Privacy Notice

Privacy Notice 

Data Protection Privacy Notice 


This privacy notice lets you know what happens to any personal data that you give to us, or any that we may collect from or about you. 

This privacy notice applies to personal information processed by or on behalf of the practice. 

This Notice explains 

  • Who we are, how we use your information and our Data Protection Officer 
  • What kinds of personal information about you do we process? 
  • What are the legal grounds for our processing of your personal information (including when we share it with others)? 
  • What should you do if your personal information changes? 
  • For how long your personal information is retained by us? 
  • What are your rights under data protection laws? 

In accordance with the applicable data protection legislation in the UK (The Data Protection Act 2018 and the UK General Data Protection Regulation (UKGDPR)) the practice responsible for your personal data is St Ann's Medical Centre.

This Notice describes how we collect, use and process your personal data, and how, in doing so, we comply with our legal obligations to you. Your privacy is important to us, and we are committed to protecting and safeguarding your data privacy rights 


St Ann's Medical Centre is known as the ‘Controller’ of the personal data you provide to us. 

We will collect basic personal data about you which includes name, address, date of birth and contact details such as email and mobile number etc. 

We will also collect sensitive confidential data known as “special category personal data”, in the form of health information, religious belief (if required in a healthcare setting) ethnicity, and sexual orientation through the delivery of services we provide to you and/or linked to your healthcare through other health providers or third parties. 




The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare. 

NHS health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which the Practice hold about you may include the following information: 

  • Details about you, such as your address, carer, legal representative, emergency contact details 
  • Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc. 
  • Notes and reports about your health 
  • Details about your treatment and care 
  • Results of investigations such as laboratory tests, x-rays etc 
  • Relevant information from other health professionals, relatives or those who care for you 

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS. Information may be used within the GP practice for clinical audit to monitor the quality of the service provided. 


We need to know your personal, sensitive and confidential data in order to provide you with Healthcare services as a General Practice, under the UK General Data Protection Regulation we will be lawfully using your information in accordance with: 

Article 6, e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller;” 

Article 9, (h) processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems 

This Privacy Notice applies to the personal data of our patients and the data you have given us about your carers/family members. 

Risk Stratification 

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from several sources including NHS Trusts and from this GP Practice.  


A risk score is then arrived at through an analysis of your de-identified information is only provided back to your GP as data controller in an identifiable form. Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary, your GP may be able to offer you additional services. Please note that you have the right to opt out of your data being used in this way – please see the section on Your Rights below. 

Medicines Management 

The Practice may conduct Medicines Management reviews of medications prescribed to its patients under a processing arrangement with the Medicines Management Team at Rotherham Clinical Commissioning Group. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost-effective treatments. 

The Rotherham Health Record 

St Ann's Medical Centre has access to and shares information with the Rotherham Health Record. 

The Rotherham Health Record is an electronic system for sharing your health and care information in a secure way with health and care staff who provide care directly to you.  When you receive care in a number of places in Rotherham, such as the hospital or your GP Practice, your information is stored on different computer systems. The Rotherham Health Record enables health and care professionals to access, in one place, information held in these different systems in order to deliver better care and decisions to plan and deliver your care effectively. It is a read-only system which allows health and care professionals a view of information contained in other computer systems, it does not hold any clinical patient information within it. 

The Rotherham Health Record is a partnership supported by NHS Rotherham Clinical Commissioning Group, The Rotherham NHS Foundation Trust, Rotherham Doncaster and South Humber NHS Foundation Trust, Rotherham Metropolitan Borough Council, Rotherham Hospice and GP Practices within the Rotherham CCG area. All partners are signatories to the Rotherham Health Record Information Sharing Agreement which provides partner agencies with a robust foundation for the lawful, secure and confidential sharing of personal information. 

Each partner has a legal duty to protect your personal information and will remain sole data controller of its own data. We all take confidentiality very seriously and are committed to ensuring all personal information within the Rotherham Health Record is managed in accordance with the relevant legislation to ensure your information is safe, secure and confidential. 

Information available to view within The Rotherham Health Record includes information such as name, address, date of birth, medications, allergies, dates and reasons for hospital admissions, appointments, test results, correspondence and referrals and emergency contact details. It does not include sensitive information, such as your sexual health history 

You can opt out of having your information shared through the Rotherham Health Record at any time. If you would like to optout, please use one of the following options: 

  • Email: 
  • Ring 01709 427299 
  • Write to:  

Rotherham Health Record Consent 

Subject Access Request Team 

Rotherham Hospital 

Moorgate Road 


S60 2UD 



The law requires St Ann's Medical Centre to share information from your medical records in certain circumstances. Under the UKGDPR we will be lawfully using your information in accordance with 


Article 6(1)(c) – ‘processing is necessary for compliance with a legal obligation to which the controller is subject…’ 


Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services...’ 


