Who is responsible for your information

Ashcroft Surgery, Newlands Way, Eccleshill, Bradford BD10 0JE, is the data controller for your GP record. That means we are legally responsible for looking after it and for deciding how it is used.

Several people share the job of protecting your information.

What information we hold about you

Your GP record is a lifelong record of your health. Some of it we write ourselves. Some of it comes from other NHS services who have treated you.

We also keep a record of contact you have with us that is not clinical — for example a complaint, a request for a report, or a note that you asked us to change your address.

Why we use your information, and what allows us to

Data protection law says we must have a clear reason, called a lawful basis, for every use of your information. As an NHS GP practice, we do not usually rely on your consent. We rely on the law that lets health services provide care.

On top of data protection law, every member of our team also has a professional duty of confidentiality. That duty is separate, and in some ways stronger. It means we do not pass on what you tell us unless we have your agreement, or there is a clear and lawful reason to.

Who we share your information with

Most sharing happens because someone else is helping to look after you. We share the least amount needed, with people who have a genuine reason to see it.

When we may share without asking you first

There are a few situations where the law requires us to share information, or where sharing is needed to protect someone. Even then, we share only what is necessary.

• To protect a child or an adult at risk of harm.
• To report certain infectious diseases, as required by law.
• When a court, coroner or tribunal orders us to.
• To prevent or detect a serious crime, or where there is a serious risk to someone's life.
• To report certain births, deaths and gunshot or knife wounds, as required by law.

Wherever we can, we will tell you first and explain what we are doing and why.

Records that are shared for your care

The NHS uses a few national and regional systems so that staff treating you elsewhere can see key facts about your health. Think of it like a doctor in A&E being able to check your allergies at 2am, instead of guessing.

Your Summary Care Record

This is a short summary taken from your GP record. As a minimum it holds your medicines, allergies and any bad reactions you have had to medicines. It can be seen by NHS staff caring for you elsewhere, such as in hospital, at NHS 111 or in a pharmacy.

You can ask for extra detail to be added, such as your conditions and care plans. You can also ask for a basic record only, or ask to opt out completely.

To change your choice, ask reception for a Summary Care Record preference form, or read more on the NHS Summary Care Record information for patients page (opens NHS England Digital).

The Yorkshire and Humber Care Record

This is a regional shared care record. It lets health and care staff who are directly involved in your care see up-to-date information from your GP record, hospital records and social care records in one place.

No new copy of your record is created. The system simply lets approved staff look at information that is already held, at the moment they need it.

You can object to your information being shared this way. Speak to us first, or read more on the Yorkshire and Humber Care Record website (opens external site).

Sharing through our clinical system

Your GP record is held on a secure NHS clinical system. Other NHS services that use the same system — for example community nursing or out-of-hours care — can be given permission to view your record when they are treating you.

You can ask us to stop your record being shared in this way. Please talk to us first, because it can mean that a clinician treating you in an emergency cannot see important information such as your allergies.

Your data choices and opt-outs

You have real choices about how your information is used beyond your own care. These choices are separate from each other, so it helps to know which one does what.

Risk stratification

Risk stratification is a computer search of NHS records that looks for patients who may be at higher risk of becoming unwell — for example from heart disease or a fall. It helps us offer extra support early, rather than waiting for someone to become seriously ill.

Only this practice sees results that identify you by name. The legal basis for it is section 251 of the NHS Act 2006.

If you do not want to be included, tell us and we will add a code to your record so you are left out. Phone 01274 612 279 or email B83062.ashcroftsurgery@nhs.net.

Seeing your own record

You have the right to see what we hold about you. There are two main ways to do it.

1. Put your request in writing

   Email B83062.ashcroftsurgery@nhs.net or write to the surgery. Please say what you need and, if possible, the dates you are interested in. That helps us find it faster.

2. Show us who you are

   We will ask for photo identification, such as a passport or driving licence. This protects you from someone else getting hold of your record.

3. We check the record

   A clinician reviews it before it is released. Very occasionally we have to hold back a small part — for example if it names another person who has not agreed to be identified, or if releasing it could cause serious harm. If we do that, we will tell you.

4. You receive your copy

   We will send it in the format you asked for where we reasonably can, either securely by email or on paper.

Your rights over your information

Data protection law gives you a set of rights. Some of them work a little differently for health records, because we have a legal duty to keep an accurate and complete medical record. We have explained honestly where each right applies and where it does not.

The right to be informed

You have the right to know what we do with your information. That is what this page is for. If anything here is unclear, please ask us and we will explain it.

The right to see your information

You can ask for a copy of your record, free of charge. See Seeing your own record above.

