About this policy

This privacy policy explains what we do with your data if you choose to use the Register with a GP service; and what your rights are.

Whenever you provide personal information to a third party, that party is legally obliged to use your information in line with data protection law.

We take the security of your personal information seriously. We've set up security measures, policies and procedures such as:

• monitoring our platform to keep your personal information secure
• following good practice guidance in line with that provided by the National Technical Authority
• having security and confidentiality policies in place across the organisation
• restricting access to personal information to only those staff who need access to perform their role

The Service and who we are

The Service allows a user to register with a GP practice, and is owned and operated by Tower Hamlets GP Care Group CIC.

Our legal basis for processing personal data

Our legal basis for processing your personal data under the General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA 2018) is:

• GDPR Article 6 (1) (c): processing is necessary to comply with a legal obligation
• GDPR Article 6 (1) (e): processing is necessary for the performance of a task carried out in the public interest
• GDPR Article 9 (2) (g): processing is necessary for reasons of substantial public interest
• DPA 2018 – Schedule 1, Part 2, (6) (1): statutory and government purposes
• GDPR Article 9 (2) (h): processing is necessary for the management of health or social care systems and services
• DPA 2018 – Schedule 1, Part 1, (2) (2) (f): health or social care purposes
• GDPR Article 9 (2) (i): processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health
• DPA 2018 – Schedule 1, Part 1, (3): public health

If you agree to take part in feedback or surveys about the Service, our legal basis for processing your data in this context is consent (GDPR Article 6 (1) (a)).

What information we collect about you and how it is used

The information processed for the purposes of the Service can be split into several different categories:

• Service registration data: personal, health and contact details you provide, which are used to register you with a GP practice.
• Service feedback data: Non-personally identifiable information you provide if you choose to give us feedback.
• Service audit data: Non-personally identifiable information that is captured against your IP address about your use of the Service, such as the time of use, actions you took using the Service, and associated technical log events. These are used to diagnose problems, understand usage by individuals and the Service as a whole.

Who we share your data with

In order to register you with a GP, we send your service registration data to your chosen practice using the GOV.UK Notify service. The GOV.UK Notify service is operated by the Cabinet Office. Their privacy policy is available here. Your registration data is then processed by your GP practice according to their own privacy policy.

How we use your personal data and why

The processing of your personal data is necessary to provide you with the Service and ensure its functionality.

You will not be able to use the Service unless you agree to its terms of use and this privacy policy.

We may need to share your personal information if we are required to do so by law.

How long we keep your data for

• Service registration data: up to 24 hours
• Service feedback data: Indefinitely
• Service audit data: Indefinitely

Where this data is stored and processed

We only store and process your personal data within the European Economic Area.

Your rights

Under data protection law you have certain rights. The rights available to you depend on our reason for processing your data. These rights are listed below:

• to know how your data will be collected, processed and stored, and for what purposes
• to withdraw your consent
• to request a copy of your personal data
• to correct your personal data errors or omissions
• to request we restrict our use of your personal data (for example, if you think it's inaccurate and needs to be corrected before it's used)

You can read more about your rights and when they apply on the Information Commissioner's Office's (ICO) website.

Your right to complain

If you wish to raise a complaint about how Tower Hamlets GP Care Group CIC uses your data, visit our contact page. You also have the right to raise a concern with the Information Commissioner's Office at any time.

Points of contact for queries

If you have any queries in relation to the use of your personal data within the Service, or about the Service generally, you can find our contact details on the Tower Hamlets GP Care Group CIC contact page.

Changes to the privacy policy

The terms of our privacy policy may change from time to time. Any updates to the privacy policy will be published on the Service website.