Privacy Policy
1. Introduction
This privacy policy sets out the way Castletown Medical Centre processes your personal information. It covers how we collect information, what we do with it, how we protect it, and what controls or rights you have.
We are committed to protecting the privacy of our patients and anyone who interacts with us, and will treat all information you give us with care.
We promise to:
- Tell you why we collect personal information, how we do this, and what we use it for.
- Only collect the information we need to deliver the service to you.
- Keep the personal information up to date and ensure it is safe and secure.
Please read this Privacy Policy carefully to understand how we process your personal data. By providing your personal data to us, or by using our services or this website, you are accepting the practices in this Privacy Policy.
As a data controller, we comply with the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003, and UK GDPR. We also comply with all applicable clinical confidentiality guidelines.
We are recorded on the ICO Data Protection Register under registration number ZB626401. Our registered Data Protection Officer is Bernard Seymour.
2. Who we are
References in this policy to Castletown Medical Centre relate to Castletown Medical Centre, 6, The Broadway, Castletown, Sunderland, SR5 3EX.
3. What information we collect
We collect personal information about you to enable us to provide the services or fulfil a role with us. This may include:
- Name and address, marital status, family history, and details of any lasting power of attorney
- Email address and telephone numbers
- The country you live in, your gender, date of birth, NHS number, and where relevant the language you speak
- Details of your employment, where relevant to your care
- The name and contact details of your next of kin. It is your responsibility to ensure that if you provide us with information about another person, they are aware of the terms of this privacy policy
- Details about associated people, for example children, partners, carers and relatives
- From your parent or guardian if you are under 16
- Recordings of telephone calls or video calls we receive or make
- Video and sound recordings on our premises
- Details of services and treatments you may have received from us
- Reports or notes on your health or any treatment and care you have received or need
- Patient feedback and treatment outcome information you provide
- Information about complaints and incidents
- When you visit our website, we collect information about your IP address and the pages you visit. This does not tell us who you are or your address, unless you choose to provide that information
- Information from surveys you take part in
We will also collect special category data. This may include:
- Information about your race, ethnic origin and religion
- Information about your physical or mental health, genetic data or biometric data
- Information about your sex life or sexual orientation
- Information about risk and safeguarding
4. How we collect personal information
We collect personal information in the following ways:
- When you register with us or provide information at any other time
- When you correspond with us by email, phone or other means
- During the course of the provision of services to you
- When you contact us by email, telephone, social media or any other way
- When you visit our website
- When you fill in a form or survey for us
- Information from emergency services, local authorities and other public organisations
- Information from third parties, including other healthcare providers, when you have given permission to share it with us
- From publicly available services to keep your information up to date, for example the NHS national database
5. Personal information provided by other sources
We may collect personal data about you from other sources, including:
- Your next of kin or other family member
- Doctors, other clinicians and healthcare professionals, hospitals, clinics and other healthcare providers
- Your employer, when they provide information relevant to your care
- Translators and interpreters
- Any health professional or organisation who provides information for the continuity of your care
- A Local Authority or the Police
6. How we use the information and why we need it
We use your personal information to provide direct health or social care services to you and to meet our commitments to you. This may include:
- Processing - using the information to fulfil any request made by you, or someone on your behalf, to receive one of our services.
- Consent - we will generally only ask for your consent to process your personal information where there is no other legal ground to do so. Where we need your consent, we will ensure you are fully informed and use that consent solely for the reason you gave it. You can change your mind at any time by contacting us using the details in Section 14.
- Public interest task - we process your personal information when carrying out a task in the public interest, including the provision of direct health or social care. This also includes processing personal information for medical research, trials, and to train and educate healthcare professionals.
- Preventative or occupational medicine - to assess your ability to work, the provision of health or social care, a medical diagnosis, or the management of health and social care systems.
- Legal claims - where necessary to defend legal claims or a court action.
- Vital interests - where necessary to protect your vital interests or those of another person.
- Public interest - usually in line with applicable laws, such as protecting against dishonesty, malpractice or other seriously improper behaviour.
- Profiling - we may use profiling and screening methods to provide a better service to patients, helping us target resources more effectively by understanding patients' needs.
7. Legitimate interests
The practice also processes your data where it is in our legitimate interest to do so, and where these interests do not override your rights. These legitimate interests include:
- Keeping our records up to date
- Statistical research and analysis, to monitor and improve services
- Monitoring how we are meeting our clinical and non-clinical performance
- Sharing your personal information with people or organisations to comply with legal or regulatory obligations, or to enable us to run our organisation
- Managing our relationships with you and third parties who assist us in providing services to you
8. Who will see the information
Your information is only accessible to our staff, and only where appropriate to the role they are carrying out. We will never sell your information or let other organisations use it for their own purposes.
