Translate

Privacy Notice

Introduction

Custom House Surgery (“CHS”, “we”, “our”, or “us”) is committed to protecting the privacy and confidentiality of personal information entrusted to us. This Privacy Policy explains how we collect, use, store, and share personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, NHS confidentiality requirements, and relevant healthcare regulations.

We are the data controller for the personal information we process.

Contact details

Custom House Surgery
16 Freemasons Road
Custom House
London
E16 3NA

Telephone: 020 7476 2255

Data protection officer (DPO)

Our Data Protection Officer can be contacted via the practice

Dr Rasheed Oluwalogbon

What information we collect

We may collect and process the following categories of personal information:

Name, date of birth, NHS number, address, telephone number, and email address
Emergency contact details
Medical history and health records
Appointment details and consultation notes
Test results, prescriptions, and referral information
Information relating to safeguarding or social care
Employment and occupational health information where applicable
CCTV footage where installed for security purposes
Website usage information through cookies and analytics
Information submitted through our website, online forms, AI receptionist system, or digital communication tools

How we use your information

We use your personal information to:

Provide safe and effective healthcare services
Arrange appointments, referrals, and follow-up care
Communicate with you about your care
Maintain accurate medical records
Process prescriptions and test results
Respond to patient enquiries and requests
Improve our services and patient experience
Comply with legal and regulatory obligations
Support NHS planning and public health activities

We will only use your information where we have a lawful basis to do so.

Use of AI and digital communication tools

Custom House Surgery uses digital systems, including the Emma AI Receptionist service and the Nina website platform, to help improve patient access, communication, and administrative efficiency.

These systems may collect and process information you provide when:

Booking or requesting appointments
Submitting enquiries online
Requesting prescriptions or medical advice
Completing website forms
Interacting with automated reception or triage services

Information submitted through these systems is handled securely and only used for purposes connected with your healthcare and the operation of the practice.

Any third-party technology providers used by the practice are required to comply with UK GDPR, NHS data security standards, and confidentiality obligations. We ensure that appropriate contracts and safeguards are in place to protect patient information.

AI-assisted systems do not replace clinical judgement or professional medical advice from healthcare staff.

Lawful basis for processing

Under UK GDPR, the lawful bases we rely on include:

Provision of healthcare and treatment
Compliance with legal obligations
Public interest in the area of public health
Legitimate interests where appropriate
Consent, where specifically required

Special category health data is processed under Article 9(2)(h) of UK GDPR for the provision of health or social care.

Sharing your information

We may share relevant information with:

NHS hospitals and community services
Other healthcare professionals involved in your care
NHS England and Integrated Care Boards
Pharmacies
Laboratories and diagnostic services
Social care services
Approved technology and IT service providers supporting NHS services
Regulatory bodies where required by law

We only share information necessary for the purpose and ensure appropriate safeguards are in place.

We will not sell your personal information to third parties.

Electronic patient records

Your records are held securely on NHS-approved clinical systems. Information may be shared electronically with other healthcare providers directly involved in your care through secure NHS systems.

You may have the option to opt out of certain data sharing arrangements. Further information is available from the practice reception team.

Confidentiality

All staff and contractors working with CHS are subject to confidentiality obligations and receive training in data protection and information governance.

How long we keep information

We retain medical records in accordance with NHS Records Management Code of Practice requirements. Retention periods vary depending on the type of record and legal requirements.

Your rights

Under UK GDPR, you have the right to:

Access your personal information
Request correction of inaccurate information
Request restriction of processing in certain circumstances
Object to certain types of processing
Request data portability where applicable
Withdraw consent where processing is based on consent
Lodge a complaint with the Information Commissioner’s Office (ICO)

Information commissioner’s office

Visit the Information Commissioner's Office website
Telephone: 0303 123 1113

Subject access requests

You may request access to your medical records by contacting the practice. We may require proof of identity before releasing information.

Cookies and website data

Our website may use cookies to improve user experience and analyse website traffic. You can control cookie settings through your browser preferences.

Further information can be found in our Cookie Policy.

CCTV

Where CCTV is in operation, recordings are used for crime prevention, public safety, and the protection of staff and patients. Images are retained securely for a limited period unless required for investigation purposes.

Changes to this policy

We may update this Privacy Policy from time to time. The latest version will always be available on our website and at the practice.

Contact us

If you have questions about this Privacy Policy or how your information is handled, please contact: