Privacy policy

Privacy notice

 
 
 

Cranwich Road Surgery Privacy Policy

Effective Date: October 2025
Reviewed by: Practice Manager - G. Rajah
Next Review Due: October 2026

Introduction

At Cranwich Road Surgery, we are committed to protecting your privacy and the confidentiality of your personal information. This Privacy Policy explains how we collect, use, store, share, and protect your personal data, in compliance with the Data Protection Act 2018, which incorporates the UK General Data Protection Regulation (UK GDPR).

Our primary purpose is to provide safe, high-quality care. To do this, we must collect, store, and, when necessary, share information about our patients.

Who We Are

  • Data Controller: Cranwich Road Surgery

  • Data Protection Officer (DPO): NHS North East London ICB

Information We Collect

We may collect and process the following types of data:

  • Personal identification: name, address, date of birth, NHS number

  • Contact details: telephone number, mobile number, email

  • Demographic information: gender, ethnicity, occupation, family members, carers

  • Medical data: appointments, test results, diagnoses, treatment plans, referrals, prescriptions, allergies, and medical history

  • Correspondence: with you and other care providers

  • Lifestyle information where relevant: smoking, alcohol intake, social circumstances

  • Safeguarding information (children and vulnerable adults)

All medical records are treated as special category (sensitive) data, and handled with heightened care.

Why We Process Your Data

We process your data to provide direct care. This includes:

  • Diagnosing and treating health conditions

  • Referring you to other services (e.g. hospitals, community care)

  • Managing prescriptions

  • Delivering preventative care

  • Responding to emergencies

We also process anonymised or pseudonymised data to:

  • Audit services and improve quality of care

  • Conduct research and development

  • Plan future NHS services

  • Monitor safety and outcomes

Legal Basis for Processing

The legal bases under GDPR for processing your data include:

  • Article 6(1)(c) – Legal obligation

  • Article 6(1)(e) – Public task

  • Article 9(2)(h) – Provision of health or social care

  • Common Law Duty of Confidentiality – Implied consent for direct care

Who We Share Information With

Your data may be shared with:

  • GPs, nurses, and admin staff at the surgery
  • Hospitals and specialists
  • Community services (e.g. district nurses, health visitors)
  • Pharmacists
  • Mental health services
  • Local authorities and social care providers
  • NHS England, ICBs, NHS Digital
  • Emergency services
  • Coroner’s services (in specific circumstances)
  • Voluntary sector (e.g. social prescribing)
  • Education Services
  • Fire and Rescue Services
  • Police & Judicial ServicesThe
  • Child Health Information Service
  • Substance Misuse Remote Workers
  • PCN
This practice is also part of a Neighbourhood Multi-Disciplinary Team based upon the Springfield Park Primary Care Network designed to bring together a number of service providers to help patients with more than one need.
 
GP Connect Access Record
 
We use an NHS IT service called GP Connect to support your direct healthcare.
GP Connect allows authorised clinicians involved in your care to view relevant information from your GP record, ensuring they have accurate, up-to-date details when treating you.
It is used only for direct patient care and not for any other purpose.
 
Through GP Connect; Clinicians such as GPs, NHS 111 staff, hospital doctors, nurses, care home staff, and social care clinicians can securely access your GP record when needed for your care.
NHS 111 and other local services may also use GP Connect to book appointments directly with your GP practice or another service within the Primary Care Network.
All access is logged and audited. Information is only shared where necessary and with authorised healthcare professionals.
As a patient, you have the right to opt out of your information being shared through GP Connect.
If you wish to exercise this right or learn more, please contact your Practice Manager. You may opt in again at any time.
To learn more, visit: GP Connect - NHS England Digital
 

We use EMIS Health systems and approved NHS data tools like EMIS Enterprise, Apollo, and INR Star to securely store and process your data.

We do not sell or share data for marketing purposes. We only share information with insurers with your explicit consent.

Communication with You

We may use text messages, phone calls, or emails to:

  • Remind you of appointments

  • Share test results

  • Invite you for vaccinations or reviews

Please ensure your contact details are up-to-date. You can opt out of these communication methods at any time.

