Privacy Notice
Who we are
Castleman Healthcare Ltd is a not-for-profit GP Provider company and a network of 13 GP practices. Our registered address is 18 Kirkway, Broadstone, Dorset BH18 8EE.
The 12 constituent practices which form Castleman Healthcare Ltd. collect, store and use large amounts of personal data every day, such as medical or personal records which may be paper-based or held on a computer.
They take their duty to protect your personal information and confidentiality very seriously and work hard to ensure it is held securely and only accessed on a need to know basis. Each practice within our GP Provider Company will have in place robust confidentiality protocols which, in tandem with this privacy notice, will protect you.
What information does Castleman Healthcare Ltd. hold about you?
As a GP Provider Company no identifiable personal data is held by Castleman Healthcare Ltd. however we work with each of the twelve practices who make up our company and they will hold the following data:
• Name, address, date of birth, next of kin
• Contacts they have had with you such as appointments or visits
• Details of diagnosis and treatment
• Results of x-rays, scans and laboratory tests.
• Allergies and health conditions
• Information from people who care for you and know you well such as health or social care professionals, relatives or carers.
Why our practices collect information about you
Our practices need accurate and up to date information about you so that they can give you the best possible care and make sure they contact you at the right address and phone number. They will check your details with you when you visit them. Please let them know of any changes, for example, to your address or phone number.
Castleman Healthcare Ltd. will only ever collect from practices anonymised data for the purposes of ensuring that the services we run offer you the best possible care and data will only ever be used for auditing purposes. Information may include for example, but not be limited to, the numbers of patients seen by a particular service/practitioner, the number of follow up appointments, referrals into secondary care, the impact of a service on primary care service etc. Different data may be collected for different services and Castleman Healthcare Ltd. will keep you informed of what is being collected.
No personal, identifiable, patient data will be held by Castleman Healthcare Ltd.
How your practice keeps your records confidential
Everyone working for the NHS must comply with the Common Law Duty of Confidence. Information you give in confidence at our GP practices will only be used for the purposes explained to you and to which you consented, unless there are other circumstances covered by the law. All practices comply with the NHS Confidentiality Code of Conduct. All Practice staff are required to protect your information, inform you of how your information will be used, and allow you to decide if and how your information can be shared. All manual and computerised records are stored in secure environments with access strictly controlled. If someone other than you (e.g. a relative or friend) contacts your practice to find out about your care or treatment the practice will not be able to talk to them unless they have your permission (apart from parents/guardians of children who are recorded as next of kin).
As above, Castleman Healthcare Ltd does not hold personal patient data.
How our practices use your personal information
Your records are used by your GP practice to direct, manage and deliver your care so that:
-
Clinical staff involved in your care have accurate and up to date information to assess your health and decide on the most appropriate care for you.
-
Clinical staff have the information they need to assess and improve the quality and type of care you receive.
-
Administrative staff supporting your care can sort out your appointments, deal with queries, produce letters etc.
-
Appropriate information is available if you see another doctor, or are referred to a specialist or another part of the NHS or social care.
They will also use information they hold about you to:
-
Review the care they provide to ensure it is of the highest standard and quality
-
Ensure their services can meet patient needs in the future
-
Investigate patient queries, complaints and legal claims
-
Ensure the GP practice receives payment for the care you receive
-
Prepare statistics on NHS performance
-
Audit NHS accounts and services
-
Undertake heath research and development (with your consent – you may choose whether or not to be involved)
-
Help train and educate healthcare professionals.
They may use your telephone number(s) to send your appointment details via a SMS text message a few days before your appointment. Most patients appreciate these reminders and it helps to reduce the number of missed appointments, but if you do not wish to receive them please let your practice know.
Your practice may use your details to ask you to complete patient satisfaction surveys about the services and care you have used in your practice and if the service is run by Castleman Healthcare Ltd your practice will provide us with your feedback but this will be done in an anonymised format. This is to improve the way we deliver healthcare to you and other patients. We will not contact you with marketing material.
When do we and your practice share information about you?
Direct care purposes:
Unless you object, your practice will normally share information about you with other health and social care professionals directly involved in your care so that you may receive the best quality care. For example, if your practice were to refer you to a hospital or for another service such as physiotherapy, they will give that service relevant information about you and your condition.
