INTRODUCTION
The Nelson Medical Practice is committed to protecting the confidentiality and security of your personal information.
This Privacy Notice explains how we collect, use, store and share your personal information, your rights regarding that information, and how we comply with data protection legislation.
The Practice acts as the Data Controller for the personal information we hold about our patients.
This notice applies to all patients registered with the Practice and to individuals who interact with our services.
WHO WE ARE
The Nelson Medical Practice
220 Kingston Road, LONDON, SW20 8DA
Telephone: 020 3826 0826
Email: [email protected]
Data Protection Officer (DPO): Steve McGuinness (Nelson)
Contact details above
Laura Watson (SW London ICB)
Email: [email protected]
THE INFORMATION WE COLLECT
To provide safe and effective healthcare services, we maintain records about your health and care.
The information we collect may include:
· Name, address, date of birth and contact details
· NHS number and other healthcare identifiers
· Next of kin and emergency contact details
· Medical history and clinical records
· Consultation notes
· Diagnoses and treatment information
· Prescriptions and medication records
· Test results and investigations
· Referral information and correspondence from hospitals and other healthcare providers
· Appointment records
· Vaccination history
· Images, scans and documents relating to your care
· Information submitted through online consultation systems
· Communications between you and the Practice
· Information relating to safeguarding concerns where applicable
Some of this information is classified as "special category data" under UK data protection law because it relates to your health.
WHY WE USE YOUR INFORMATION
We use your information to:
· Provide healthcare and treatment
· Maintain accurate medical records
· Arrange referrals and coordinate care with other healthcare providers
· Manage appointments and recalls
· Prescribe medications and monitor treatment
· Communicate with you about your care
· Deliver preventative healthcare programmes
· Support safeguarding responsibilities
· Investigate complaints and incidents
· Meet legal and regulatory obligations
· Improve the quality and safety of services
· Manage NHS contracts and healthcare funding
· Support healthcare planning and public health activities where permitted by law
OUR LEGAL BASIS FOR PROCESSING INFORMATION
The Practice processes personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and relevant NHS legislation.
The legal bases relied upon include:
Article 6 UK GDPR
· Article 6(1)(e) – Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Practice.
Article 9 UK GDPR
As health information is special category data, we also rely upon:
· Article 9(2)(h) – Processing is necessary for the provision of health or social care or treatment and the management of health systems and services.
Where required, we may also process information under other legal obligations imposed on healthcare providers.
USE OF ARTIFICIAL INTELLIGENCE (AI) AND EMERGING TECHNOLOGIES
The Practice may use approved artificial intelligence (AI), machine learning, speech recognition and clinical support technologies to help improve patient care, efficiency and administrative processes.
Examples may include technologies used for:
· Transcribing consultations and generating clinical notes
· Processing clinical correspondence and incoming documents
· Clinical coding and record management
· Summarising healthcare information
· Supporting administrative workflows
· Assisting clinicians in reviewing patient information
Current examples include AI-assisted transcription and document management systems.
Where AI technologies are used:
· The Practice remains responsible for all decisions relating to patient care
· AI systems are used to support, not replace, qualified healthcare professionals
· Information generated by AI systems is reviewed and verified by trained staff before being added to a patient's medical record
· Appropriate contractual, technical and organisational safeguards are implemented
· Suppliers must comply with NHS information governance, confidentiality and data protection requirements
· Data Protection Impact Assessments (DPIAs) are undertaken where required before introducing new technologies
The Practice does not make solely automated decisions about patients that produce legal or similarly significant effects without meaningful human involvement.
As healthcare technologies evolve, additional approved AI systems may be introduced to support clinical and administrative functions. This Privacy Notice will be updated where appropriate.
WHO WE SHARE INFORMATION WITH
Your information may be shared where necessary to support your healthcare, comply with legal obligations or fulfil NHS requirements.
This may include:
· NHS England
· South West London Integrated Care Board (ICB)
· NHS trusts and hospitals
· Community healthcare providers
· Mental health services
· Pharmacies
· Out-of-hours services
· Ambulance services
· Diagnostic and laboratory services
· Social care providers
· Safeguarding organisations
· Regulatory bodies
· Approved NHS technology and information system providers
· Organisations providing services on behalf of the NHS
Information is shared only where there is a lawful basis to do so and appropriate safeguards are in place.
We may also disclose information when required by law, court order, safeguarding obligations or regulatory requirements.
CONFIDENTIALITY AND SECURITY
Everyone working within the NHS has a legal duty to maintain the confidentiality of patient information.
The Practice maintains physical, technical and organisational safeguards designed to protect information against unauthorised access, loss, misuse or disclosure.
All staff receive confidentiality and information governance training and are required to follow strict policies and procedures.
NATIONAL DATA OPT-OUT
The NHS provides patients with a choice about whether confidential patient information is used for research and planning purposes.
This is known as the National Data Opt-Out.
More information is available at: https://www.nhs.uk/your-nhs-data-matters/
Your choice will not affect your individual care or treatment.
HOW LONG WE KEEP INFORMATION
Medical records are retained in accordance with the NHS Records Management Code of Practice and other applicable legal and regulatory requirements.
Healthcare records are generally retained for long periods to support ongoing care and meet legal obligations.
When information is no longer required, it will be securely destroyed or deleted in accordance with NHS retention schedules.
YOUR RIGHTS
Under UK data protection legislation, you have rights relating to your personal information.
These include:
· The right to be informed about how your information is used
· The right to request access to your information
· The right to request correction of inaccurate information
· The right to request restriction of processing in certain circumstances
· The right to object to processing in certain circumstances
· Rights relating to automated decision-making where applicable
Some rights may be limited where healthcare legislation requires information to be retained or processed for patient care.
ACCESSING YOUR MEDICAL RECORD
You can access parts of your medical record through the NHS App and other approved NHS digital services.
You may also make a Subject Access Request to obtain copies of information held by the Practice.
Requests should be made to the Practice Manager or Data Protection Officer.
INTERNATIONAL TRANSFERS
The Practice aims to ensure that patient information is processed within the United Kingdom wherever possible.
Where information is processed outside the UK, appropriate legal safeguards will be implemented in accordance with UK data protection legislation.
COMPLAINTS AND FURTHER INFORMATION
If you have concerns about how your personal information is handled, please contact the Practice in the first instance.
If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO).
Information Commissioner's Office
Website: https://ico.org.uk
Telephone: 0303 123 1113
CHANGES TO THIS PRIVACY NOTICE
This Privacy Notice will be reviewed regularly and updated when necessary to reflect changes in legislation, NHS requirements, technology or Practice services.
Last Updated: June 2026
Review Date: June 2027