Privacy Notice - Brave AI

There may be occasions where we use artificial intelligence (AI) tools, such as Brave AI, to support administrative efficiency, documentation, or clinical workflows. These tools are used in a controlled and secure manner and are not intended to replace clinical judgement.

Where AI tools are used, we ensure that any patient information shared is limited to what is necessary and appropriate. Wherever possible, data is anonymised or pseudonymised before being processed. 

In situations where identifiable information is required, this is done in line with strict data protection and confidentiality requirements. We remain fully responsible for any decisions made regarding your care. AI outputs are always reviewed by a qualified healthcare professional.

1) Data Controller contact details

All Croydon GP Practices

2) Data Protection Officer contact details

Contact Laura Watson via email

3) Purpose of the processing

Brave AI may be used to support:

• Clinical documentation (e.g. summarising consultations or drafting notes) 
• Administrative tasks (e.g. drafting letters or reports) 
• Improving efficiency and reducing administrative burden on staff 

The purpose of using AI is to enhance patient care and operational effectiveness, not to make automated clinical decisions.

4) Lawful basis for processing

This is a Direct Care purpose where applicable. The lawful bases include:

• Article 6 UK GDPR: 6(1)(e) – Public task 
• Article 9 UK GDPR: 9(2)(h) – Provision of health or social care 

We also recognise your rights under the Common Law Duty of Confidentiality, meaning your information will only be used where there is a lawful basis or appropriate consent.

5) Recipient or categories of recipients of the shared data

Where Brave AI is used, data may be processed by:

• Approved AI service providers (acting as Data Processors) 
• Healthcare professionals involved in your care 

We ensure that all providers meet UK GDPR and NHS data security standards. Data is not used for marketing or sold to third parties.

6) Rights to object

You have the right to object to the use of your information in AI-supported processes where this is not essential for your care.

If you wish to object, please contact the practice. We will consider your request and ensure your preferences are respected wherever possible.

7) Right to access and correct

You have the right to:

• Access your personal data 
• Request correction of inaccurate information 

If AI has been used in processing your information, this forms part of your medical record and can be accessed through a Subject Access Request.

There is no right to delete accurate medical records except where legally required.

8) Retention period 

Your data will be retained in line with the NHS Records Management Code of Practice. AI-generated content that forms part of your health record will be retained as part of that record.

9) Right to Complain

You have the right to complain to the Information Commissioner’s Office (ICO).