We are the Data Controller, which means we decide how and why your personal information is used.

The Data Protection Officer for North West London GP practices is Norman Ernest-Williams. For day-to-day questions about your information or to exercise your rights, please contact the practice manager using the details above.

Why we use your information

1. Direct care (your individual healthcare)

We use your information to:

• Provide GP, nursing, and wider primary care services
• Make referrals, prescribe medication, and review test results
• Communicate with you by SMS, email, phone, letter, NHS App, or in person
• Share relevant information with other NHS services involved in your care, such as hospitals, pharmacies, and out-of-hours services

Automated searches of GP records

We routinely use approved computer systems to search GP records to identify patients who may need:

• Reviews or recalls
• Screening invitations
• Long-term condition monitoring
• Preventive care or additional support

These searches help us provide proactive care.

All results are reviewed by trained staff or clinicians.

We do not make fully automated decisions about your care.

2. Risk stratification and population health

We may use approved NHS systems to analyse information from GP records to help identify patients who may be at higher risk of illness or complications. This supports early intervention and better care planning.

Where used:

• Information may be linked with data from other NHS services
• Analysis is carried out using secure, NHS-approved systems
• Identifiable information is only seen by authorised staff at the practice

You may have the right to object to this processing in some circumstances. Please speak to the practice if you would like more information.

3. Screening programmes

We support national and local screening programmes, including (but not limited to):

• Cervical, breast, and bowel cancer screening
• NHS Health Checks
• Diabetic eye screening and other local programmes

We may share limited contact information so that you can be invited for screening.

You can choose not to take part in screening. More information about screening and opt-out options is available from GOV.UK population screening programmes, or speak to the practice.

4. Research, audit, and service improvement

We also use information to:

• Check the quality and safety of care (clinical audit)
• Improve services
• Support medical research and health service planning when the law allows

Where possible, information used for these purposes is anonymised or de-identified.

Some research may take place without consent where allowed by law and with strict safeguards. Some studies will ask for your explicit consent before using identifiable information.

You can opt out of your confidential information being used for research and planning. This does not affect your direct care.

When the law requires us to share information

In some circumstances, we must share information by law, including:

• NHS England to support NHS systems and patient registration
• Care Quality Commission (CQC) for regulation and inspection
• UK Health Security Agency or local health protection teams to report certain infectious diseases
• Medical Examiner Service when a patient dies, to support independent review of the death
• If ordered to do so by a court of law

In these cases, you may not have the right to object.

Safeguarding

Sometimes we need to share information to protect:

• Children
• Vulnerable adults
• Other individuals at risk of serious harm

These situations are rare.

We do not need your consent to share information for safeguarding where the law requires or allows this.

Our lawful basis for using your information

Under UK GDPR, we use your information because:

• It is necessary to provide NHS care and manage health services (Article 6(1)(e) and Article 9(2)(h))
• Some research, audit, and planning is carried out in the public interest or using de-identified data (Article 6(1)(e) and Article 9(2)(j))
• In some cases, we are required to share information by law (Article 6(1)(c) and, where applicable, Article 9(2)(h) or Article 9(2)(i))

We also comply with the common law duty of confidentiality.

How we keep your information secure

We follow NHS and industry standards to protect your information, including:

• Secure IT systems and access controls
• Staff training and confidentiality obligations
• Audit logs and monitoring
• Policies and procedures for data protection and information governance

How long we keep your information

Medical records are kept in line with the NHS Records Management Code of Practice. Information is only kept for as long as legally required.