Information is shared so that the NHS or Public Health England can, for example: 


  • plan and manage services 
  • check that the care being provided is safe 
  • prevent infectious diseases from spreading   


We will share information with NHS Digital, the Care Quality Commission and local health protection team (or Public Health England) when the law requires us to do so. Please see below for more information. 

We must also share your information if a court of law orders us to do so. 

NHS Digital 

NHS Digital is a national body which has legal responsibilities to collect information about health and social care services. 


It collects information from across the NHS in England and provides reports on how the NHS is performing. These reports help to plan and improve services to patients. 


This practice must comply with the law and will send data to NHS Digital, for example, when it is told to do so by the Secretary of State for Health or NHS England under the Health and Social Care Act 2012. 


More information about NHS Digital and how it uses information can be found at: 

Care Quality Commission (CQC) 

The CQC regulates health and social care services to ensure that safe care is provided.  

The law says that we must report certain serious events to the CQC, for example, when patient safety has been put at risk.  

For more information about the CQC see:  

Public Health 

  • The law requires us to share data for public health reasons, for example to prevent the spread of infectious diseases or other diseases which threaten the health of the population.  


  • We will report the relevant information to local health protection team or Public Health England. 


For more information about Public Health England and disease reporting see: 

National screening programmes 

The NHS provides national screening programmes so that certain diseases can be detected at an early stage.  

These screening programmes include bowel cancer, breast cancer, cervical cancer, aortic aneurysms and a diabetic eye screening service.  

The law allows us to share your contact information with Public Health England so that you can be invited to the relevant screening programme. The following sections of the UK GDPR allow us to contact patients for screening. 

Article 6(1)(e) – ‘processing is necessary…in the exercise of official authority vested in the controller...’’ 

Article 9(2)(h) – ‘processing is necessary for the purpose of preventative…medicine…the provision of health or social care or treatment or the management of health or social care systems and services...’ 

For national screening programmes you can opt so that you no longer receive an invitation to a screening programme.  


More information can be found at: or speak to the practice. 


We are committed to protecting your privacy and will only use information collected lawfully in accordance with: 

  • Data Protection Act 2018 
  • The UK General Data Protection Regulation 
  • Human Rights Act 1998 
  • Common Law Duty of Confidentiality 
  • Health and Social Care Act 2012 
  • NHS Codes of Confidentiality, Information Security and Records Management 


In the circumstances where we are required to use personal identifiable information, we will only do this if: 

  • The information is necessary for your direct healthcare, or 
  • We have received explicit consent from you to use your information for a specific purpose, or 
  • There is an overriding public interest in using the information: 
  • In order to safeguard an individual, 
  • To prevent a serious crime or in the case of Public Health or other emergencies, to protect the health and safety of others, or 
  • There is a legal requirement that allows or compels us to use or provide information (e.g. a formal court order or legislation), or 
  • We have permission from the Secretary of State for Health and Social Care to use certain confidential patient identifiable information when it is necessary for our work 

Everyone working for the NHS has a legal and contractual duty to keep information about you confidential.  

Our practice policy is to respect the privacy of our patients, their families and our staff and to maintain compliance with the UK General Data Protection Regulation (UKGDPR) and all UK specific Data Protection requirements. Our policy is to ensure all personal data related to our patients will be protected. 

All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. The practice will, if required, sign a separate confidentiality agreement if the client deems it necessary. If a sub-contractor acts as a data processor for St Ann's Medical Centre an appropriate contract (art 24-28) will be established for the processing of your information. 

Where information is held centrally and used for statistical purposes, we take strict measures to ensure that individual patients cannot be identified. Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose in an identifiable format. In some circumstances you can Opt-out of the surgery sharing any of your information for research purposes – please see Your Rights section below. 


We would like to use your name, contact details and email address to inform you of services that may benefit you, with your consent only. There may be occasions where authorised research facilities would like you to take part in innovations, research, improving services or identifying trends. 

At any stage where we would like to use your data for anything other than the specified purposes and where there is no lawful requirement for us to share or process your data, we will ensure that you have the ability to consent and opt out prior to any data processing taking place. 

This information is not shared with third parties or used for any marketing and you can withdraw your consent at any time via phone, email or by informing the practice DPO as below. 


All the personal data we hold is processed and stored in the UK. Your information will not be sent outside of the UK where the laws do not protect your privacy to the same extent as the law in the UK. We will never sell any information about you. 

No third parties have access to your personal data unless the law allows them to do so and appropriate safeguards have been put in place.  


