At Friends Medical Service, we are committed to protecting the privacy and security of your data. This notice explains how we collect and use your personal information during and after your treatment, your legal rights, and how the law safeguards you. It is important to read this alongside any other privacy notices or consent requests we provide so you understand how and why your data is used. We will never share your information outside our health partner organisations without your explicit consent, except in exceptional circumstances (e.g., risks to health/safety, legal obligations, or statutory functions).
# Your information, what you need to know
This privacy notice explains why we collect information about you, how it may be used and how we keep it safe and confidential.
## Why we collect information about you:
Health care professionals who provide care must maintain records about your health and any treatment or care you have received. These records help to provide you with the best possible healthcare. We collect and hold data for the sole purpose of providing healthcare services to our patients. In this role, we may collect information about you, which helps us respond to your queries or secure specialist services. We may keep your information in written form and/or digital form. The records may include basic details about you, such as your name and address. They may also contain more sensitive information about your health and information such as outcomes of needs assessments.
## The kind of data we hold about you:
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the person’s identity has been removed (anonymous data).
Certain types of sensitive personal data require more protection, such as information about a person’s health, religion, or race, which are called “special category data.”
We will collect, store, and use the following categories of your data:
– **Contact Data** – personal contact details such as name, title, addresses, telephone numbers, and email addresses.
– **Identity Data** – personal details such as date of birth, gender, marital status, photographic ID, next of kin, emergency contact information and dependents.
– **Private Medical Insurance Data** – medical insurance details, including membership numbers and compensation history.
– **Financial Data** – payment information, including invoices, payment methods, bank/card details and billing address.
– **Image Data** – Our CCTV shall collect visual images, personal appearances, and behaviour of individuals (but not sound) when patients attend the publicly accessible parts of our property. For the avoidance of doubt, there are no CCTV cameras within the consulting rooms, wards, or theatres on our property.
– **Audio Data** – recordings of phone calls taken for training and complaint management purposes.
– **Personal Views** – your feedback and responses to our patient satisfaction survey, should you provide exact details of any complaint you submit.
– **Any further information that you choose to tell us.**
We will also collect, store and use the following more sensitive types of personal data:
– **Health Data** – details of your health comprising records, records of health conditions, any disability, treatments and care received including vaccination status, prescriptions, notes and reports about your health from your GP, results of x-rays, MRI or CT results, relevant images, including high-definition photos and videos and associated reports, blood tests, pathology tests, tissue samples and other pertinent medical examinations.
– **Sex Life Data** – on occasion, we may collect data about your sex life or sexual orientation, such as we will make enquiries of female patients on the chance of pregnancy before undertaking an x-ray, tests or procedure.
# How we keep your information confidential and safe
Information provided in confidence will only be used for the purposes advised with the patient’s consent unless the law covers other circumstances.
Your records are backed up securely and are in line with NHS standard procedures. We ensure that our information is kept in secure locations, protected by appropriate security, and accessible only to authorised personnel.
We also make sure external data processors that support us are legally and contractually bound to operate and prove security arrangements are in place where data that could identify a person are processed.
We are committed to protecting your privacy and will only use information collected lawfully under the following:
– Data Protection Act 1998
– General Data Protection Regulation 2018
– Human Rights Act
– Common Law Duty of Confidentiality
## Data Protection
We have implemented appropriate security measures to prevent your data from being accidentally lost, used, accessed in an unauthorised way, altered, or disclosed. In addition, we limit access to your data to employees, agents, contractors, and other third parties who have a business need to know.
We have put in place procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
## Data Retention
We will only retain your data for as long as reasonably necessary to fulfil the purposes we collected it, including satisfying any legal, regulatory, tax, accounting, or statutory reporting requirements. We may retain your data for a more extended period in case of a complaint or if we reasonably believe there is a prospect of litigation regarding our relationship with you.
To determine the appropriate retention period for personal data, we consider the amount, nature and sensitivity of the personal data, the potential risk of harm from unauthorised use or disclosure of your data, the purposes for which we process your data and whether we can achieve those purposes through other means, and the applicable legal, regulatory, tax, accounting or other requirements.
We shall retain all your health records collated during your treatment at the clinic, which relate to your health records and shall comprise Contact Data, Identity Data, Health Data and Sex Life Data (where applicable) for the following periods, being the statutory retention periods for health records:
– **Adult patients** – 8 years from the date of last entry;
– **Paediatric patients** – until 25th birthday, or if the patient is 17 at the time of last entry, then to be retained until 26th birthday;
Data relating to the payment of the services shall be retained for the following retention periods:
– **Invoices and Private Medical Insurer details** comprising Identity, Financial, and insurance Data – 7 years.
