This website uses cookies to function correctly.
You may delete cookies at any time but doing so may result in some parts of the site not working correctly.

Fair Processing Notice

your care data

Privacy Notice – How we use your information


This fair processing notice explains why Cumberland House Surgery collects information about you and how that information may be used.


How do we maintain the confidentiality of your records?

Cumberland House Surgery manages patient information in accordance with existing laws and with guidance from organisations that govern the provision of healthcare in England such as the Department of Health and the General Medical Council.

We are committed to protecting your privacy and will only use information collected

lawfully in accordance with:


  • Data Protection Act 1998
  • Human Rights Act 1998
  • Common Law Duty of Confidentiality
  • Health and Social Care Act 2012
  • NHS Codes of Confidentiality and Information Security Information for more information read the document To Share or Not to Share the Government response to the Caldicott Review Click here


We collect and hold data for the sole purpose of providing healthcare services to our patients and we will ensure that the data is kept confidential. Confidentiality is an important duty, but it is not absolute.

We can disclose personal information if:

(a) it is required by law

(b) the patient consents – either implicitly for the sake of their own care or expressly for other purposes

(c) it is justified in the public interest.

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.


We will only ever use or pass on information about you if others involved in your care have a genuine need for it.


We will not disclose your information to any 3rd party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the new information sharing principle following Dame Fiona’s Caldicott information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles. They should be supported by the policies of their employers, regulators and professional bodies. To view the Caldicott principles, please click here 


Details we collect about you


The health care professionals who provide you with care maintain records about your health and any treatment or care you have received previously (e.g. NHS Trust, GP Surgery, Walk-in clinic, etc.). These records help to provide you with the best possible healthcare.


NHS Health records may be electronic, on paper or a mixture of both, and we use a combination of working practices and technology to ensure that your information is kept confidential and secure. Records which Cumberland House Surgery may hold about you may include the following information:-


Records which this GP Practice hold about you may include the

following information;

  • Details about you, such as your address, legal representative, emergency contact


  • Any contact the surgery has had with you, such as appointments, clinic visits,

emergency appointments, etc.

  • Notes and reports about your health
  • Details about your treatment and care
  • Results of investigations such as laboratory tests, x-rays, etc
  • Relevant information from other health professionals, relatives or those who care for you
  • Details about you such as your address and next of kin.
  • Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments etc.
  • Notes and reports about your health.
  • Details about your treatment and care.
  • Results of investigations, such as laboratory tests, x-rays etc.
  • Relevant information from other health professionals, relatives or those who care about you.

  • Review your suitability for research study or clinical trial.


How we use your Information

Under the powers of the Health and Social Care Act 2012 (HSCA) the Health and Social Care Information Centre (HSCIC) can require Personal Confidential Data (PCD) from GP Practices without seeking patient consent. Improvements in information technology are also making it possible for us to share data with other healthcare providers with the objective of providing you with better care.

To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS.


To ensure you receive the best possible care, your records are used to facilitate the care you receive. Information held about you may be used to help protect the health of the public and to help us manage the NHS.


Clinical audit

Information may be used for audit to monitor the quality of the service provided. Some of this information may be held centrally and used for statistical purposes. Where we do this we make sure that individual patient records cannot be identified, eg the National Diabetes Audit.


Clinical Research 

Sometimes your information may be requested to be used for research purposes – the surgery will always gain your consent before releasing the information for this purpose.


Summary Care Record 

There is a new Central NHS Computer System called the Summary Care Record (SCR). It is an electronic record which contains information about the medicines you take, allergies you suffer from and any bad reactions to medicines you have had.

Storing information in one place makes it easier for healthcare staff to treat you in an emergency, or when your GP practice is closed.

This information could make a difference to how a doctor decides to care for you, for example which medicines they choose to prescribe for you.

Only healthcare staff involved in your care can see your Summary Care Record. 

it is not compulsory to have a summary care record. If you choose to opt out of the scheme, then you will need to complete a form and bring it along to the surgery. You can use the form at the foot of this page.