We may also use YouTube or online media for public health messaging; patients can opt out of this communication.

Summary Care Record (SCR) & Local Shared Records

All patients have an SCR unless they opt out. The SCR helps clinicians outside the surgery access essential information during emergencies or urgent care.

Locally, we share summary data via One London, a secure shared patient record initiative.

Covid-19 Pandemic and COPI Notices

During the Covid-19 pandemic, under COPI (Control of Patient Information) Notices, data was shared more extensively for:

  • Managing outbreaks

  • Identifying vulnerable patients

  • National vaccination rollouts

These provisions end once COPI notices are withdrawn.

Automated Data Use

We may use automated tools and algorithms (e.g., risk stratification software) to identify high-risk patients, such as those likely to fall or need shielding.

Patients can opt out of automated processing after the COPI notice is withdrawn.

Research & Planning

We contribute anonymised/pseudonymised data to support NHS research and planning. Identifiable data is only used for research with your consent.

More information is available from NHS Digital:
GP Data for Planning and Research Privacy Notice

Your Rights

You have the right to:

  • Access your information

  • Correct inaccurate data

  • Object to specific uses of your data (Article 21)

  • Opt out of data being used for planning/research (via Your NHS Data Matters)

You cannot opt out of your data being used for direct care.

How Long We Keep Your Data

We retain records in line with the NHS Records Management Code of Practice. Medical records are retained for your lifetime and transferred when you move practice.

More information:
Records Management Code of Practice

How We Store Your Data

We store your data on secure systems managed by:

  • EMIS Health (Cloud-based records)

  • INR Star (For patients on warfarin – managed by LumiraDX)

All data is stored in UK Government-approved data centres.

Safeguarding and Caldicott Guardian

The practice has a duty to safeguard vulnerable adults and children. Where necessary, information may be shared with appropriate agencies in the patient’s best interests.

Our Caldicott Guardian (a senior GP) ensures any data sharing is proportionate and lawful. Their decisions are final.

Data Processors

We may use approved third-party processors to deliver services, including:

  • EMIS Health

  • LumiraDX (INR Star)

  • Other NHS-contracted IT and clinical service providers

All data processors are under strict confidentiality and security obligations.

Complaints and Queries

If you have a question or concern about how your data is handled:

  • Contact the Practice Manager

  • Or, contact our Data Protection Officer at:

NHS NEL GP DPO Service

NHS North East London

9th Floor

20 Churchill Place

London

E14 5HJ

DPO Email: nel.gpdpoig@nhs.net

For advice and guidance on data breaches, directly email the DPO at nel.gpdpoig@nhs.net.

If you are not satisfied, you can escalate the issue to the:

Information Commissioner's Office (ICO)

Website: www.ico.org.uk
Helpline: 0303 123 1113
Address: Wycliffe House, Water Ln, Wilmslow SK9 5AF

National Data Opt-Out

To manage your NHS data preferences for planning and research:

Visit: www.nhs.uk/your-nhs-data-matters

Changes to This Policy

We review this policy annually or when there are significant changes in law or practice.

  • Cranwich Road Surgery
    62 Cranwich Road, N16 5JF
  • 020 8802 2002

This document reflects our commitment to transparency, patient privacy, and high-quality care. If you have any concerns, please contact the surgery and speak to the Practice Manager

 

COVID-19 Vaccination Programme (PCN Delivery)

 
Springfield Park Primary Care Network (PCN), which includes Spring Hill Practice, Stamford Hill Group Practice, and The Surgery (Cranwich Road), delivers the COVID-19 vaccination service collaboratively on behalf of all practices within the network.
 
To enable safe and effective delivery of the vaccination programme, limited and necessary patient information is shared between the practices within the PCN. This includes information required to identify eligible patients, record vaccinations, and support follow-up care.
 
Lawful Basis for Processing
Processing of patient information for this purpose is carried out under:
All processing is conducted in accordance with the UK GDPR, the Data Protection Act 2018, and NHS information governance requirements.
 
