Privacy Notice

How We Use Your Data

We use the information we receive from you, together with information we have obtained from our dealings with you (including in relation to services we provide to you) to continue to allow us to provide services that you request, to communicate with you, and to personalise information sent to us regarding your health from other Health Care Providers. Examples of how we may personalise information include using your information in generating referrals for you, looking at treatment options for you and deciding on further healthcare needs you may have in the future.

We are also a Research Practice and may contact you in regards to research trials that the surgery have been invited to take part in. We may invite you to take part in a study, your information will not be divulged to any research trial without your explicit consent.

Information to be provided where personal data is collected from the data subject

Where personal data relating to a data subject is collected from the data subject, the controller shall, at the time when personal data is obtained, provide the data subject with all of the following information:

  • The identity and the contact details of the controller and, where applicable, of the controller’s representative
  • The contact details of the data protection officer, where applicable
  • The purposes of the processing for which the personal data are intended as well as the legal basis for the processing
  • The recipients or categories of recipients of the personal data, if any;

We do not sell, trade, or rent your personal information to others.

We store all the information you provide us, including information provided via forms you complete on our secure server. Our server is secured in line with GDPR regulations and is fully risk assessed annually. Any new information you provide us may be used to update an existing record we hold for you. If you provide a work or home email address we will not be responsible for third parties having access to any communications we send.

Third parties, for instance pharmacies may deliver some of our products to you, or provide all or part of the service requested by you. In these instances, while the information you provide will be disclosed to them, it will only be used for the administration of the service provided (for instance prescriptions).

We ask for your home and/or mobile phone number, and email address to enable us to contact you in regards to your healthcare.

We make outbound phone calls for a number of reasons including changing of appointments or other administrative tasks. We will only call the number that is contained within your medical record. We cannot call you back to a number that is not contained within the registration portal on your medical record.

We may invite you in for an appointment based on your healthcare needs. We will only ever write to the address that is contained within your medical record. It is important for you to keep us updated of any changes to contact details to ensure that your records are up to date.

If we provide information to a third party it is for healthcare purposes if the party we are sending to process data we will exercise the strictest control over the third party contractually, requiring it and any of its agents and/or suppliers to:

  • maintain the security and confidentiality of the information and restrict access to those of its own employees
  • use the data for the agreed purpose only and prevent it being used for any other purpose by any other party
  • refrain from communicating with you other than concerning the healthcare issue in question
  • once you have left the practice we will hold your data in the timeframe laid down in GDPR regulations

In addition, we will restrict the information disclosed to the absolute minimum necessary, for example, to provide the product or service.

Our own security procedures mean that we may occasionally have to request proof of identity.

In the event of phone calls from you, we also reserve the right to ask security questions (which we in our sole discretion deem appropriate) in order to satisfy ourselves that you are who you say you are.


As a primary care provider and part of the National Health Service we do participate in medical research projects. Please rest assured that your data is not shared with any research provider without your express consent. All research projects are undertaken with NIHR Clinical Research Network or providers that are ISO2700 and ICH-GCP certified and also NHS IG compliant. We also ensure that all research providers adhere fully with the DPA 1988 and GDPR legislation.

Your consent

Before you provide any data to us we will endeavor to make it clear why we need it. As a Health Care Provider we need to use what is called sensitive personal data (this is your medical history). When this is required we will obtain your consent first. Consent is required for each instance of access when the request comes from another data controller or provider that does not process their data in line with that of GDPR Article 9:

processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;

Certain exceptions may be made in regards to the collection of medications by your spouse or nominated person. These exceptions have been fully risk assessed and a copy of this assessment is available upon request. The nominated person must detail on the patient record when picking up a controlled drug.

Links to other sites on our Website

We often link off to other sites to help provide you with extra information or services. For example, to make it easy for you to share information with your family and friends, we provide links to Twitter, Facebook and other popular social media or book-marking sites. But remember, these sites may use cookies that we do not control. So be sure to check how they use your information.

How you can control cookies

If cookies are disabled on your device you will still be able to use most of this site. However it may limit what you can do.

How you manage your cookies depends on your browser. To find out which browser you use:

PC: open your browser and go to the Help menu and then click on the ‘About’ option.

Apple Macintosh: open your browser and go to the Apple menu and then click on the ‘About’ option.

Mobile device: check your settings.

If you would like to know more about cookies you can visit which explains in detail how they can work and can be managed.

Disclosure of information to third parties

As previously mentioned, we do not sell, trade or rent your information, and will never disclose information about you (including information obtained from our dealings with you) to third parties, except:

We may of course be obliged at law to pass on your information to the police or any other statutory or regulatory authority and in some cases, exemptions may apply under the GDPR Act, whereby we can legitimately release personal data as required to by law.

Subject access requests

You have a statutory right of access to accessible personal and/or sensitive personal data that we hold about you. In order to exercise this right, your application must be in writing for security reasons.

