We use cookies to make this site work. We'd also like to set optional cookies so we can understand how the site is used and improve it. We will not set optional cookies unless you accept them. You can change your choice at any time from the Cookie settings link in the footer.
Strictly necessary cookies
These cookies are required for the site to work. They store your cookie preferences and keep your session secure. They are exempt from consent under PECR Regulation 6(4) because they are essential to deliver the service you have requested.
Optional cookies
Optional cookies help us understand how the site is used and provide additional features such as analytics, accessibility tools and translation. We will only set them if you accept.
Data Protection Privacy Notice
How we use your personal information
At St Fillans Medical Centre, we take your privacy seriously. We are responsible for keeping your personal and health information safe and for using it appropriately and lawfully.
This privacy notice explains what information we collect about you, why we use it, who we may share it with and your rights.
Who is responsible for your information?
St Fillans Medical Centre is the Data Controller for the personal information we hold about our patients. This means we are responsible for deciding how your information is collected, used and protected.
If you have any questions about how we use your information, please contact the practice
What information do we hold about you?
To provide you with safe and effective healthcare, we keep information about you which may include:
- your name, address, date of birth and contact details
- your NHS number
- details of appointments and consultations
- medical conditions and diagnoses
- medicines, allergies and vaccinations
- test results and investigations
- referrals and correspondence from hospitals and other healthcare services
- information about your physical and mental health
- information about your family or carers where relevant to your care
- information provided by other health and care organisations
- information about your communication or accessibility needs.
We may also hold other sensitive information (such as religious beliefs, ethnicity, sexuality) where it is relevant to your healthcare.
Information may be collected directly from you or received from other organisations involved in your care.
Why do we use your information?
The main reason we use your information is to provide you with healthcare.
This includes:
- assessing and treating you
- managing appointments, prescriptions and referrals
- sharing relevant information with other professionals involved in your care
- managing long-term conditions and preventative healthcare
- contacting you about your care
- maintaining an accurate medical record
- ensuring the safety and quality of the care we provide.
We may also use information for other legitimate NHS purposes, including:
- clinical audit and quality improvement
- managing and planning NHS services
- protecting public health
- safeguarding children and vulnerable adults
- investigating complaints or concerns
- meeting our legal and regulatory responsibilities
- research, where appropriate safeguards and legal requirements are met.
Where possible, information used for planning, audit or research will be anonymised so that you cannot be identified.
What allows us to use your information?
We do not usually rely on your consent to use your information to provide NHS healthcare.
Under UK data protection law, we generally use your personal information because it is necessary for the performance of a task carried out in the public interest or in the exercise of official authority.
Health information is classed as special category data. We are permitted to use this where it is necessary for the provision and management of health or social care. There may also be circumstances where we have a legal obligation to use or disclose information, where it is necessary to protect someone's vital interests, or where another lawful basis applies.
Where we rely specifically on your consent for a particular use of your information, we will make this clear to you. You can withdraw that consent at any time.
Who might we share your information with?
We only share information where there is a lawful reason to do so and, wherever possible, only share the information that is necessary.
Depending on your care, this may include:
- hospitals and NHS trusts
- other GP practices
- community health services
- pharmacies
- mental health services
- ambulance services
- NHS England
- NHS Lancashire and South Cumbria Integrated Care Board
- our Primary Care Network and healthcare professionals working on its behalf
- local authorities and social care services
- organisations providing services on our behalf
- regulators and other organisations where we have a legal obligation to provide information
When another organisation processes information on our behalf, appropriate agreements and safeguards must be in place to protect your information.
We may sometimes be required by law to provide information without your consent, for example where there is a legal requirement, court order, serious safeguarding concern or certain public health requirement.
We will not sell your personal information.
Sharing information for your care
Healthcare professionals sometimes need access to information held in your GP record so that they can provide you with safe and appropriate care. This may include professionals working in hospitals, urgent care services, community services, pharmacies and other GP practices.
Systems such as GP Connect may be used to allow authorised health and care professionals to access relevant information from your GP record for your direct care.
Access to your information is controlled and should only take place where there is an appropriate reason.
Using information for research and planning
Information from health and care records can also help the NHS to:
- plan and improve services
- monitor the safety and quality of care
- understand diseases and health trends
- develop new treatments
- carry out approved research
Where possible, anonymised information is used.
National data opt-out
You have a choice about whether your confidential patient information can be used for research and planning. The National Data Opt-Out allows you to opt out of your confidential patient information being used for these purposes, subject to certain legal exemptions.
Your choice does not affect the information used to provide your individual care.
You can find out more, check your choice or change it at any time through the NHS website
How do we keep your information safe?
Everyone working for the NHS has a legal and professional responsibility to keep information about you confidential.
We use appropriate technical and organisational safeguards to protect your information. These include secure NHS computer systems, access controls, staff training, confidentiality requirements and monitoring of access to patient records.
Staff should only access information they need to carry out their role.
How long do we keep your information?
We keep health records in accordance with NHS records management requirements and other applicable legal and regulatory requirements. Different types of information have different retention periods. Information is securely destroyed when it is no longer required and it is appropriate to do so.
Your rights
Data protection law gives you a number of rights regarding your personal information. Depending on the circumstances, these can include the right to:
- know how your information is being used
- request access to the information we hold about you
- ask us to correct inaccurate or incomplete information
- object to certain uses of your information
- ask us to restrict how your information is used
- request the deletion of information in certain circumstances
- request transfer of information in certain circumstances
- withdraw consent where we are relying on consent
Some of these rights are limited when information is held as part of your medical record or where we have a legal reason to continue processing it.
Accessing your medical record
You have the right to request access to the information held in your medical record. This is known as a Subject Access Request (SAR).
You can contact the practice if you would like to request a copy of your records or discuss access to your medical information.
You may also be able to view parts of your GP health record through the NHS App
Your right to object
You have the right to object to certain ways in which we use your personal information.
If you have concerns about how your information is being used or shared, please contact the practice. We will explain whether we are able to stop the processing or whether there is a legal or clinical reason why it needs to continue.
Information about children
Children and young people have the same rights over their personal information as adults.
Whether a parent or guardian can access a child's medical information will depend on factors including the child's age, capacity and the circumstances of the request.
We have a duty to protect the confidentiality of children and young people as well as adults.
Website and cookies
Our website may use cookies to help it function correctly and to understand how people use the site.
Where cookies are not essential, we will ask for your permission before using them.
Please see our Cookie Policy for further information.
Changes to this privacy notice
We may update this privacy notice when our services, systems or legal requirements change.
The latest version will always be available on our website.
Last reviewed: September 2026
Questions or concerns about your information
If you have any questions about this privacy notice or how we use your personal information, please contact:
- Information Governance Lead: Laura Scarborough, Managing Partner
- Caldicott Guardian: Peter Flowers, GP Partner
St Fillans Medical Centre
2 Liverpool Road
Penwortham
Preston
Lancashire
PR1 0AD
- Telephone: 01772 585451
- Contact us online
You can also contact our Data Protection Officer:
- Data Protection Officer: Umar Sabat, IG-Health
- Email: umar.sabat@ig-health.co.uk
Making a complaint about how your information has been used
If you are unhappy about the way we have handled your personal information, please contact us in the first instance so that we can investigate your concerns.
You also have the right to raise a concern with the Information Commissioner's Office (ICO), the UK's independent regulator for data protection.