English (UK) 
Cymraeg Patients' Rights And Responsibilities
Saundersfoot Medical Centre,
Westfield Road,
Saundersfoot.
SA69 0YA
All Health and Social Care organisations that provide you with care are required by law to maintain records about your health and any treatment or care you have received.
The Practice collects and holds information for the purpose of providing healthcare services to our patients and running our organisation, which includes monitoring the quality of care and planning the care that we provide our patients.
To do this we may collect information about you which helps us:
- respond to your queries;
- provide you with the most appropriate care; or
- arrange specialist services on your behalf.
We may keep your information in written form and/or in digital/electronic form. The records will include basic details about you, such as your name and address. They may also contain sensitive information about your health such as outcomes of assessments. All information about you is treated confidentially and only shared as described in this Privacy Notice.
We hold different types of information about you which forms part of your medical record and is mainly held to ensure you receive the best possible treatment and care. For example,
Personal information may include:
- name, address and other contact details;
- date of birth, next of kin and NHS number.
We may also hold your email address, marital status, occupation, oversees status, place of birth and preferred name or maiden name.
Sensitive personal information also called Special Category data may include:
- notes and reports about your health, treatment and care, including:
- your medical conditions;
- results of investigations, such as x-rays and laboratory tests;
- future care you may need;
- personal information from people who care for and know you, such as relatives and health or social care professionals;
- other personal information such as smoking status and any learning disabilities;
- your religion and ethnic origin;
- sexual orientation;
- safeguarding status, for example, if you are subject to any protection orders regarding your health wellbeing and human rights.
- notes and reports about your health, treatment and care, including:
The information we hold about you is collected through a variety of sources, including, but not limited to:
- when you register as a patient with the Practice;
- directly through communications with yourself – for example, during consultation with one of our health professionals, when receiving treat or when making an appointment to see them;
- when registering for on-line services such as My Health On-Line and My Health Texts;
- telephone recordings;
- from other health care professional who provide care or treatment to you – for example, when you attend A&E or another secondary care service, Out of Hours GP services and other primary care service providers;
- Social Care;
- Voluntary Sector services – for example, who form part of a multi-disciplinary team;
- through automated technologies such as when you visit our website, see our Privacy Policy for further information.
To ensure you receive the best possible care, your records are used to facilitate the care you receive. For example, the Practice may need to share your information with other health and care services who will provide you with direct care and treatment, i.e. when referring you to a Consultant in hospital for specialist treatment.
Information held about you may be used to help protect the health of the public and to help manage the NHS. It may also be used in National Screening Programmes, medical research and clinical audits. For National Data Collection requirements, safeguarding and legal requirements. Where necessary it may be used for the security and safety of our staff and our premises.
In some cases, you can object to your personal information being shared with other healthcare providers but you should be aware that this may, in some instances, affect your care as important information about your health might not be available to healthcare staff in other organisations. If this limits the treatment that you can receive then the Practice staff will explain this to you at the time you object.
We will not share your information with any third parties for the purpose of direct marketing.
When we process your personal information, we will only do so where there is a legal basis. Much of our processing relates to your direct care and treatment:
- Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Where we have a specific legal obligation that requires the processing of personal data, the legal basis will be:
- Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject.
Where we process special category data, for example data including health, racial or ethnic origin, or sexual orientation, we need to meet an additional condition in the GDPR.
Where we are processing special category personal data for purposes related to the commissioning and provision of health services the condition will be:
- Article 9(2)(h) – processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services; or
- Article 9(2)(i) – processing is necessary reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices.
Where we process your personal data for the purposes of research, the legal basis for doing so will be:
- Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Where we are processing special category personal data for purposes related to research, the legal basis will be:
- Article 9(2)(a) – you have provided your explicit consent; or
- Article 9(2)(j) – processing is necessary for scientific or historical research purposes or statistical purposes.
The Practice may also process personal data for the purpose of, or in connection with, legal proceedings, including prospective legal proceedings, for the purpose of obtaining legal advice, or for the purpose of establishing, exercising or defending legal rights.
Where we process personal data for these purposes, the legal basis for doing so will be:
- Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject; or
- Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
- Article 6(1)(f) – processing is necessary for the purposes of legitimate interests pursued by the controller.
Where we process special category personal data for these purposes, the legal basis for doing so will be:
- Article 9(2)(f) – processing is necessary for the establishment, exercise or defence of legal claims; or
- Article 9(2)(g) – processing is necessary for reasons of substantial public interest.
On occasions, we may need to share your information with law enforcement agencies or to protect the wellbeing of others. For example, to safeguard children or vulnerable adults.
Where we process personal data for these purposes, the legal basis for doing so will be:
- Article 6(1)(c) – processing is necessary for compliance with a legal obligation to which the controller is subject; or
- Article 6(1)(e) – processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
- Article 6(1)(f) – processing is necessary for the purposes of legitimate interests pursued by the controller.