Data Sharing and Security
Only staff directly involved in delivering the vaccination programme will have access to relevant information.
Data is shared securely using NHS-approved systems (e.g., EMIS, Pinnacle, or NIMS) and is retained in line with national NHS record-keeping standards.
No data is shared with external organisations for non-care purposes without a lawful basis and appropriate data sharing agreements.
 
Your Rights
Patients have the right to:
Further details about your data protection rights are available in our full Practice Privacy Notice, or you may contact the PCN Data Protection Officer:
 

NHS NEL GP DPO Service

NHS North East London

9th Floor

20 Churchill Place

London

E14 5HJ

DPO Email: nel.gpdpoig@nhs.net

 

Learning Disability Register Reconciliation Project 

Spring Hill Practice is participating in a Learning Disability Register Reconciliation Project with Springfield Park Primary Care Network (PCN) and local NHS and health and care partners. The purpose of this project is to improve the accuracy of our Learning Disability Register and help ensure that patients receive appropriate care, support, and reasonable adjustments. 

Why We Use Your Information 

We may review information held within your GP record to identify patients who: 

  • Have a learning disability but are not currently recorded on the GP Learning Disability Register. 

  • May have inaccurate, incomplete, or outdated coding relating to a learning disability. 

  • May be eligible for an NHS Annual Learning Disability Health Check. 

  • Require reasonable adjustments to support access to healthcare services. 

Accurate recording helps ensure patients receive the right care, support, communication, and access to services. 

What Information We May Use 

We will only use the minimum information necessary for this project, which may include: 

  • NHS number 

  • Name 

  • Date of birth 

  • GP practice details 

  • Learning disability-related clinical codes 

  • Learning Disability Register status 

  • Limited demographic information where necessary to support identification and reconciliation 

This information is already held within your GP record. 

How We Use Your Information 

Authorised staff may review patient-level information to determine whether patients are correctly included on the Learning Disability Register. 

This may involve comparing information held within the GP record with information provided by authorised NHS and local authority partners where there is a lawful basis for doing so. 

Where a discrepancy is identified, the Practice may review and update the patient's clinical record where clinically appropriate. 

No automated decision-making or profiling is used as part of this project. Any amendments to patient records will be reviewed and completed by appropriately authorised staff members. 

Who We May Share Information With 

For the purposes of this project, information may be shared, where necessary and proportionate, with: 

  • Homerton Healthcare NHS Foundation Trust Learning Disability and Autism Services 

  • Other authorised health and care professionals involved in the Learning Disability Register Reconciliation Project 

Information will only be shared where necessary to support direct care, improve the accuracy of GP records, and ensure eligible patients receive appropriate services. 

Information will never be sold or used for marketing purposes. 

Lawful Basis for Processing 

Processing of personal data for this project is carried out under: 

  • Article 6(1)(e) UK GDPR – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority. 

  • Article 9(2)(h) UK GDPR – Processing is necessary for the provision or management of health and social care services. 

The common law duty of confidentiality is satisfied through the use of information for direct care purposes and the management of health and care services. 

How We Keep Your Information Safe 

We protect your information through: 

  • Secure NHS-approved systems 

  • Role-based access controls 

  • NHS Smartcards or approved secure authentication 

  • Access restricted to authorised staff 

  • Audit logging and monitoring 

  • Secure NHS communication systems 

  • Staff confidentiality obligations 

  • Mandatory Information Governance and Data Protection training 

How Long We Keep Information 

Patient information forms part of the GP record and is retained in accordance with the NHS Records Management Code of Practice. 

Any temporary reconciliation files created for the project will only be retained for as long as necessary to complete the work and will then be securely deleted. 

Where project reporting is required, information will be anonymised or aggregated wherever possible. 

Your Rights 

You have the right to: 

  • Be informed about how your information is used. 

  • Access your personal information. 

  • Request correction of inaccurate information. 

  • Object to certain types of processing. 

  • Request restriction of processing in certain circumstances. 

  • Raise concerns about how your information is being used. 

Further information about your data protection rights can be found within this Privacy Notice or by contacting the Practice Manager or the Practice Data Protection Officer. 

 

Reviewed it by M O’Garro in June 2026. 

Next review due in June 2027. 

Page last reviewed: 13 July 2026
Page created: 20 May 2025