Subject Access Requests will be provided free of charge except:

Where requests from a data subject are manifestly unfounded or excessive, in particular because of their repetitive character, the controller may either:

Charge a reasonable fee taking into account the administrative costs of providing the information or communication or taking the action requested; or

Refuse to act on the request.

The controller shall bear the burden of demonstrating the manifestly unfounded or excessive character of the request.

Without prejudice to Article 11 of the Act, where the controller has reasonable doubts concerning the identity of the natural person making the request referred to in Articles 15 to 21, the controller may request the provision of additional information necessary to confirm the identity of the data subject.


Union or Member State law to which the data controller or processor is subject may restrict by way of a legislative measure the scope of the obligations and rights provided for in Articles 12 to 22 and Article 34, as well as Article 5 of GDPR in so far as its provisions correspond to the rights and obligations provided for in Articles 12 to 22, when such a restriction respects the essence of the fundamental rights and freedoms and is a necessary and proportionate measure in a democratic society to safeguard:

National security


Public security

The prevention, investigation, detection or prosecution of criminal offences or the execution of criminal penalties, including the safeguarding against and the prevention of threats to public security

Other important objectives of general public interest of the Union or of a Member State, in particular an important economic or financial interest of the Union or of a Member State, including monetary, budgetary and taxation a matters, public health and social security

The protection of judicial independence and judicial proceedings;

The prevention, investigation, detection and prosecution of breaches of ethics for regulated professions;

A monitoring, inspection or regulatory function connected, even occasionally, to the exercise of official authority in the cases referred to in points (a) to (e) and (g);

The protection of the data subject or the rights and freedoms of others;

The enforcement of civil law claims.

In particular, any legislative measure referred to in the paragraph above shall contain specific provisions at least, where relevant, as to:

The purposes of the processing or categories of processing

The categories of personal data

The scope of the restrictions introduced

The safeguards to prevent abuse or unlawful access or transfer

The specification of the controller or categories of controllers

The storage periods and the applicable safeguards taking into account the nature, scope and purposes of the processing or categories of processing

The risks to the rights and freedoms of data subjects

The right of data subjects to be informed about the restriction, unless that may be prejudicial to the purpose of the restriction

Security of Processing

Taking into account the state of the art, the costs of implementation and the nature, scope, context and purposes of processing as well as the risk of varying likelihood and severity for the rights and freedoms of natural persons, as the controller we shall implement appropriate technical and organisational measures to ensure a level of security appropriate to the risk, including inter alia as appropriate:

The pseudonymisation and encryption of personal data;

The ability to ensure the ongoing confidentiality, integrity, availability and resilience of processing systems and services

The ability to restore the availability and access to personal data in a timely manner in the event of a physical or technical incident;

A process for regularly testing, assessing and evaluating the effectiveness of technical and organisational measures for ensuring the security of the processing.

In assessing the appropriate level of security account shall be taken in particular of the risks that are presented by processing, in particular from accidental or unlawful destruction, loss, alteration, un-authorised disclosure of, or access to personal data transmitted, stored or otherwise processed.

As the controller we shall take steps to ensure that any natural person acting under the authority of us as the controller who has access to personal data does not process them except on instructions from the controller, unless he or she is required to do so by Union or Member State law.

Changes to our privacy policy

If we decide to change our privacy policy, we will update all relevant documentation and post any changes on our websites so that you are always aware of what information we collect, how we use it, and under what circumstances we disclose it.

Internet Data

IP addresses and log file data for the Alcester Health Centre site, does not automatically capture or store personal information, other than logging the user’s IP Address or the location of your computer or network on the Internet, for systems administration and troubleshooting purposes. (If you are connected to the Internet you have an IP address, for example, an IP address might read “”). We do not use IP addresses in the aggregate to track which pages people visit in order to improve the quality of the site.

Data collection and use

You may be asked for personal information if you complete one of the forms on this site. We will only use the information about you for the purpose for which you provide it. Personal information to our website is stored on secure servers. We will never sell or share your personal information with other organisations for their direct marketing purposes without your explicit consent. We do not hold any personal information about you on our website. If you would like further information our data protection officer will be happy to assist you.

Online Registration

When you register with the practice on our site or subscribe to our emails, we ask you for information such as name, address, telephone number, previous GP, etc. This is used only to register you as a patient on our clinical system this information is not kept in any other format or file.


A cookie is a tiny text file that is stored on your computer. We do not use cookies or analytics cookies provided by companies such as Google in order to tailor your experience on our site. We will not access any information stored in a cookie placed by other websites. Our cookies do not contain personally identifiable information, other than your IP address, which itself is only very rarely enough to identify you as an individual.

How we protect your information

Our website has security measures in place to protect against the loss, misuse or alteration of the information under our control. When you contribute online, we use a secure server to protect your personal information during transmission.

Contacting us about privacy

If you have any questions about our privacy policy, the information we have collected from you online, the practices of this site or your interaction with this website, please contact us by calling 01789 763060.