For further information visit the NHS Care records website or the HSCIC Website


Mobile Telephone Number 

If you provide us with your mobile phone number we may use this to send you reminders about your appointments or other health screening information.  You will be required to give us consent to receiving SMS messages for this service.

Our Practice Website 

Our website does not use cookies to track your activity online but the  "Remember these details" feature on our on-line prescription form uses first party cookies on your computer to store your information. This information is only used to remember your details and is never passed to any third party. Cookies must be enabled in your browser for this feature to work.  Using this feature means you agree to the use of cookies as required by EU Data Protection Directive 95/46/EC

NHS Health Checks

All of our patients aged 40-74 not previously diagnosed with cardiovascular disease are eligible to be invited for an NHS Health check. Nobody outside the healthcare team in the practice will see confidential information about you during the invitation process and only contact details would be securely transferred to a data processor (if that method was employed). You may be given the chance to attend your health check either within the practice or at a community venue. If you health check is at a community venue al data collected will be securely transferred back into the practice system and nobody outside the healthcare team in the practice will see confidential information about you during this process.


Risk Stratification 

Risk stratification data tools are increasingly being used in the NHS to help determine a person’s risk of suffering a particular condition, preventing an unplanned or (re)admission and identifying a need for preventive intervention. Information about you is collected from a number of sources including NHS Trusts and from this GP Practice. A risk score is then arrived at through an analysis of your de-identified information using software managed by the North West Commissioning Support Unit and is only provided back to your GP as data controller in an identifiable form.


Risk stratification enables your GP to focus on preventing ill health and not just the treatment of sickness. If necessary your GP may be able to offer you additional services.


Please note that you have the right to opt out.


Individual Funding Request 

An ‘Individual Funding Request’ is a request made on behalf of a patient, by a clinician, for funding of specialised healthcare which falls outside the range of services and treatments that NHS Eastern Cheshire Clinical Commissioning Group (CCG) has agreed to commission for the local population. An Individual Funding Request is taken under consideration when a case can be set out by a patient’s clinician that there are exceptional clinical circumstances which make the patient’s case different from other patients with the same condition who are at the same stage of their disease, or when the request is for a treatment that is regarded as new or experimental and where there are no other similar patients who would benefit from this treatment.

A detailed response, including the criteria considered in arriving at the decision, will be provided to the patient’s clinician.

Invoice validation

Invoice validation is an important process. It involves using your NHS number to check that the CCG that is responsible for paying for your treatment. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for. The process makes sure that the organisations providing your care are paid correctly.


Your doctor or your pharmacist sends your prescriptions to the Business Services Authority  after dispensing your medical products to you, as stated on the prescription form.  We manage the information on the forms as required by Data Protection law and they use it to:-

  • pay the organisation providing you with medical products.
  • secure effective and efficient delivery of NHS services.
  • analyse general trends to support more effective planning of NHS services.
  • check fraud and mistakes, including checking claims you make for help with NHS charges.  If they can't confirm that you are entitled to help, you may be sent a Penalty Charge Notice.
  • monitor the safety of new medicines.

To prevent, detect and investigate fraud and errors, they may share your information with:

  • NHS Counter Fraud Authority
  • The Department for Work and Pensions
  • HM Revenue and Customs
  • Veterans UK
  • NHS Commissioners and service providers.

They only share your information with those directly involved in your NHS care or reviewing your NHS care, those who have a legal right to it and those who you have given them permission to share it with.

They also share you information with Public Health England to help them protect and improve the health of the population of England.  You can only be identified from this information where Public Health England have the legal power to do so.  They share patient identifiable information for new medicines with the Drug Safety Research Unit at Southampton University.  They have a legal right to this.  They will contact your GP to ask for your permission to take part in the medicine safety study.  If you do not wish to take part your information will be deleted. 


If you want to know more please click on the link below to view the leaflet “How information about you helps us to provide better care”.


For further information, click on the link below.


You have a choice. If you are happy for your information to be used in this way you do not have to do anything. If you have any concerns or wish to prevent this from happening, please speak to practice staff or download the opt out form below, complete it and return it to the practice

We need to make sure that you know this is happening and the choices you have.

doc How information about you helps us to provide better care

doc Care Data - Frequently Asked Questions

doc Opt Out Form - Download, complete and return to the practice

You can find out more on the NHS England Care Data website

Who are our partner organisations?

