This Privacy Notice explains how our GP practice collects, uses, stores, processes and protects your personal information. We are committed to maintaining the confidentiality and security of your data in line with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.

The UK General Data Protection Regulation (UKGDPR) and the Data Protection Act 2018 (DPA 2018) became law on 25th May 2018, and 1st January 2021 when the UK exited the EU.

For the purpose of applicable data protection legislation (including but not limited to the General Data Protection Regulation (Regulation (UK) 2016/679) (the “UKGDPR”), and the Data Protection Act 2018 the practice responsible for your personal data is Alcester Health Centre.

If you have any questions about this notice, please contact our Practice Manager.

The Data Controller responsible for your information is:

Alcester Health Centre, Fields Park Drive, Alcester, Warwickshire, B49 6QR

Telephone: 01789 763060

Email: alcester.healthcentre1@nhs.net

We collect and process the following types of information:

• Personal details — name, date of birth, address, contact details
• Health records — medical history, diagnoses, test results, consultations, medications
• NHS identifiers — NHS number, CHI number (if applicable)
• Appointment information — bookings, attendance, referrals
• Online service data — information submitted through online forms or digital services
• Emergency contact details
• Information from other providers — hospitals, community services, social care, pharmacies

We use your information to:

• Provide safe, effective primary care services
• Make referrals to hospitals and other healthcare providers
• Prescribe medication and manage repeat prescriptions
• Conduct health checks, immunisations, and screening
• Support safeguarding of children and vulnerable adults
• Manage practice administration and service planning
• Comply with legal and regulatory obligations

We process your information under the following lawful bases:

• Article 6(1)(e) — Public task (providing NHS healthcare)
• Article 9(2)(h) — Provision of health or social care
• Article 6(1)(c) — Compliance with legal obligations

Where consent is required (e.g., for certain non‑NHS services), we will ask for it explicitly.

We may share your information with:

• NHS hospitals and specialist services
• Community and mental health teams
• Pharmacies
• Social care services
• Out‑of‑hours and urgent care providers
• Diagnostic and screening services
• NHS England and Integrated Care Boards
• Local authorities (e.g., safeguarding teams)
• Approved third‑party data processors supporting NHS systems

We only share the minimum necessary information and always in line with UK GDPR.

Your information is stored securely on NHS‑approved systems. We use:

• Encrypted electronic records
• Access controls and audit trails
• Secure NHS networks
• Staff confidentiality agreements and training

We retain your records in accordance with the NHS Records Management Code of Practice.

We keep your medical records for the duration required by NHS retention schedules. In most cases, GP records are kept for the lifetime of the patient plus 10 years.

Under UK GDPR, you have the right to:

• Access your records
• Request corrections to inaccurate information
• Request deletion (in limited circumstances)
• Restrict processing
• Object to certain uses of your data
• Request data portability (where applicable)

To exercise your rights, please contact the practice in writing.

You can request access to your records by submitting a Subject Access Request (SAR). We will respond within one month.

If our website uses cookies or online forms, we may collect:

• IP address
• Browser type
• Usage data

This helps us improve website functionality. You can manage cookies through your browser settings.

If you have concerns about how your data is handled, you can contact us at alcester.healthcentre1@nhs.net for the attention of the Practice Manager

You also have the right to complain to the Information Commissioner’s Office (ICO): www.ico.org.uk

We may update this notice periodically. The latest version will always be available on our website.