1. Your Privacy

Romsey Medical Practice is committed to protecting your privacy and handling your personal information lawfully, fairly, and transparently.

We collect and use personal information only where necessary to:

  • Provide safe, effective and appropriate healthcare
  • Manage appointments, reminders and clinical results
  • Communicate with you regarding your care
  • Meet our legal, regulatory and professional obligations

This Privacy Policy explains how and why we collect your information, how it is used, how it is stored, and when it may be shared.

 

2. What Is Personal Information?

In a healthcare setting, personal information may include:

  • Name, date of birth, address, telephone number and email address
  • NHS number (where applicable)
  • Appointment records and attendance history
  • Medical history, diagnoses, test results and treatment records
  • Family or social information relevant to your care
  • Payment records relating to services provided

We do not store card payment details. Payments are processed securely through approved providers.

We may also receive relevant clinical information from other healthcare professionals involved in your care.

 

3. Lawful Basis for Processing

Under UK GDPR and the Data Protection Act 2018, we process your data under:

Article 6 (Lawful Basis)

  • Performance of a contract (provision of healthcare services)
  • Legal obligation
  • Legitimate interests (practice administration)
  • Consent (where applicable)

Article 9 (Special Category Data – Health Information)

  • Provision of health or social care (Article 9(2)(h))
  • Public interest in public health (where applicable)
  • Explicit consent (where required for non-clinical purposes)

 

4. How We Use Your Information

We use your information to:

  • Provide safe, personalised medical care
  • Maintain accurate clinical records
  • Communicate results and follow-up advice
  • Make referrals where appropriate
  • Send appointment confirmations/reminders (with consent)
  • Manage billing and payments
  • Improve our services through feedback

Electronic correspondence and referrals are transmitted securely and encrypted where appropriate.

 

5. Newsletters and Service Updates

We may send service updates or newsletters containing:

  • Changes to services
  • Health information
  • Practice announcements

You will only receive these if you opt in. You may withdraw consent at any time.

 

6. Storage and Security

Your information is stored securely using approved clinical systems including:

  • Pabau Practice Management System

We implement appropriate technical and organisational measures including:

  • Role-based access controls
  • Encryption where appropriate
  • Secure cloud hosting
  • Regular system updates
  • Staff confidentiality training

Access is limited to authorised personnel only.

 

7. Retention of Records

Clinical records are retained in accordance with NHS Records Management Code of Practice and professional guidance:

  • Adults: Minimum 11 years after last contact
  • Children: Until age 25 (or 26 if 17 at last treatment)
  • Financial records: Retained in line with tax and legal requirements

Records are securely deleted when no longer required.

 

8. Disclosure of Information

Confidential information will only be shared where there is a lawful basis.

We may share information:

  • With your consent
  • With other healthcare professionals involved in your care
  • Where required by law or court order
  • To prevent serious harm
  • For safeguarding purposes

All disclosures are documented.

 

9. Public Interest Disclosures

In rare cases, information may be disclosed without consent where:

  • There is a risk of serious harm
  • There is a safeguarding concern
  • It is required to prevent serious crime

Such disclosures are made in accordance with professional and legal guidance.

 

10. NHS-Related Sharing

Where relevant, information may be shared with:

  • NHS hospitals for referrals
  • NHS England for payment or regulatory purposes
  • Laboratories or imaging providers

All sharing is lawful, proportionate and secure.

 

11. Your Rights

Under UK GDPR, you have the right to:

  • Access your records (Subject Access Request)
  • Request correction of inaccurate data
  • Request restriction of processing
  • Object to certain processing
  • Request erasure (where legally possible)
  • Withdraw consent (where processing relies on consent)

Subject Access Requests (SARs)

Requests must be made in writing or by email.
Proof of identity may be required.

We respond within one calendar month of receiving a valid request.

There is no charge unless the request is manifestly unfounded or excessive.

 

12. Standards for Clinical Record Keeping

We ensure that records are:

  • Accurate and contemporaneous
  • Dated and attributable to the clinician
  • Professional and objective
  • Secure and confidential

 

13. Communication Preferences

You may update your communication preferences at any time.

If we have had no contact with you for two years, we may contact you to confirm your preferences.

 

14. Cookies

Our website may use cookies to improve functionality.

You may disable cookies via your browser settings, though some features may be limited.

 

15. Updates to This Policy

We may update this Privacy Policy to reflect legal or operational changes.

The latest version is available on request or at the practice.

 

16. Contact Details

Romsey Medical Practice
4 Eastwood Court
Broadwater Road
Romsey
SO51 8JJ

Email: info@romseymedicalpractice.co.uk
Telephone: 01794 278110

If you are unhappy with how your information is handled, you may contact:

Information Commissioner’s Office (ICO)
www.ico.org.uk