Where we share special category personal data for these purposes of safeguarding, the legal basis for doing so is:
- Article 9(2)(g) – processing is necessary for reasons of substantial public interest.
In order to deliver the best possible service, the Practice may share your information, where required, with other NHS bodies such as other GP Practices and hospitals. The information that makes up your record is also essential to help these organisations provide you with the best possible care.
All organisations that we work with are subject to strict data sharing and/or processing agreements which set out how data will be used and forms part of their contractual obligations.
The organisations we may share your information with are:
- Health Boards and Trusts in NHS Wales and where necessary NHS Trusts/Foundation Trusts in NHS England;
- Other GPs, for example, those which form part of the Cluster Network your Practice is a member of;
- Out of Hours GP Service Providers (for when your GP Practice is closed);
- Other Primary Care Service providers such as Pharmacists, Dentists and Optometrists;
- Health Board, private sector or voluntary sector providers who deliver services on behalf of the Practice. For example, Allied Health Professionals who work directly in the GP Practice to treat patients i.e. physiotherapists who hold clinics for patients with musculoskeletal problems;
- Welsh Ambulance Service Trust (WAST);
- Health Care Research Wales (HCRW);
- Public Health Wales (PHW);
- Healthcare Quality and Improvement Partnership (HQIP);
- Local Authorities and Social Care providers;
- Education Services;
- Fire and Rescue Services;
- Police and Judicial Services;
- Voluntary (Third) Sector Services.
We will never share your information without establishing the legal basis to do so, unless there are exceptional circumstances such as when the health or safety of others is at risk, where the law requires it.
Our guiding principle is that we are holding your records in strictest confidence; we are required by law to report certain information to the appropriate authorities. This is only provided after formal permission has been given by a qualified health professional. There are occasions when we must pass on information, such as notification of new births, where we encounter infectious diseases which may endanger the safety of others, such as meningitis or measles (but not HIV/AIDS), and where a formal court order has been issued.
Third party processors
The Practice may use carefully selected third party service providers. When we use such a service provider to process data on our behalf then we will always have an appropriate agreement in place to ensure that they keep your data secure, that they do not use or share information other than in accordance with our instructions and that they are operating appropriately. Examples of functions that may be carried out by third parties includes:
- companies that provide IT services & support, including our core clinical systems; systems which manage patient facing services (such as our website and service accessible through the same); data hosting service providers; systems which facilitate appointment bookings or document management services etc.
- delivery services, for example, if we were to arrange for delivery of any medicines to you;
- payment providers, if for example you were paying for a prescription or a service such as travel vaccinations.
Further details regarding specific third-party processors can be supplied on request by the Practice.
The General Data Protection Regulation (GDPR) provides several rights to individuals. The practice must generally respond to requests in relation to you exercising any of these rights within one month, although there are some exceptions to this. The availability of some of these rights depends on the legal basis that applies in relation to the processing of your personal data, and there are some other circumstances in which we may not uphold a request to exercise a right. Your rights and how they apply are described below.
Right to be informed
Your right to be informed is met by the provision of this privacy information, and similar information when we communicate with you directly; at the point of contact.
Right of access
You have the right to obtain a copy of the personal information that we hold about you and other information specified in the GDPR, although there are exceptions to what we are obliged to disclose. A situation in which we may not provide all the information your request is where, in the opinion of an appropriate health professional, disclosure would be likely to cause serious harm to you, or somebody else’s physical or mental health. See the ‘How can you access your information?’ section for further details.
Right to rectification
You have the right to ask us to rectify any personal information that we hold about you that you consider is inaccurate.
Right to erasure (‘right to be forgotten’)
You have the right to request that we erase personal information about you that we hold. This is not an absolute right, and depending on the legal basis that applies, we may have overriding legitimate grounds to continue to process the information.
Right to restriction of processing
You have the right to request that we restrict processing of personal information that we hold about you. You can ask us to do this, for example, where you contest the accuracy of the data.
Right to data portability
This right is only available where the legal basis for processing under the GDPR is consent, or for the purposes of a contract between you and the Practice. For this to apply the information must be held in electronic form. The right is to be provided with the data in a commonly used electronic format.
Right to object
You have the right to object to the processing of your personal information about you on the grounds relating to your particular situation. The right is not absolute, and we may continue to use the data if we can demonstrate compelling legitimate grounds.
Rights in relation to automated individual decision-making including profiling
You have the right to object to being subject to a decision based solely on automated processing, including profiling. Should we perform any automated decision-making, we will record this in our privacy information, and ensure that you have an opportunity to request that the decision involves personal consideration.
Right to complain to the Information Commissioner
You have the right to complain to the Information Commissioner if you are not happy with any aspect of the Practice processing your personal information or you believe that we are not meeting our responsibilities as a data controller.
The contact details are:
Address: Information Commissioner’s Office, Wycliffe House Water Lane, Wilmslow SK9 5AF
Phone: 0303 123 1113
Website: www.ico.gov.uk