The right to have mistakes corrected

If something factual in your record is wrong — such as your name, address or date of birth — tell us and we will correct it.

A clinical opinion is different. We cannot simply delete a professional judgement a clinician made at the time, because the record has to show what was actually thought and done. But if you disagree with something, we can add your comment alongside it so that anyone reading the record sees your view too.

The right to have information erased

This right is limited for health records. Because we hold your record to carry out a public task, and because the law requires us to keep medical records, we usually cannot delete it. We will always explain our reasons if you ask.

The right to restrict or object to how we use it

You can object to particular uses of your information, and you can ask us to limit what we do with it while a concern is being looked into.

We will always consider your objection carefully. We may not be able to agree to it if we have a legal duty, or where it would put your safety or someone else's safety at risk. We will explain our decision.

The right to move your information

This right applies only where information is used with your consent or under a contract, so it rarely applies to a GP record. In practice, if you move to another GP practice your record is transferred to them automatically and securely.

The right to complain

You have the right to complain to us directly if you think we have handled your information wrongly. We will acknowledge your complaint within 30 days and respond as quickly as we can.

You also have the right to complain to the Information Commissioner's Office at any point. You do not have to come to us first. See If you are unhappy below.

How long we keep your records

We follow the national rules in the NHS Records Management Code of Practice. In short:

• Your GP record is kept for the whole of your life while you are registered with an NHS GP practice.
• If you move to another practice, your record moves with you.
• After a patient dies, the record is normally kept for at least 10 years.
• Records for children and young people are normally kept until at least their 25th birthday.

Records are then either securely destroyed or, in some cases, permanently kept for historical reasons. We never simply throw records away.

Read the NHS Records Management Code of Practice (opens NHS England site)

Children and young people

Young people have the same right to confidentiality as adults. What matters is not simply age, but whether a young person understands enough to make the decision for themselves.

Parents can normally see the record of a young child. Access to a teenager's record is not automatic, because the teenager's own confidentiality has to be respected.

One exception always applies. If we are seriously worried that a child is being harmed or is at risk of harm, we have a duty to share information with social care or the police. Keeping a child safe comes first. We will normally tell the family we are doing this, unless telling them would put the child at greater risk.

How we keep your information safe

We complete the NHS Data Security and Protection Toolkit each year. This is a national assessment that checks we are handling information properly.

If you are unhappy about how we have used your information

Please tell us. Most concerns can be sorted out quickly, and it helps us improve.

1. Talk to us first

   Contact the surgery on 01274 612 279 or email B83062.ashcroftsurgery@nhs.net. You have a legal right to complain to us directly about how we have handled your information. We will acknowledge your complaint within 30 days and reply as soon as we reasonably can.

2. Or contact the Data Protection Officer

   You can go straight to the Data Protection Officer, Daljeet Sharry-Khan, at daljeet.sharry-khan@bradford.nhs.uk. The Data Protection Officer is independent of the day-to-day running of the surgery.

3. You can always contact the Information Commissioner's Office

   The Information Commissioner's Office (ICO) is the UK regulator for data protection. You can contact them at any time — you do not have to complain to us first.

   Helpline: 0303 123 1113
   Website: ico.org.uk/make-a-complaint (opens ICO website)
   Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF

   The ICO is in the process of becoming a new organisation called the Information Commission. Its role and contact details stay the same.

Common questions

Can reception staff see my medical record?

Our reception and administrative team can see the parts of the system they need to do their job — for example to book you in, process a prescription or pass a message to a clinician. They are bound by the same duty of confidentiality as our doctors and nurses, and every access is logged.

Why does reception ask what my problem is?

So they can get you to the right person. Some problems are better dealt with by a nurse, a pharmacist or a physiotherapist than a GP. You do not have to give details if you would rather not, but a short reason usually helps you get help faster. If you would prefer to speak privately, just say so and we will find a quieter space.

Will my family be told about my appointment?

No. We do not discuss your care with a relative unless you have told us we can, or unless you lack the capacity to decide and sharing is in your best interests. If you would like a family member or carer to be able to speak to us on your behalf, tell us and we will record your permission.

Does opting out of research affect my treatment?

No. The national data opt-out only affects how your information is used for research and planning. It never affects the care you receive, and no one treating you will know or care whether you have set it.

Do you use my information to train artificial intelligence?

We do not share your identifiable record with commercial companies to train their products. Where NHS systems we use include automated tools, they are approved for NHS use and operate under NHS information governance rules. Any clinical decision about you is always made by a person, not by a machine.

What happens to my record if I move away?

When you register with a new GP practice, your electronic record is transferred securely to them. We keep only what we are required to keep.

Useful links