Privacy Notice - Arden’s Manager

The Practice is committed to protecting your personal information and ensuring it is handled securely and lawfully. This privacy notice explains how we use Ardens Manager to support the safe and efficient delivery of healthcare services. The Practice is the Data Controller for the personal information processed using Ardens Manager.

1) Data Controller contact details

All Croydon GP Practices 

2) Data Protection Officer contact details

Contact Laura Watson via email

3) Purpose of the processing

We use Ardens Manager to support the safe and effective delivery of healthcare services, including managing clinical templates, maintaining accurate patient records, supporting audits, and assisting with administrative and operational tasks within the surgery. 

This ensures that patient care is coordinated, consistent, and delivered in line with NHS standards, while also helping the practice meet legal and quality requirements.

4) Lawful basis for processing

The legal basis is:  

• Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”
• Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;”

5) Recipient or categories of recipients of the shared data

Personal data processed through Ardens Manager may be accessed by authorised staff within the practice who require the information to provide care or carry out administrative tasks. 

Where necessary for your treatment, information may also be shared securely with other NHS healthcare providers involved in your care, such as hospitals or community services, and with the NHS Integrated Care Board (ICB) to support care coordination and service management. 

Your personal data is not shared with commercial organisations for marketing purposes.

6) Rights to object 

Under the UK General Data Protection Regulation (UK GDPR), you have the right to object to the processing of your personal data where we rely on certain lawful bases, such as processing necessary for administrative purposes or direct communications. If you wish to object, the practice will carefully consider your request and will only continue processing your data where we have compelling legitimate reasons or where it is necessary to provide healthcare services. 

To exercise this right, you can contact the practice directly.

7) Right to access and correct

Under the UK General Data Protection Regulation (UK GDPR), you have the right to access the personal information the practice holds about you. You can request a copy of your data and review how it is being used. If any information is inaccurate or incomplete, you also have the right to request that it be corrected. To exercise these rights, you can contact the Practice directly.

8) Retention period 

Information processed through Ardens Manager, including patient records, clinical templates, audit data, and administrative information, is retained only for as long as necessary to provide healthcare services and meet legal and operational requirements. Patient records are generally kept for at least 10 years after the last patient contact, or longer for children until their 25th birthday, in line with the NHS Records Management Code of Practice. 

9) Right to Complain

You have the right to complain to the Information Commissioner’s Office (ICO).

Please note that the National Data Opt Out does not apply to this sharing of information.

For further information, please see your NHS data matters