What is this?
We are required by law to provide you with information on how we use your data. There is a highly detailed privacy notice available here, but this simplified notice is provided for clarity.
Who are we?
We are the St Andrews Medical Practice. We provide medical services to you as a patient as part of the NHS.
Data Protection Officer
The practice is required by law to have a Data Protection Officer. The contact details are:
Name: Steve Durbin
Address: 50 Oakleigh Road North, Whetstone, London, N20 9EX
Purposes of Processing, Legal Basis, Types of Data
We process data to carry out our role as your General Practitioner in providing you with healthcare.
The legal basis for this purpose is provided by the various NHS and social care acts. The Data Protection Act 2018 section 8 allows us to process data for these purposes. This provide a legal basis for processing under the Applied GDPR Article 6 1(e) – task in the public interest.
For special category data Data Protection Act section 10 applies (health and social care purpose) and hence GDPR Article 9 2(h) – provision of health and social care. There are additionally some situations where other provisions are used; these are given in more detail in the full notice.
The types of data we keep relate to your health and care. These include both personal identifiers (e.g. your name, NHS number) and special category personal data (e.g. your health conditions). Further details are provided in the full notice.
Recipients of Your Data
We share data with other health and social care providers in order to provide you with care. You can opt out of this sharing, but this may affect your care. See the full privacy notice for
We are additionally required to supply data to other parts of the NHS for commissioning and audit purposes.
We share data for research purposes and health planning. You again can opt out of these purposes; this will generally not affect you individually, but will mean that research and planning may not take into account needs of people such as yourself. See the full privacy notice for details.
Transfers to Other Countries
We do not store or transmit your data outside of the UK and EU unless this is:
a) Required for your care and you have consented to this
b) We are required to under international law
How Long Will You Keep My Data?
This depends on a number of factors such as how long you stay with our practice and the type of data. Generally, when you leave our practice your data is transferred to the new practice or to central records and we do not retain after that point.
Full details of how long data is held is given in the full privacy notice.
You have the right to:
Receive a copy of your data (Subject Access Request)
Have your data corrected, erased or restrict processing
Complain to our Data Protection Officer or the supervisory authority (the Information Commissioner) about our use or handling of your data.
If you wish to exercise your rights, please contact the practice in the first instance - details above. You can also contact the Data Protection Officer if you prefer – details are again given above, or you can contact the Information Commissioner (ICO) – details via their website at https://ico.org.uk.
Provision of Data
It is not generally a legal requirement for you to provide us with data – however if you do not do so we may be unable to provide you with treatment. For more detail see the full privacy notice.
Automated Decision Making
We use various tools to simplify care and ensure that you get the best care possible.
Some of these have a degree of automation, for example, where a regular test is recommended for a health condition you have, or you are in a particular age and gender range and have not had a recommended screening test, we will have an automated list that flags you to be contacted. These recalls are automated, but it’s up to you to book an
appointment; no action is taken beyond contacting you.
NO decisions on your care are taken without human intervention.
St Andrews Medical Practice does not set first party cookies on this website containing any personal data unless specifically instructed to do so by the user. For example, if a user requests to be remembered on a form then a cookie is set to retain the form data for next time.
You may delete Cookies at any time. See the help in your internet browser to find out how to delete your cookies.
The following cookies are set by Google Analytics and implicitly accepted by you:
This cookie helps us count how many people visit this site by tracking if you’ve visited before. Expires in 2 years.
This cookie helps us count how many people visit this site by tracking if you’ve visited before. Expires in 24 hours.
A cookie that is used to manage the rate at which page view requests are made. Expires in 10 minutes.
A persistent cookie - remains on a computer, unless it expires or the cookie cache is cleared. It tracks visitors. Metrics associated with the Google __utma cookie include: first visit (unique visit), last visit (returning visit).
__utmb Cookie & __utmc Cookies
These cookies work in tandem to calculate visit length. Google __utmb cookie demarks the exact arrival time, then Google __utmc registers the precise exit time of the user.
Because __utmb counts entrance visits, it is a session cookie, and expires at the end of the session, e.g. when the user leaves the page. A timestamp of 30 minutes must pass before Google cookie __utmc expires. Given__utmc cannot tell if a browser or website session ends. Therefore, if no new page view is recorded in 30 minutes the cookie is expired. This is a standard 'grace period' in web analytics. Ominture and WebTrends among many others follow the same procedure.
Cookie __utmz monitors the HTTP Referrer and notes where a visitor arrived from, with the referrer siloed into type (Search engine (organic or cpc), direct, social and unaccounted). From the HTTP Referrer the __utmz Cookie also registers, what keyword generated the visit plus geolocation data. This cookie lasts six months.
Google __utmv Cookie lasts "forever". It is a persistant cookie. It is used for segmentation, data experimentation and the __utmv works hand in hand with the __utmz cookie to improve cookie targeting capabilities.
The following cookies are set by St Andrews Medical Practice:
Cookie lasts "forever". Indicates that user has acknolwledged the 'cookie information' banner and so prevent the banner being shown again.
Cookie lasts "forever". Indicates that the user has viewed the 'Important information' popup when the website is accessed for the first time or in a new session. This is to prevent the popup being shown again.