, prevention/detection of crime, or protection of a person or community). Consent is not always required.
• Lawful Basis: Art. 6(1)(c) - Necessary to comply with a legal obligation.
• Recipient / Processor: Police Constabulary (controller)

Coroner

• Purpose: Health records or information relating to a deceased patient may be shared with the coroner.
• Lawful Basis: Art. 6(1)(c) - Necessary to comply with a legal obligation. and Art. 9(2)(h) Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: The Coroner (controller)

Medical Examiner Service

• Purpose: Deceased patient records and next-of-kin details shared with the Medical Examiner's Office. (Records of deceased patients are outside the scope of the UK-GDPR, but next-of-kin details are within scope.)
• Lawful Basis: Art. 6(1)(c) - Necessary to comply with a legal obligation. and Art. 9(2)(h) Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Medical Examiner's Office, University Hospitals Sussex NHS FT (processor)

Non-commissioned private healthcare providers

• Purpose: Information shared with private providers at your request and with your consent.
• Lawful Basis: Art. 6(1)(c) - Necessary to comply with a legal obligation
• Recipient / Processor: BMI Goring Hall; Nuffield Chichester; or other provider of the patient's choice (controllers)

Messaging service

• Purpose: Information shared with private providers at your request and with your consent.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: BMI Goring Hall; Nuffield Chichester; or other provider of the patient's choice (controllers)

Remote consultation (including video and clinical photography)

• Purpose: Personal information, including images, processed and stored to provide medical advice. Photographs or video may be taken with your consent.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: eConsult; AccuRx (processors)

MDT meetings

• Purpose: Personal data shared with staff from other agencies to plan care for patients with long-term conditions.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Sussex Partnership NHS FT; OneCall (processors)

General Practice Extraction Service (GPES)

• Purpose: Data extracted for NHS England for various purposes including identifying at-risk patients, CVDPREVENT audit, and physical health checks for people with severe mental illness.
• Lawful Basis: Statutory (HSCA 2012 s.259) and Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: NHS England (processor)

Medication and prescribing

• Purpose: Prescriptions containing identifiable and health data shared with pharmacies to provide medicines management, medication and treatment.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Pharmacy of choice (processor)

Telephony

• Purpose: The practice uses an internet-based telephony system that records calls to assist with patient consultations and manage call volumes.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: X-on Health (processor)

Learning Disability Mortality Review (LeDeR)

• Purpose: Records of deceased patients with learning disabilities or autism shared with NHS England to improve the quality of care.
• Lawful Basis: Section 251, NHS Act 2006 - Processing with the support of the Confidentiality Advisory Group under the Health Service (Control of Patient Information) Regulations 2002.
• Recipient / Processor: ICB; NHS England (processors)

Shared care record (GP Connect)

• Purpose: Record shared via GP Connect to enable a shared care record used for direct care, population health management and analytics. No identifiable data used for secondary purposes without consent.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: NHS England (processor)

Local shared care record

• Purpose: Record shared to enable authorised health and social care staff to access your information for routine appointments and urgent situations.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Alliance for Better Care Ltd (processor)

Off-site storage of Lloyd George records

• Purpose: Paper medical records stored securely at an off-site facility meeting NHS standards.
• Lawful Basis: Art. 6(1)(b) - Necessary for the performance of a contract, Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Alliance for Better Care Ltd (processor)

Vaccinations for housebound patients

• Purpose: Data provided to a vaccination provider to attend and vaccinate housebound patients.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Summersdale Pharmacy (provider)

Youth Emotional Support Service (YES)

• Purpose: Dedicated YES caseworkers access patient information from the clinical system. The Council acts as a processor but also retains information in its own system (Mosaic).
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: West Sussex County Council (processor and controller)

First Contact Physiotherapy

• Purpose: Physiotherapists access patient information from the clinical system to deliver first contact physio services.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Pure Physio (processor)

Pharmacist service (TMMT)

• Purpose: Pharmacists access patient information from the clinical system.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: TMMT (processor)

Clinical transcription (Heidi)

• Purpose: Clinical conversations are processed and transcribed by AI to capture relevant medical details during or following consultations.
• Lawful Basis: Art. 6(1)(e) and Art. 9(2)(h) - Necessary for a task carried out in the public interest or in the exercise of official authority; and necessary for healthcare purposes (preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment, or the management of health or social care systems and services).
• Recipient / Processor: Heidi Health (processor)

Review

This notice was last reviewed in September 2026.

Any changes to this notice will be published on our website and displayed prominently at the practice.

• Document reference: 20260901
• Version: V2