How we look after your data

The General Data Protection Regulation (GDPR) is a new, Europe-wide law that replaces the Data Protection Act 1998 in the UK. It is part of the wider package of reform to the data protection landscape that includes the Data Protection Bill. The GDPR sets out requirements for how organisations will need to handle personal data from 25 May 2018.

Our staff and associates who provide you with care maintain records about your health and any treatment you receive, including previous healthcare treatment. These records help to provide you with the best possible healthcare.

Health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. We also provide some services on behalf of the NHS and so our polices are designed to ensure we meet all relevant statutory legislation and guidance.


Records which the Practice MK holds about you may include the following information:

  • Details about you, such as your address, legal representative, emergency contact details.
  • Any contact the practice has had with you, including telephone calls, emails and appointments.
  • Notes and reports about your health
  • Details about your treatment and care
  • Relevant information from other health professionals, relatives or those who care for you

For clients referred to us by the NHS your records will be retained in accordance with the NHS Code of Practice for Records Management.

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS.

Information may be used by The Practice MK for clinical audit to monitor the quality of the service provided.

All information held about you is stored under our complete control and when used for statistical purposes we take strict measures to ensure that individual clients cannot be identified.

Sometimes your information may be requested to be used for research purposes – The Practice MK may advise you of such research opportunities but will never release any of your personal information for this purpose without obtaining your consent.


How do we maintain the confidentiality of your records? 

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

  • Data Protection Act 2018
  • Human Rights Act 1998
  • Common Law Duty of Confidentiality
  • Health and Social Care Act 2012
  • NHS Codes of Confidentiality and Information Security
  • Information: To Share or Not to Share Review (click here to read further information about this)

Every member of staff and associate who works for The Practice MK has a legal obligation to keep information about you confidential. All staff employed by The Practice MK including its associates are requested to sign a confidentiality agreement upon appointment.  Any breeches of this agreement will be dealt with by means of disciplinary and if necessary, legal means.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any 3rd party without your permission unless there are exceptional circumstances (i.e. life or death situations), or where the law requires information to be passed on for example Child/Adult Protection and Serious Criminal Activity.


Who are our partner organisations?

We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations or receive information from the following organisations:-

  • NHS Trusts / Foundation Trusts
  • GP’s
  • NHS Commissioning Support Units
  • Private Sector Providers
  • Voluntary Sector Providers
  • Clinical Commissioning Groups
  • Social Care Services
  • NHS Digital
  • Local Authorities
  • Education Services
  • Fire and Rescue Services
  • Police & Judicial Services
  • Other ‘data processors’ which you will be informed of

You will be informed who your data will be shared with and in some cases asked for explicit consent for this happen when this is required.


We do not use external companies to process personal information or for archiving purposes. 


Access to personal information

You have a right under the Data Protection Act 2018 to request access to view or to obtain copies of what information the practice holds about you and to have it amended should it be inaccurate.  

In order to request this, you need to do the following:

  • Your request must be made in writing addressed to the Practice Manager
  • There is no charge to have a printed copy of the information held about you
  • Under the Data Protection Act 2018 we may impose a charge for printed copies of the same information if these can be deemed as excessive requests.
  • We are required to respond to you within 30 days
  • You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located

Objections / Complaints

Should you have any concerns about how your information is managed by us, please contact the Practice Manager.  If you are still unhappy, you can then complain to the Information Commissioners Office (ICO) via their website (


Change of Details

It is important that you tell us if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended.  You have a responsibility to inform us of any changes so our records are accurate and up to date for you.



The Data Protection Act 2018 requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information.  

This information is publicly available on the Information Commissioners Office website

The Practice MK is registered with the Information Commissioners Office (ICO).


Who is the data Processor?

This is the person/people or organisation that is responsible for using and recording your information. All staff employed at The Practice MK are individual data processors


Who is the Data Controller?

The Data Controller, responsible for keeping your information secure and confidential is   The Practice MK