Privacy Notice - NHS Office 365

The Practice is committed to protecting your privacy and ensuring your personal information is handled securely and lawfully. This privacy notice explains how we use NHS Office 365 (O365) in the course of delivering healthcare services and managing our practice operations.

1) Data Controller contact details

All Croydon GP Practices 

2) Data Protection Officer contact details

Contact Laura Watson via email

3) Purpose of the processing

We use NHS Office 365 to securely manage and communicate patient and staff information, support the delivery of healthcare services, coordinate care with other NHS providers, and carry out administrative and operational tasks necessary for running the surgery.

4) Lawful basis for processing

The legal basis is:  

• Article 6(1)(e) “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.
• Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;”

5) Recipient or categories of recipients of the shared data

We use NHS Office 365 to securely manage and communicate patient and staff information, support the delivery of healthcare services, coordinate care with other NHS providers, and carry out administrative and operational tasks necessary for running the practice. 

Personal data may be shared securely with other NHS healthcare providers directly involved in your care, with the NHS Integrated Care Board (ICB) and NHS England for care coordination and operational purposes, and with authorised staff within the surgery for clinical and administrative reasons. Data is not shared with commercial organisations for marketing purposes.

6) Rights to object 

You have the right to object to some or all the information being shared. Please contact our Data Protection Officer. 

7) Right to access and correct

You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.

8) Retention period 

Patient records and related information stored in NHS Office 365 are retained in line with the NHS Records Management Code of Practice. 

This means clinical records are generally kept for at least 10 years after the last patient contact (or longer for children, usually until their 25th birthday), and staff or administrative records are kept according to NHS and legal requirements. Emails and documents in NHS Office 365 are retained according to NHS-approved retention schedules and local information governance policies.

9) Right to Complain

You have the right to complain to the Information Commissioner’s Office (ICO).

Please note that the National Data Opt Out does not apply to this sharing of information.

For further information, please see your NHS data matters