We may also have to share your information, subject to strict agreements on how it will be used, with the following organisations: 

  • NHS Trusts / Foundation Trusts 
  • GPs 
  • NHS Commissioning Support Units 
  • Independent Contractors such as dentists, opticians, pharmacists 
  • Private Sector Providers 
  • Voluntary Sector Providers 
  • Ambulance Trusts 
  • Clinical Commissioning Groups 
  • Social Care Services 
  • NHS England (NHSE) and NHS Digital (NHSD) 
  • Local Authorities 
  • Education Services 
  • Fire and Rescue Services 
  • Police & Judicial Services 
  • Voluntary Sector Providers 
  • Private Sector Providers 
  • Other ‘data processors’ which you will be informed of 

We may also use external companies to process personal information, such as for archiving purposes. These companies are bound by contractual agreements to ensure information is kept confidential and secure. All employees and sub-contractors engaged by our practice are asked to sign a confidentiality agreement. If a sub-contractor acts as a data processor for St Ann's Medical Centre an appropriate contract (UKGDPR Article 24-28) will be established for the processing of your information. 


We are required under UK law to keep your information and data for the full retention periods as specified by the NHS Records management code of practice for health and social care and national archives requirements. 

More information on records retention can be found online at ( ) 


Under the UK General Data Protection Regulation all individuals have certain rights in relation to the information which the Practice holds about them. Not all rights apply equally to all our processing activity as certain rights are not available depending on the lawful basis for the processing. To get in touch about these, please contact us. We will seek to deal with your request without undue delay, and in any event in accordance with the requirements of any applicable laws. Please note that we may keep a record of your communications to help us resolve any issues which you raise. 

Examples of where rights may not apply - where our lawful basis is: 


  • Processing is necessary for the performance of a task carried out in the exercise of official authority vested in the controller - then rights of erasure, portability do not apply. 
  • Legal Obligation - then rights of erasure, portability, objection, automated decision making and profiling do not apply. 


If you require further detail each link below will take you to the Information Commissioner’s Office’s website where further detail is provided in section ‘When does the right apply’. 


These rights are:  


Under the NHS Constitution you have the right to privacy and to expect the NHS to keep your information confidential and secure. 


You have the right to be informed about how your information is used. 


Supporting these rights patients in England also have the right under the NHS Constitution to request that their personal confidential data is not used for reasons other than their individual care and treatment. The process for applying this right is called the ‘National Patient Data Opt-out’ this gives patients and the public the opportunity to make an informed choice about whether they wish their personally identifiable data to be used just for their individual care and treatment or also used for research and planning purposes.  


 However, there are exemptions to this, the national patient data opt-out applies unless: 


  • There is a mandatory legal requirement or an overriding public interest for the data to be shared e.g. Adults and Children safeguarding. 


  • The opt-out does not apply when the individual has consented to the sharing of their data; or 


  • Where the data is anonymised in line with the Information Commissioner’s Office (ICO) Code of Practice on Anonymisation. 


To be compliant with the national data opt-out policy the Practice has put procedures in place to review uses or disclosures of confidential patient information against the national data opt-out operational policy guidance.  


If you believe the Practice is using your personal information in a way you would object to or contrary to your National Patient Data Opt-Out request, you have the right to object and have your objections considered and where your wishes cannot be followed, to be told the reasons including the legal basis. 


For further details of the national patient data opt out can be found here:  

Access to your personal information 

Data Subject Access Requests (DSAR): You have a right under the Data Protection legislation to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. To request this, you need to do the following: 

  • Your request should be made to the Practice – for information from the hospital you should write direct to them 
  • There is no charge to have a copy of the information held about you 
  • We are required to respond to you within one month 
  • You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified, and your records located information we hold about you at any time. 


You should tell us so that we can update our records please contact the Practice Manager as soon as any of your details change, this is especially important for changes of address or contact details (such as your mobile phone number), the practice will from time to time ask you to confirm that the information we currently hold is accurate and up-to-date. 


Should you have any concerns about how your information is managed at the GP, please contact the GP Practice Manager or the Data Protection Officer as above. If you are still unhappy following a review by the GP practice, you have a right to lodge a complaint with a supervisory authority: You have a right to complain to the UK supervisory Authority as below. 

Information Commissioner: 

Wycliffe House 
Water Lane 
SK9 5AF 

Tel: 0303 1231113  or 01625 545745  

If you are happy for your data to be extracted and used for the purposes described in this privacy notice, then you do not need to do anything. If you have any concerns about how your data is shared, then please contact the Practice Data Protection Officer. 

If you would like to know more about your rights in respect of the personal data we hold about you, please contact the Data Protection Officer as below. 


The Practice Data Protection Officer is Claire McInnes, Head of Information Governance at NHS Rotherham CCG. Any queries regarding Data Protection issues should be addressed to her at: 



Claire McInnes, Data Protection Officer 

NHS Rotherham CCG 

Oak House 



S66 1YY  


It is important to point out that we may amend this Privacy Notice from time to time. If you are dissatisfied with any aspect of our Privacy Notice, please contact the Practice Data Protection Officer. 

