Privacy Notice: Fair Processing

Your information and how we use it

At Queensway Surgery, we are committed to protecting your privacy and keeping your personal information safe.

This Privacy Notice explains:

• What information we collect about you
• How we use your information
• Who we may share it with
• Your rights regarding your information
• How to contact us if you have any questions or concerns

We process your personal information in line with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and NHS confidentiality requirements.

Who we are

Queensway Surgery is the Data Controller for the personal information we hold about our patients. This means we are responsible for ensuring that your information is used lawfully, fairly and securely.

Information we hold about you

To provide healthcare services, we may collect and hold information including:

Personal information

• Name
• Date of birth
• Address
• Telephone number
• Email address
• NHS number
• Emergency contact details

Health information

• Medical history
• Diagnoses and conditions
• Medications
• Allergies
• Test results
• Referral information
• Vaccination records
• Consultation notes
• Hospital correspondence
• Care plans

We may receive information directly from you or from organisations involved in your care.

Communicating with you

How we contact you

Queensway Surgery may contact you by telephone, text message (SMS), letter, email, online consultation systems, or other NHS-approved communication methods.

We may use these methods to:

• Send appointment reminders
• Share test results
• Provide information about your treatment or medication
• Invite you for reviews, screening, vaccinations, or health checks
• Respond to queries you have submitted to the practice

You do not need to give specific consent for us to contact you regarding your direct healthcare. This forms part of the care we provide as an NHS organisation.

Text messages (SMS)

Many of our patients prefer to receive information by text message. We may send text messages containing information relevant to your care, including appointment details, test results, medication updates, and health monitoring information.

We aim to ensure that messages contain enough information for patients to understand what action is needed while keeping content appropriate and proportionate. For highly sensitive matters, such as safeguarding concerns, sexual health issues, or certain mental health matters, we may use alternative methods of communication where appropriate.

Keeping your contact details up to date

We send messages to the contact details recorded in your medical record.

It is important that you tell us promptly if:

• Your mobile number changes
• Your email address changes
• You no longer have access to a particular device
• You would prefer us to use a different method of contact

Keeping your information up to date helps ensure your health information reaches you safely and reduces the risk of messages being sent to the wrong person. 

Learn more by reading our guide to changing your personal details

Message notifications and lock screen settings

Text messages and other notifications may appear on your phone's lock screen or notification panel. How these notifications appear is controlled by your personal device settings and is not something the practice can manage on your behalf.

If you are concerned that someone else may be able to view message notifications on your device, you should adjust your phone's privacy settings to limit or hide message previews.

If you share a phone with another person, or have concerns about receiving healthcare information electronically, please let us know and we will discuss alternative communication methods with you.

Your communication preferences

You have the right to tell us how you would prefer to be contacted.

If you do not wish to receive text messages, emails, or other digital communications, please speak to a member of our team.

Please note that changing your communication preferences may affect how quickly we are able to contact you regarding appointments, results, treatment, or other aspects of your care.

Why we use your information

We use your information to:

Provide your healthcare

This includes:

• Diagnosing and treating medical conditions
• Referring you to other healthcare services
• Prescribing medication
• Managing appointments
• Providing follow-up care

Support safe and effective services

We may also use information to:

• Improve the quality of care we provide
• Monitor patient safety
• Review and improve services
• Meet NHS contractual and legal requirements
• Plan future healthcare services

Support research and planning

Where allowed by law, information may be used to support NHS research and service planning. Wherever possible, information is anonymised or pseudonymised so that individuals cannot be directly identified.

Legal basis for processing your information

We process your information because it is necessary to:

• Provide healthcare and treatment
• Protect public health
• Manage and plan NHS services
• Meet legal obligations placed upon the NHS
• Carry out tasks in the public interest

We do not usually rely on consent to provide your healthcare because NHS organisations have specific legal duties that require information to be processed for direct care.

Who we may share your information with

To provide your care, your information may be shared with:

• Hospitals
• Community healthcare services
• Mental health services
• NHS 111 and Out of Hours services
• Social care services
• Community pharmacies
• Other GP practices where appropriate
• Essex Integrated Care Board (ICB)
• Organisations commissioned by the NHS to support your care

Information is only shared when there is a lawful reason to do so and where appropriate safeguards are in place.

Shared care records

Healthcare professionals involved in your care may need access to information held by other NHS organisations.

This may include:

• GP Connect
• Summary Care Record
• My Care Record
• Shared care systems used across Essex

Sharing information in this way helps healthcare professionals make informed decisions and provide safer, more coordinated care.

You can discuss any concerns about shared records with the practice.

Primary Care Networks (PCNs)

Queensway Surgery is a member of Southend Victoria Primary Care Network (PCN).

GP practices within the PCN work together to provide services such as:

• Social prescribing
• Vaccination programmes
• Physiotherapy services
• Mental health support services

Where necessary for your care, relevant information may be shared securely with healthcare professionals working within the PCN.

Population Health Management and Risk Stratification

The NHS uses data to better understand the health needs of local communities.

This information helps healthcare organisations:

• Identify patients who may benefit from additional support
• Improve prevention and early intervention
• Plan healthcare services
• Allocate resources effectively

In most cases, this work uses pseudonymised information, meaning identifying details are removed before analysis takes place.

National data opt-out

You can choose whether your confidential patient information is used for research and planning purposes.

Your choice does not affect:

• Your healthcare
• Your treatment
• Access to NHS services

To find out more or register your choice, visit Your NHS Data Matters

Organisations that process information on our behalf

Like most NHS organisations, we use specialist suppliers to help provide our services.

