This notice explains how Premier Medical Centre collects, uses, stores and shares your personal information. Please read it carefully. If you have questions, contact our Data Protection Officer using the details below.
1. Who We Are
Premier Medical Centre is an NHS GP practice in England. We are the 'Data Controller' for the personal information we hold about you — this means we decide how and why your information is used.
We're registered with the Information Commissioner's Office (ICO) as a Data Controller. You can check this on the ICO's public register at ico.org.uk.
2. What Information We Collect
We collect and hold information about you so we can give you safe, effective healthcare. This includes:
Personal information
- ›Your full name, date of birth, address and contact details
- ›Your NHS number and GP registration details
- ›Next of kin and emergency contact details
- ›How you'd like us to contact you
Health and clinical information
- ›Your medical history, diagnoses, conditions and symptoms
- ›Medications, prescriptions and allergies
- ›Test results, referral letters and clinical correspondence
- ›Mental health and safeguarding information, where relevant
- ›Information about your lifestyle that affects your health
Administrative information
- ›Appointment and attendance records
- ›Insurance and third-party requests (for example, solicitor letters or occupational health reports)
- ›Complaints and feedback you've sent us
3. Our Legal Basis for Using Your Data
Data protection law says we must have a lawful reason for using your personal data. Because health information is extra sensitive, we also need to meet an additional condition for that.
In plain terms: we mainly use your information to provide care. We also use it to meet legal duties, like reporting some diseases. Lastly, it helps the NHS plan and improve services. The table below shows the specific legal basis for each purpose, for reference.
4. How We Use Your Information
4.1 For your direct care
The main reason we use your information is to give you safe, effective, personal care. This includes talking with you, prescribing medication, making referrals, and working with other NHS services on your care.
4.2 Care outside our practice
When needed, we share relevant parts of your record with other healthcare professionals involved in your care, including:
- ›NHS hospital trusts and specialist services
- ›Community nursing and other health professionals
- ›Mental health services
- ›Out-of-hours GP services and urgent care centres
- ›Ambulance services
- ›Social care services, where this is part of your clinical care
- ›Emergency services, where this is part of your clinical care
4.3 NHS planning and commissioning
We're required by law to share some information with NHS England and our Integrated Care Board, to help plan and run health services. This data is looked at across many patients together, and identifying details are removed wherever possible.
4.4 Safeguarding
If we believe a child or vulnerable adult is at risk of harm, we have a legal and professional duty to share information with the right authorities — even without your consent, if this is needed to protect someone's safety.
4.5 Public health
We share data with Public Health bodies. We also work with NHS England and local councils. This helps us track diseases, and supports screening and vaccines. we report infectious diseases too. This is required by law.
4.6 Risk stratification
Our Integrated Care Board uses anonymised patient data to spot patients who may be at risk of an unplanned hospital stay, so we can offer support earlier. This is allowed under a specific law (Section 251 of the NHS Act 2006). You can opt out of this — just speak to reception.
4.7 Research and audit
We may use anonymised data to support medical research and to help the NHS improve its services. We remove identifying details wherever we can. If a research project needs to identify you personally, we'll ask for your clear consent first, unless the law allows otherwise.
4.8 AI-assisted tools
We use a small number of AI tools to help with administrative and clinical tasks. These tools work under our instruction, and we have Data Processing Agreements in place with each of them. This includes:
- ›Transcribing consultations to help keep accurate clinical notes. The text is copied into our clinical system and then deleted from the tool straight away. Heidi doesn't keep a copy of the recording or transcript.
- ›Helping process lab results, prescriptions and patient registrations, to reduce paperwork and support timely clinical review (GP Automate).
- ›Helping direct patients to the right care through online triage and appointment requests (Blinx).
No decision about your care is ever made by AI alone. Every output from these tools is checked by a qualified member of our clinical or admin team before any action is taken. If you'd like a person to review any AI-assisted step in your care, just ask us.