Covid-19 and your information - Updated April 2021 


Supplementary privacy note on Covid-19 


This notice describes how we may use your information to protect you and others during the Covid-19 outbreak. It supplements and is to be read alongside our standard Privacy Notice above. 


The health and social care system is facing significant pressures due to the Covid-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations. 

Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak. The Secretary of State has served notice under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) to require NHS Digital; NHS England and Improvement; Arms Length Bodies (such as Public Health England); local authorities; health organisations and GPs to share confidential patient information to respond to the Covid-19 outbreak. Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data.  The COPI notice is currently in place until 30 September 2021. Further information is available on here and some FAQs on this law are available here. 


To support the response to the outbreak, NHS Digital has been legally directed to collect and analyse healthcare information about patients from their GP record for the duration of the coronavirus emergency period using the General Practice Extraction Service (GPES). 


NHS Digital will analyse the data and securely and lawfully share data with other appropriate organisations described below for coronavirus response purposes only. These purposes include: 

  • carrying out vital research into treatments and vaccines for the virus, including clinical trials 
  • identifying coronavirus trends and risks to public health 
  • diagnosing and monitoring the effects of coronavirus 
  • controlling and helping to prevent the spread of the virus 
  • planning and providing health, social care and other public services in response to coronavirus (COVID-19) 
  • helping clinicians, scientists, public health bodies and the government to provide guidance and develop policies to respond to the outbreak 
  • monitoring and managing the outbreak 


NHS Digital is the controller of the personal data collected and analysed above jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect, analyse and in certain circumstances disseminate this data under the COVID-19 Public Health Directions 2020 (COVID-19 Directions).  


Data may be analysed and linked to other data held by NHS Digital, or held by other 

organisations to which access to the data is granted for COVID-19 purposes. Data will be collected nationally from all GP Practices by NHS Digital every fortnight. 


All GP practices in England are legally required to share data with NHS Digital for this purpose under the Health and Social Care Act 2012. The data to be collected will include information about patients who are currently registered with a GP practice or who have a date of death on or after 1 November 2019 whose record contains coded information relevant to coronavirus planning and research. 


It will not include details for any patient who has registered a Type 1 objection with their GP practice.  Where a Type 1 objection has been registered, your GP practice will not share your personal identifiable confidential information outside of the GP practice, except when it is being used for the purposes of your care and treatment 


More information on this collection of data can be found here:  

During this period of emergency, opt-outs will not generally apply to the data used to support the Covid-19 outbreak, due to the public interest in sharing information.  This includes National Data Opt-outs However, in relation to the Summary Care Record, existing choices will be respected. Where data is used and shared under these laws your right to have personal data erased will also not apply. It may also take us longer to respond to Subject Access requests, Freedom of Information requests and new opt-out requests whilst we focus our efforts on responding to the outbreak. 


In order to look after your health and care needs we may share your confidential patient information including health and care records with clinical and non clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111. We may also use the details we have to send public health messages to you, either by phone, text or email. 


During this period of emergency we may offer you a consultation via telephone or video-conferencing. By accepting the invitation and entering the consultation you are consenting to this. Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation. 


We will also be required to share personal/confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of 

protecting public health, providing healthcare services to the public and monitoring and 

managing the outbreak.  Further information about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the Covid-19 response is here   


NHS England and Improvement and NHSX have developed a single, secure store to gather data from across the health and care system to inform the Covid-19 response. This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital. New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patients themselves.  All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.    


In such circumstances where you tell us you’re experiencing Covid-19 symptoms we may need to collect specific health data about you.  Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards.  


Covid-19 Vaccinations 


Covid-19 vaccinations are being delivered according to priority groups identified by the Joint Committee of Vaccination and Immunisation (JCVI). The vaccinations may not take place at your GP practice, but rather a local vaccination service (led by GPs, practice nurses and community pharmacists) who are responsible for delivering the vaccine to people in your community. 


Patients eligible for a Covid-19 vaccination will be contacted via a centralised booking service, managed by the GP Federation, Connect Healthcare Rotherham CIC on behalf of the Primary Care Networks in Rotherham. All data held and accessed in the delivery of the booking service will be treated with the appropriate safeguards. 


NHS England is responsible for processing your personal data for the purposes of the national vaccination programme. To find out more, you can access the privacy notice at:  

 or search for “NHS England Privacy Notice” in your browser. 


We may amend this privacy notice at any time so please review it frequently. The date at the top of this page will be amended each time this notice is updated.  

Call 111 when you need medical help fast but it’s not a 999 emergencyNHS ChoicesThis site is brought to you by My Surgery Website