These include organisations that provide:

• Clinical records systems
• Secure NHS email systems
• Patient communication services
• Telephony and call recording systems
• Information governance support
• Medical reporting services
• NHS data analytics services

All providers are required to meet NHS security and confidentiality standards and may only process information under our instructions.

Call recording

Telephone calls to and from the practice may be recorded for:

• Staff training
• Quality monitoring
• Investigation of incidents or complaints
• Staff and patient safety

Recordings are stored securely and only accessed by authorised staff.

Artificial intelligence (Ai) and digital tools

The practice may use approved NHS digital technologies to help improve efficiency and patient care.

These systems may support:

• Clinical documentation
• Appointment management
• Patient communications
• Healthcare planning

Any use of artificial intelligence or automated systems is subject to appropriate governance, security controls and data protection requirements.

How we protect your information

We take the security of your information seriously.

Measures include:

• Staff confidentiality agreements
• Annual data protection training
• Secure NHS networks
• Role-based access controls
• Password protection and encryption
• Audit logs to monitor system access

Only staff who need access to your information for their work are permitted to view it.

How long we keep your information

We keep records in accordance with NHS Records Management requirements.

Information is only retained for as long as necessary and is securely destroyed when no longer required.

Digital systems and national NHS services we use

To support patient care and the safe running of the practice, we use a range of digital systems and national NHS services. These systems help us communicate with patients, maintain accurate records, improve clinical safety, and plan healthcare services. All suppliers are required to meet NHS information governance and security standards.

SystmOne (TPP)

Our electronic patient record system. It stores your medical record, appointments, prescriptions, test results and other information needed to support your care.

Accurx

A secure NHS-approved communication platform used to send text messages, appointment information, questionnaires and other information relating to your care. It may also be used to receive information from you.

Accurx Scribe

An NHS-approved tool that can assist clinicians by creating consultation notes from conversations. This helps reduce administrative workload and allows clinicians to spend more time focusing on patient care. All information remains subject to NHS confidentiality and data protection requirements.

EMMA AI

A digital patient contact system that helps manage requests coming into the practice by telephone or online. It gathers information provided by patients and creates a structured summary to help ensure enquiries are directed to the appropriate team efficiently.

Anima - Our GP online system

An online consultation and patient access platform that allows patients to contact the practice digitally, submit requests, and access services without always needing to telephone the surgery. Information submitted through the platform becomes part of your healthcare record where appropriate.

NHSmail and Microsoft 365

Secure NHS-approved email, communication and document management systems used by practice staff to communicate and work safely with NHS organisations and approved partners.

Athena

A data and analytics platform used to support population health management, service planning and quality improvement. It allows approved healthcare staff to identify trends and opportunities to improve patient care across the local population.

Eclipse

A clinical platform used to support healthcare improvement programmes, including identifying patients who may benefit from checks, monitoring or preventative interventions such as hypertension management.

Cinapsis Teledermatology

A secure system used to support specialist dermatology referrals and advice. It enables clinicians to securely share clinical information and images to support diagnosis and treatment decisions.

iGPR

A system used to process requests for copies of medical records and medical reports, including those requested by patients, solicitors or insurance companies where appropriate authority has been provided.

Lalu

A service used to support the production of private medical reports and other non-NHS paperwork requested by patients or authorised third parties. Only information required for the specific report is shared.

Rego

A records management service used to digitise historic paper medical records so they can be incorporated into electronic patient records.

Cisco Webex Telephony

Our telephone system provider. Calls may be recorded for training, monitoring, quality assurance, patient safety and staff protection purposes.

National NHS Services

GP Connect

GP Connect allows authorised healthcare professionals involved in your care to view relevant information from your GP record when needed. This supports safer and more coordinated care, particularly in urgent or emergency situations. Information is only shared for direct care purposes.

Summary Care Record

A national NHS record containing key information such as medications, allergies and adverse reactions. It helps healthcare professionals provide safe treatment when they do not have access to your full GP record.

My Care Record

A shared care record that allows healthcare professionals across different NHS and care organisations to access appropriate information needed to support your treatment and care.

OpenSAFELY

A secure NHS research platform used by approved researchers to analyse pseudonymised patient data. Patient names, addresses and other direct identifiers are not released to researchers. The platform supports healthcare research designed to improve patient outcomes and NHS services.

Population Health Management

A programme that uses pseudonymised information to help the NHS understand the health needs of local communities, identify health inequalities and plan services more effectively.

Risk Stratification

A process used by healthcare organisations to identify patients who may be at increased risk of illness or hospital admission so that preventative support and earlier interventions can be offered.

Your Rights

Under UK data protection law, you have the right to:

• Request access to your information
• Request correction of inaccurate information
• Request restriction of processing in certain circumstances
• Object to specific uses of your information
• Raise concerns about how your information is being used

Some rights may be limited where information must be retained to meet legal or healthcare requirements.

Accessing your records

You have the right to request access to information we hold about you.

Apply for online access with family and carers (proxy) access

Data Protection Officer

Our Data Protection Officer is:

Jane Marley
Head of Information Governance
Contact them online

Complaints

If you have concerns about how your information has been used, please contact the Practice Manager in the first instance:

Make a complaint online

You also have the right to complain to the Information Commissioner's Office (ICO)

Read our full complaints procedure

Changes to this privacy notice

We regularly review and update this Privacy Notice to ensure it remains accurate and reflects any changes to the services we provide or the way we process information.

The latest version will always be available from the practice website and reception.