5. Who We Share Your Data With
We only share your information where we have a proper legal reason to. The organisations we may share with include:
We never sell your personal data. We never share it for marketing. We never send it outside the United Kingdom. Wherever a third-party tool processes your data, we make sure a proper agreement is in place and the right safeguards are used.
6. Opting Out of Wider Data Use
The NHS sometimes uses patient data for things beyond your direct care — like research and planning. You have the right to opt out of this.
Type 1 Opt-Out
This stops your data being shared from our records for anything beyond your direct care. To set this up, speak to our reception team or ask for a form at the practice.
National Data Opt-Out
This stops NHS England from sharing your identifiable data with other organisations for research and planning. You can set this up online at your-data.england.nhs.uk, or by calling 0300 303 5678.
How to opt out
Type 1 Opt-Out: speak to our reception team or ask for a form at the practice.
National Data Opt-Out: visit your-data.england.nhs.uk or call 0300 303 5678.
You can turn either opt-out on or off at any time.
7. How Long We Keep Your Data
We keep your records in line with NHS rules on how long to hold them. As a general guide:
Full details of NHS retention rules are at england.nhs.uk/publication/corporate-records-retention-disposal-schedule-guidance.
8. Your Rights
Under data protection law, you have a number of rights over your own personal data. In a healthcare setting, some of these may be limited where there's a legal duty to keep information, or where releasing it could cause harm.
To use any of these rights, contact our Data Protection Officer (see Section 1). We'll respond within one calendar month. Most requests are free.
Accessing your medical records
You can view your GP record online through the NHS App.
You can also ask in writing for a Subject Access Request. We'll provide your records within one month.
9. How We Protect Your Information
We take keeping your data safe seriously. This includes:
- ›All staff sign confidentiality agreements when they join us
- ›Access to patient records is controlled and limited by role
- ›Our clinical system (EMIS) is hosted on secure, NHS-approved infrastructure
- ›All our electronic messages use NHS Mail, a secure NHS-approved email system
- ›Paper records are stored securely with limited access
- ›All staff receive regular training on handling information safely
- ›We follow the NHS Data Security and Protection Toolkit (DSPT)
- ›Every third-party tool we use has been checked and approved in line with NHS information governance rules, including the DSPT
If a data breach happens that could put your rights at risk, we're legally required to tell the ICO within 72 hours, and to tell you directly where appropriate.
10. Cookies and Our Website
Our website (premiermedicalcentre.nhs.uk) uses cookies. These are small files saved on your device to help it work properly and, with your permission, to help us understand how the site is used. We use:
- ›Essential cookies are needed for the website to work properly (for example, remembering your cookie choice). These cannot be switched off.
- ›Analytics cookies help us understand how visitors use the site, so we can improve it (this data is anonymised). We only set these if you accept them.
When you first visit our website, you'll see a cookie banner asking you to accept or reject analytics cookies. We won't set analytics cookies unless you accept. You can change your choice at any time using the "Cookie settings" link in the footer of any page.
You can also control cookies through your browser settings, though turning off essential cookies may stop parts of the site working properly.
11. How to Raise a Concern
If you're concerned about how we handle your personal data, please contact our Data Protection Officer first:
If you're still unhappy after contacting us, you can complain to the Information Commissioner's Office (ICO):
You also have the right to take legal action if you believe your rights have been breached.
12. Changes to This Notice
We review this privacy notice regularly. If we make any significant changes, we'll let patients know via our website and noticeboards at the practice. The latest version is always available at premiermedicalcentre.nhs.uk and from reception, on request.
Version 1.0 | Last reviewed: May 2026 | Next review: May 2027
Approved by: Roopa Rawal, Patient & Employee Experience Lead | Seema Ussene, Practice Manager
Premier Medical Centre — nhsnwl.premiermedicalcentre@nhs.net — 020 3728 2551
For more about your rights and how the NHS uses your data: england.nhs.uk/contact-us/privacy/privacy-notice/your-information/