You may be receiving care from other people as well as the NHS, for example Social Care Services. Your practice may need to share some information about you with them so everyone can work together for your benefit. They will only do this when they have a genuine need for it or they have your permission. There are exceptional circumstances when they have to share information, for example, when either your or somebody else’s health and safety is at risk; or they have to by law e.g. for certain infectious diseases, child or adult safeguarding, formal court order, or where a serious crime has been committed.
Where patient information is shared with other organisations they will put in place an information sharing agreement to ensure we are sharing your information legally and securely.
Indirect Care Purposes:
Your practice may also be asked by other statutory bodies to share basic information about you, such as your name and address, but not sensitive information from your health records. This will only be done if this is required by law. Normally where they are not using your information for your direct care, your practice will anonymise the information i.e. strip out anything that can identify you.
As Castleman Healthcare Ltd does not hold any patient data we will never be able to share information directly, although as stated above our practices may send us anonymised data for said purposes.
We are required by Articles in the General Data Protection Regulations to provide you with the information as below:
Data Protection Officer Contact Details
James Leyland – james.leyland@dorset.nhs.uk
Purpose of the processing
Direct Care is care delivered to the individual alone, most of which is provided in the GP practice or a clinical service hosted by the GP practice and our GP practices host services for Castleman Healthcare Ltd. After a patient agrees to a referral for direct care elsewhere, such as a referral to a specialist in a hospital, necessary and relevant information about the patient, their circumstances and their problem will need to be shared with the other healthcare workers, such as specialist, therapists, technicians etc.
The information that is shared is to enable the other healthcare workers to provide the most appropriate advice, investigations, treatments, therapies and/or care.
Lawful basis for processing
The processing of personal data in the delivery of direct care and for providers’ administrative purposes in support of direct care elsewhere is supported under the following Article 6 and 9 conditions of the GDPR:
Article 6(1)(e) ‘…necessary for the performance of a task carried out in the public interest or in the exercise of official authority…’.
Article 9(2)(h) ‘necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services…”
We will also recognise your rights established under UK case law collectively known as the “Common Law Duty of Confidentiality”.
Recipient of Categories of Recipients of the processed data
The data will be shared with health and care professionals and support staff in your GP surgery or clinical service and at hospitals, diagnostic and treatment centres who contribute to your personal care.
Your right to object to recording or sharing information
You have the right to object to some or all the information being processed under Article 21. Please contact the Data Controller of Castleman Healthcare Ltd. James Leyland on the contact details above should you need further information. You should be aware that this is a right to raise an objection. This is not the same as having an absolute right to have your wishes granted in every circumstance.
If you feel that you are being asked for information you would prefer not to have recorded, or have concerns about how it is used or shared, please let your GP practice know and they will record this in your records so that all staff involved in your care are aware of your decision. Please be aware that if you make this choice, it may make it difficult to give you treatment so talk this through with your GP practice thoroughly so that they can let you know of any potential impact. You can also change your mind at any time about a disclosure decision.
If you think any information held about you is inaccurate please let your practice know. If your GP practice is concerned that by changing your information it could cause you or our/their staff harm they may not change the information, but they will document your objection in your records.
Your individual rights are;
• the right to be informed;
• the right of access;
• the right to rectification;
• the right to erasure;
• the right to restrict processing;
• the right to data portability;
• the right to object; and
• the right not to be subject to automated decision-making including profiling.
How you can access your records
The General Data Protection Regulation 2017 gives you a right to access the information held about you (unless an exemption applies). Requests can be made verbally or in writing and no fees will be chargeable. You should contact your GP practice for this data. They will provide your information to you within 30 days. Requests which are manifestly unfounded or excessive could be refused or a reasonable fee charged. If a request is refused your practice will inform you as to reasons why within one month and you have the right to complain to the supervisory authority.
Castleman Healthcare Ltd holds no patient records however.
How long is your data retained?
Your data will be retained in line with the law and national guidance.
Further information and useful contacts
If you have any queries or concerns about how we use your information please contact:
James Leyland – james.leyland@dorset.nhs.uk
CASTLEMAN HEALTHCARE LTD
18 Kirkway
Broadstone
Dorset
BH18 8EE
Information Commissioners Office:
You have a right to complain to the Information Commissioner if ever you are unsatisfied with the way the practice or Castleman Healthcare Ltd has handled or shared your personal information. Visit: https://ico.org.uk/concerns/.
Tel: 0303 123 1113.
There are National Offices for Scotland, Northern Ireland and Wales, (see ICO website).