We will only share your personal information:
- Where consent is necessary, we will have taken your consent and will use the information for the specific reason it was given. You can withhold or withdraw consent at any time by contacting us using the details in Section 14.
- With doctors, clinicians, hospitals, clinics, diagnostic and treatment centres and other healthcare providers, to provide our services and continuity of care. This also includes processing personal information to enable research, medical trials, and the training and education of healthcare professionals.
- With first responders, the ambulance service, safeguarding services, undertakers, coroners and care homes.
- Where necessary to protect your vital interests (i.e. your life or health).
- With organisations or people we are required to share information with by law or regulation, such as national databases, screening registers, government authorities and NHS organisations.
- With the police or other law enforcement agencies, where required by law or a court order.
- With Social Care Services, Education Services, Local Authorities, and voluntary and private sector providers working with the NHS.
- Where we use other organisations to provide services on our behalf, for example IT hosting and support, external reception and appointment services, or data processing.
- With our associated GP practices and our Primary Care Network.
- Where we are legally required to, or in response to a lawful request by a governmental or law enforcement authority.
Where a third-party data processor is used, we ensure they operate under a contract covering confidentiality, security of personal data, and their obligations under data protection legislation.
9. National data opt-out
Whenever you use a health or care service, important information about you is collected in a patient record. This helps ensure you get the best possible care and treatment.
This information can also be used for purposes beyond your individual care - for example, to help improve quality and standards of care, support research into new treatments, prevent illness and disease, monitor safety, and plan services.
Most of the time, anonymised data is used for research and planning, meaning your confidential patient information is not needed. Sometimes your confidential patient information will be needed, and you have a choice about whether this is used in this way. If you're happy for your information to be used, you don't need to do anything. If you don't wish your information to be used in this way, you can opt out — your confidential information will still be used to support your individual care.
To find out more or register your choice, visit www.nhs.uk/your-nhs-data-matters. You can change your mind about your choice at any time.
Castletown Medical Centre is compliant with the national data opt-out policy.
10. Security
The security of your personal information is very important to us. We have appropriate organisational and technical measures in place to prevent unauthorised access or unlawful processing of personal data, and to prevent data being lost, destroyed or damaged.
All information you provide to us is stored on secure servers. Unfortunately, the transmission of information via the internet is never completely secure. Although we do our best to protect your personal data, we cannot guarantee the security of data transmitted to our site; any transmission is at your own risk. Once we receive your information, we use strict procedures and security features to prevent unauthorised access.
All personal data is processed in the UK, although for IT hosting and maintenance your information may be situated outside the UK or European Economic Area (EEA).
You may find links to third-party websites on our website. These have their own privacy policies, which you should check - we do not accept responsibility for their policies, as we have no control over them.
11. Your rights
You have the following rights:
- Transparency over how we use your personal information (right to be informed)
- To request a copy of the personal information we hold about you (right of access)
- To ask us to update or amend the personal information we hold about you (right of rectification)
- To ask us to stop using your personal information (right to restrict processing)
- To ask us to remove your personal information from our records (right to be forgotten)
- To object to your personal information being used for certain purposes (right to object)
- To obtain and reuse your personal data for your own purposes (right to portability)
- Not to be subject to a decision based solely on automated processing
You can contact us about any of these rights using the details in Section 14. To protect your privacy, we may ask you to prove your identity before responding to a request. There is no charge, and we will respond within one month.
If you are not satisfied with how we handle your request, you can contact the Information Commissioner's Office on 0303 123 1113 or at www.ico.org.uk.
12. Cookies
Our website uses cookies to distinguish you from other users. This helps us provide a good experience when you browse our website and allows us to improve our site. By continuing to browse the site, you are agreeing to our use of cookies.
A cookie is a small file of letters and numbers stored on your browser or device if you agree. We use the following types:
- Strictly necessary cookies - required for the website to function, for example enabling secure areas of the site.
- Analytical/performance cookies - allow us to recognise and count visitors and see how they move around our website, helping us improve how it works.
- Functionality cookies - recognise you when you return to our website, allowing us to remember your preferences (for example, choice of language).
13. Retention of information
We hold your information only for as long as necessary for each purpose we use it, in line with:
- Any time limits set by law or recommended by regulators, professional bodies or associations
- Time limits for making a claim
- For as long as we have a reasonable need for managing our relationship with you or running our organisation
14. How to contact us
If you have any questions about this privacy policy or your rights regarding the processing of your personal information, or wish to make a complaint, please contact:
Castletown Medical Centre, 6 The Broadway, Castletown, Sunderland, SR5 3EX
Email: nencicb-sun.castletown@nhs.net
Telephone: 0191 549 5113.