We may also have to share your information, subject to strict agreements on how it

will be used, with the following organisations;

  • NHS Trusts / Foundation Trusts
  • GPs
  • NHS Commissioning Support Units
  • Independent Contractors such as dentists, opticians, pharmacists
  • Private Sector Providers
  • Voluntary Sector Providers
  • Ambulance Trusts
  • Clinical Commissioning Groups
  • Social Care Services
  • Health and Social Care Information Centre (HSCIC)
  • Local Authorities
  • Education Services
  • Fire and Rescue Services
  • Police & Judicial Services
  • Voluntary Sector Providers
  • Private Sector Providers
  • Other ‘data processors’ which you will be informed of.


Access to personal information

You have a right under the Data Protection Act 1998 to request access to view or to obtain copies of what information the surgery holds about you and to have it amended should it be inaccurate. This is known as ‘the right of subject access’.  

In order to request this, you need to do the following:


  • Your request must be made in writing to the GP - for information from the hospital you should write direct to them
  • There may be a charge to have a printed copy of the information held about you
  • We are required to respond to you within 30 days
  • You will need to give adequate information (for example full name, address, date of birth, NHS number and details of your request) so that your identity can be verified and your records located


Objections / Complaints

Should you have any concerns about how your information is managed at the GP, please contact the GP Practice Manager. If you are still unhappy following a review by the GP practice, you can then complain to the Information Commissioners Office (ICO) via their website  Click here


If you are happy for your data to be extracted and used for the purposes described in this fair processing notice then you do not need to do anything.


If you do not want your personal data being extracted and leaving the GP practice for any of the purposes described, you need to let us know as soon as possible.

We will then enter clinical codes into your records that will prevent data leaving the

practice and / or leaving the central information system at the Health and Social Care

Information Centre (HSCIC) for use by secondary providers.

Any patient can choose to withdraw their consent to their data being used in this way. When Cumberland House Surgery is about to participate in any new data-sharing scheme we will make patients aware by displaying prominent notices in the surgery and on our website at least four weeks before the scheme is due to start. We will also explain clearly what you have to do to ‘opt-out’ of each new scheme.

A patient can object to his personal information being shared with other health care providers but if this limits the treatment that that patient can receive then the doctor will explain this to them at the time.

Change of Details

It is important that you tell the person treating you if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.



The Data Protection Act 1998 requires organisations to register a notification with the

Information Commissioner to describe the purposes for which they process personal and sensitive information.


This information is publicly available on the Information Commissioners Office website Click here

The practice is registered with the Information Commissioners Office (ICO).


Who is the Data Controller?

The Data Controller, responsible for keeping your information secure and confidential is: 

Dr J M Hodgson


Any changes to this notice will be published on our website and on the notice board.

The Partnership is registered as a data controller under the Data Protection Act 1998.  Our registration number is Z6372604. Our registration can be viewed on-line in the public register at the ICO website


Further Information

Further information about the way in which the NHS uses personal information and your rights in that respect can be found in: The NHS Care Record Guarantee: The NHS Constitution: programme: The HSCIC Guide to Confidentiality gives more information on the rules around information sharing : An independent review of how information about patients is shared across the health and care system led by Dame Fiona Caldicott was conducted in 2012.  The report, Information: To share or not to share? 

To read the Information Governance Review, click here

To read the NHS Commissioning Board – NHS England – Better Data, Informed Commissioning, Driving Improved Outcomes click here

Please visit the Health and Social Care Information Centre’s website for further information about their work.  Information about their responsibility for collecting data from across the health and social care system

The Information Commissioner’s Office is the Regulator for the Data Protection Act 1998 and offer independent advice and guidance on the law and personal data, including your rights and how to access your personal information.  For further information please visit the Information Commissioner's Office website





Call 111 when you need medical help fast but it’s not a 999 emergencyNHS ChoicesThis site is brought to you by My Surgery Website