Privacy Notice - eConsult

eConsult is an online service that allows you to contact the practice with medical or administrative requests.

When you use eConsult:

• You provide information about your symptoms or request 
• The system helps the practice understand your needs 
• Your request is reviewed by trained staff 
• You are directed to the most appropriate care (for example, advice, an appointment, or referral) 

eConsult helps the practice manage demand and improve access to care. It supports clinical decision-making but does not replace professional judgement.

Information you submit may be added to your medical record where relevant.

1) Data Controller contact details

All Croydon GP Practices 

2) Data Protection Officer contact details

Contact Laura Watson via email

3) Purpose of the processing

eConsult is used to support the delivery of healthcare services by enabling patients to submit requests online.

The system is used to:

• Collect information about a patient’s symptoms or administrative request 
• Support clinical triage and prioritisation 
• Enable appropriate responses, including advice, appointments, or referrals 
• Improve access to care and manage patient demand 

Information submitted via eConsult is reviewed by appropriately trained staff and forms part of the patient’s medical record where relevant.

4) Lawful basis for processing

We process personal data and special category health data submitted through eConsult under the following lawful bases:

• Article 6(1)(e) – Public task - Processing is necessary for the performance of a task carried out in the public interest, namely the provision of NHS healthcare services.
• Article 9(2)(h) – Provision of health or social care - Processing is necessary for the purposes of preventative or occupational medicine, medical diagnosis, and the provision of health or social care. 

Processing is required for direct care purposes, including triage, assessment, diagnosis, and treatment.

5) Recipient or categories of recipients of the shared data

Information submitted through eConsult may be shared with:

• Authorised clinicians and administrative staff within the practice 
• Other NHS healthcare organisations involved in the patient’s direct care 
• eConsult Health Ltd as the system provider (data processor) 
• Approved IT and hosting providers supporting system infrastructure 

All data sharing is subject to strict contractual, confidentiality, and data protection obligations.

We do not sell personal data or use it for marketing purposes.

6) Rights to object 

You have the right to object to the processing of your personal data in certain circumstances.

However, where processing is necessary for the provision of direct care, this may limit the ability to fully object.

To exercise this right, please contact the Practice or the Data Protection Officer.

7) Right to access and correct

You have the right to:

• Request access to your personal data 
• Request correction of inaccurate or incomplete information 

There is no automatic right to have accurate medical records deleted, except where required by law.

8) Retention period 

Information submitted via eConsult is retained as part of your medical record and managed in accordance with the NHS Records Management Code of Practice.

9) Right to Complain

You have the right to complain to the Information Commissioner’s Office (ICO). You can also raise concerns with the Practice in the first instance.

For further information, please see your NHS data matters