Privacy Notice – X-On

The Practice is committed to protecting your privacy and handling your personal information in a secure and lawful way. This notice explains how we use the X-on telephone and communications system to support our surgery operations and patient care. The Practice is the Data Controller for the personal data we process.

1) Data Controller contact details

All Croydon GP Practices

2) Data Protection Officer contact details

Contact Laura Watson via email

3) Purpose of the processing

The Practice uses X-on to manage telephone communications, online booking, call handling, and other patient contact services. This system helps the practice efficiently manage appointments, call patients with reminders or important information, and improve access to our services. X-on enables secure handling of call data and communications in line with NHS standards and data protection law.

4) Lawful basis for processing

The legal basis is:  

• Article 6(1)(c) “processing is necessary for compliance with a legal obligation to which the controller is subject.” 
• Article 9(2)(h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services on the basis of Union or Member State law or pursuant to contract with a health professional and subject to the conditions and safeguards referred to in paragraph 3;”

5) Recipient or categories of recipients of the shared data

Personal data processed through X-on may be shared securely with authorised staff within the practice who need access to this information to provide care and manage patient communications. 

In certain circumstances, information may also be shared with other NHS healthcare providers involved in your care, such as hospitals or community services, to ensure coordinated treatment and safe healthcare delivery. 

Data is not shared with commercial organisations for marketing purposes.

6) Rights to object 

Under the UK General Data Protection Regulation (UK GDPR), you have the right to object to the processing of your personal data where we rely on certain lawful bases, such as processing necessary for administrative purposes or direct communications. If you wish to object, the practice will carefully consider your request and will only continue processing your data where we have compelling legitimate reasons or where it is necessary to provide healthcare services. To exercise this right, you can contact the practice directly.

7) Right to access and correct

You have the right to access the data that is being shared and have any inaccuracies corrected. There is no right to have accurate medical records deleted except when ordered by a court of Law.

8) Retention period

Information processed through X-on, including call records, appointment details, and related communications, is retained in line with the NHS Records Management Code of Practice. Records are kept only for as long as necessary to provide healthcare services, manage appointments, and support operational needs. Once retention periods have been met, data is securely deleted or anonymised in accordance with NHS-approved retention schedules and local information governance policies.

9) Right to Complain

You have the right to complain to the Information Commissioner’s Office (ICO).

Please note that the National Data Opt Out does not apply to this sharing of information.

For further information, please see your NHS data matters