See why Your Data Matters


How we use your medical records


How do we use your data during the COVID-19 pandemic?

This notice describes how we may use your information to protect you and others during the COVID-19 outbreak.

The health and social care system is facing significant pressures due to the COVID-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations. 

Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak. Using this law the Secretary of State has required NHS Digital; NHS England and Improvement; Arms Length Bodies (such as Public Health England); local authorities; health organisations and GPs to share confidential patient information to respond to the COVID-19 outbreak. Any information used or shared during the COVID-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data. Further information is available on and there are some FAQs on this law are available on the NHSX website

During this period of emergency, opt-outs will not generally apply to the data used to support the COVID-19 outbreak, due to the public interest in sharing information. This includes National Data Opt-outs. However in relation to the Summary Care Record, existing choices will be respected. Where data is used and shared under these laws your right to have personal data erased will also not apply. It may also take us longer to respond to Subject Access requests, Freedom of Information requests and new opt-out requests whilst we focus our efforts on responding to the outbreak.

In order to look after your health and care needs we may share your confidential patient information including health and care records with clinical and non clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111. We may also use the details we have to send public health messages to you, either by phone, text or email.

During this period of emergency we may offer you a consultation via telephone or videoconferencing. By accepting the invitation and entering the consultation you are consenting to this. Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation. 

We will also be required to share personal/confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of protecting public health, providing healthcare services to the public and monitoring and managing the outbreak. Further information about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the COVID-19 response can be found on the NHSX website

NHS England and Improvement and NHSX have developed a single, secure store to gather data from across the health and care system to inform the COVID-19 response. This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital. New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patients themselves. All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation. 

In such circumstances where you tell us you’re experiencing COVID-19 symptoms we may need to collect specific health data about you. Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards. 

We may amend this privacy notice at any time so please review it frequently.


What information do we collect about you?

We only collect the information (“data”) that we need to help us keep you healthy – such as your name, address, next of kin, records of appointments, visits, telephone calls, your health record, treatment and medicines, test results, X-rays and any other information to enable us to care for you.


How do we use your information?


  •  We share your medical records with other health professionals who are involved in providing you with care and treatment. This is only ever on a need-to-know basis and event by event.
  • Some of your data is automatically copied to the Shared Care Summary Record*
  • We share some of your data with local out-of-hours provider
  • Data about you is used to manage national screening campaigns such as flu, cervical cytology and diabetes prevention.
  • Your data about you is used to manage the NHS and make payments.
  • We share information when the law requires us to, for instance when we are inspected or reporting certain illnesses or safeguarding vulnerable people.
  • Your data is used to check the quality of care provided by the NHS.
  • We may also share medical records for medical research


How to access your records?

We encourage patients to sign up to online services (e.g. Patient Access) where you can also access your medical records. Please ask our receptionist for more details.

If you want to see what is written about you, you have a right to access the information we hold on you, but you will need to complete a form called Subject Access Request (SAR). Please ask at reception for a SAR form and you will be given further information. You can also find SAR form on our website ( You can request to view only certain parts of your records if you prefer.

Furthermore, should you identify anything in your record which is incorrect,  you have the right to have the inaccurate data corrected.


Don’t want to share?

You can set your opt-out preferences at 

You can also set your opt-out preferences over the phone by calling 0300 303 5678.

A paper print-and-post form is also available to download at


Have a question?

If you have any questions, ask a member of the surgery team. You can:

  • Contact the practice’s data controller via email at  GP practices are data controllers for the data they hold about their patients.
  • Ask to speak to the Data Protection Champion, Chris Newman


If you’re not happy about how we manage your information

We really want to make sure you’re happy, but we understand that sometimes things can go wrong. If you are unhappy with any part of our data-processing methods, you can complain. For more information, visit and select ‘Raising a concern’.

We always make sure the information we give you is up-to-date. Any updates will be published on our website, in our newsletter and leaflets, and on our posters. This policy will be reviewed in April 2022.


For more information see Our Healthier South East London Privacy Notice

 Lambeth DataNet ​ uses GP patient records to obtain anonymous information to help plan and improve healthcare services in the local area. You have a right to opt out.

 *A Summary Care Record is a way of telling health and care staff important information about a person. It tells staff caring for someone about their medicines and allergies.  This means they can look after the person if they are not at their usual doctor’s surgery.



Local Care Records enable real time sharing and viewing of patient information with secondary care trusts (such as King's College Hospital and Guys & St.Thomas' Hospital) . This should deliver huge benefits to healthcare professionals and patients. 

NHS Digital has a statutory role to collect and process health and social care information which is set out in the Health and Social Care Act 2012.

NHS Digital's fair processing materials, available at  explain and provide further information on:

  • what NHS Digital collects - the types of information the NHS Digital collects and what it's used for
  • personal information choices - your rights regarding care information
  • information requests from organisations - how organisations can ask NHS Digital to collect or provide access to care information
  • assurance bodies and processes - how the information requests NHS Digital receive are carefully looked at
  • examples of benefits that have been realised through the provision of such information including case studies involving breast cancer and diabetes that are available at: 

The NHS Digital is absolutely committed to keeping all of the data it handles safe and secure and applies the same principle to any data that is released outside of the organisation.
Information is only ever shared with organisations that have gone through a strict application process, who can demonstrate they have a legitimate reason to access the data to use it for the benefit of health and care purposes, as per the new protections introduced as part of the Care Act 2014, and who have signed a legally binding agreement. So for example commercial companies cannot receive information for insurance or marketing purposes.
As part of the application process the Data Access Advisory Group, an independent group, hosted by the NHS Digital, considers all applications for data that are identifiable or de-identified for limited access.
The NHS Digital also regularly publishes a register of data releases at:  showing where data has been released, to which organisation and for which purposes.

If you require any further information that is not already covered here, you can  contact HSCIC by email at or by phone on 0300 303 5678. 

© Tree View Designs Ltd 2021