We use cookies to make this site work. We'd also like to set optional cookies so we can understand how the site is used and improve it. We will not set optional cookies unless you accept them. You can change your choice at any time from the Cookie settings link in the footer.
Strictly necessary cookies
These cookies are required for the site to work. They store your cookie preferences and keep your session secure. They are exempt from consent under PECR Regulation 6(4) because they are essential to deliver the service you have requested.
Optional cookies
Optional cookies help us understand how the site is used and provide additional features such as analytics, accessibility tools and translation. We will only set them if you accept.
The Practice is committed to protecting your personal information. This notice explains how we collect, use, and protect your data when using Heidi, a software system designed to support clinical and administrative workflows and communication. Our aim is to ensure transparency and to explain your rights in relation to your personal information.
1) Data Controller contact details
All Croydon GP Practices
2) Data Protection Officer contact details
Contact Laura Watson via email
3) Purpose of the processing
We process your personal data in accordance with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. We rely on several lawful bases for processing.
In most cases, we process data as part of the performance of a public task, meaning it is necessary for providing healthcare services and administrative support within our NHS duties. In some situations, we may seek your consent to process data for specific administrative or educational purposes, and you have the right to withdraw your consent at any time.
We may also process anonymised or pseudonymised data based on our legitimate interests, for example to improve service delivery and efficiency, while ensuring that your privacy is fully protected.
4) Lawful basis for processing
Our lawful basis for processing includes the performance of a public task, which allows us to manage patient care, appointments, and administrative functions as part of our NHS duties. In certain situations, we may rely on your consent to process data for specific administrative or educational purposes, and you have the right to withdraw your consent at any time.
We may also process anonymised or pseudonymised data based on our legitimate interests, such as improving service delivery, staff training, and workflow efficiency, while ensuring that your privacy is fully protected. Finally, we may process your data to fulfil a legal obligation, for example to comply with NHS, regulatory, or statutory requirements.
5) Recipient or categories of recipients of the shared data
Your personal data processed through Heidi may be accessed by authorised staff within the Practice who require it to carry out their duties, including clinical and administrative support personnel.
Certain data may also be shared with Heidi as the service provider, or with other NHS-approved third parties where necessary for patient care, reporting, regulatory compliance, or audit purposes. All recipients are required to maintain strict confidentiality and comply with data protection regulations to ensure that your information is kept secure at all times. We do not share identifiable patient information with third parties for marketing purposes.
6) Rights to object
You have the right to object to the processing of your personal data in certain circumstances. This includes situations where we process your information based on our legitimate interests, for example to improve services, manage administrative workflows, or support staff training.
If you choose to object, we will stop processing your data for these purposes unless we can demonstrate compelling legitimate grounds that override your interests, or if processing is required to comply with a legal obligation. To exercise your right to object, or to find out more about your data protection rights, please contact our Data Protection Officer.
7) Right to access and correct
You have the right to request access to any personal information we hold about you. This allows you to understand what data we process, why we process it, and who it may have been shared with. You also have the right to request that any inaccurate or incomplete information is corrected without undue delay. To exercise your right to access or correct your personal data, please contact our Data Protection Officer. We will respond to your request in accordance with applicable data protection laws and NHS policies.
8) Retention period
We only keep personal data processed through Heidi for as long as it is necessary to fulfil the purposes for which it was collected, including managing patient care, appointments, administrative tasks, and reporting obligations. Once information is no longer required, it is securely deleted or anonymised in line with NHS record-keeping policies and legal requirements. We regularly review the data we hold to ensure it is not kept longer than necessary and that it is stored safely at all times.
9) Right to Complain
You have the right to complain to the Information Commissioner’s Office (ICO).
Please note that the National Data Opt Out does not apply to this sharing of information.