– **Private Medical Insurance remittances** comprising Identity Data and Private Medical Insurance Data – 3 years; and
– **Details of non-payors** comprising Identity Data – until account has been paid.
# Your right to withdraw consent for us to share your personal information (Opt-Out)
If you are happy for your data to be extracted and used for the purposes described in this fair processing notice, then you do not need to do anything. You can opt out if you do not want your information used for any purpose beyond providing your care. If you wish to do so, please let us know so we can code your record appropriately. We will respect your decision if you do not want your information to be used for any purpose other than your care, but in some circumstances, we may still be legally required to disclose your data.
There are two main types of opt-out.
## Type 1 Opt-Out
If you do not want information that identifies you to be shared outside the practice for purposes beyond your direct care, you can register a ‘Type 1 Opt-Out’. This prevents your personal confidential information from being used other than in particular circumstances required by law, such as a public health emergency like an outbreak of a pandemic disease.
## Type 2 Opt-Out
NHS Digital collects information from various places where people receive care, such as hospitals and community services. If you do not want your personal confidential information to be shared outside of NHS Digital for purposes other than your direct care, you can register a ‘Type 2 Opt-Out’. For further information about Type 2 Opt-Outs, don’t hesitate to get in touch with the NHS Digital contact centre at [email protected] referencing ‘Type 2 Opt-Outs – Data Requests’ in the subject line, or call NHS Digital on (0300) 3035678
Or visit the website http://content.digital.nhs.uk/article/7092/Information-on-type-2-opt-outs.
If you wish to discuss or change your opt-out preferences, please get in touch with the Senior Administrator.
## Access to your information
Under the new General Data Protection Regulation (GDPR) 2018, everybody, with some exceptions, has the right to see or have a copy of data we hold that can identify them. You do not need to give a reason for visiting your data.
Subject access requests can be made verbally or in writing, and the practice has one month to respond to the request. Under GDPR, organisations are not permitted to charge the data subject in most circumstances.
If you want to access your data, request it in writing. Under exceptional circumstances, some information may be withheld. If you wish to have a copy of the information we hold about you, don’t hesitate to contact the Data Protection Officer.
# Change of Details
It is important that you tell the person treating you if any of your details, such as your name or address, have changed or if any of your details are incorrect so that this can be amended. Please inform us of any changes so our records for you are accurate and up to date.
## Mobile Numbers & Email Addresses
If you provide us with your mobile phone number, we may use this to send you reminders about your appointments or other health screening information. Please let us know if you do not wish to receive reminders on your mobile. If you provide us with your email address, we may use this to send you reminders to make an appointment for a review. Please let us know if you do not wish to receive correspondence by email.
## Notification – Data Controller information
Friends Medical Service is registered with the Information Commissioner’s Office (ICO) to describe the purposes for which it processes personal and sensitive information.
We are a registered Data Controller, and our registration can be viewed online in the public register at: http://ico.org.uk/what_we_cover/register_of_data_controllers.
## Complaints
If you have concerns or are unhappy about any of our services, please contact:
**Data Protection Office**
– **Address:** 41 High Street Lurgan BT66 8AH
– **Phone Number:** 02896211981
– **E-mail:** [email protected]
– **URL:** www.friendsmedicalservice.com
**Privacy Notice date:** 01/04/2025
For independent advice about data protection, privacy and data-sharing issues, you can contact:
**The Information Commissioner’s Office**
Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
Phone: 03031231113
Website: www.ico.gov.uk
## Further Information
Further information about how the NHS uses personal information and your rights in that respect can be found here: https://www.england.nhs.uk/contact-us/privacy/privacy-notice/yourinformation/
## The NHS Care Record Guarantee
The NHS Care Record Guarantee for England sets out the rules that govern how patient information is used in the NHS, what control the patient can have over this, the rights individuals have to request copies of their data and how data is protected under the Data Protection Act 1998. http://systems.digital.nhs.uk/infogov/links/nhscrg.pdf
## NHS Digital
NHS Digital collects health information from health and social care providers’ records about the care and treatment they give to promote health or support improvements in the delivery of care services in England. http://content.digital.nhs.uk/article/4963/What-we-collect
## Reviews of and Changes to our Fair Processing & Privacy Notice
We will regularly review our Fair Processing & Privacy Notice, which was last reviewed in April 2025 following GDPR implementation.