Privacy Notice

Our policy

At Salisbury Medical Practice we understand how important it is to keep your personal information safe and secure and we take this very seriously. We have taken steps to make sure your personal information is looked after in the best possible way and we review this regularly.

Our General Practitioners and Allied Healthcare Professionals provide primary medical care services to our practice population and are supported by our administrative and managerial team in providing care for patients.

To read our full privacy notice ask at Reception for a hard copy.

1. Why we are providing this privacy notice 

We are required to provide you with this Privacy Notice by Law.  It explains how we use the personal and healthcare information we collect, store and hold about you.  If you are unclear about how we process or use your personal and healthcare information, or you have any questions about this Privacy Notice or any other issue regarding your personal and healthcare information, then please do contact our Data Protection Officer (details below). 

The legal basis

We have been commissioned by the Bath and North East Somerset, Swindon and Wiltshire Integrated Care Board (ICB) to provide a GP surgery service and it is necessary for the performance of this task in the public interest for us to process your personal data. 

We will use your special categories of personal data, such as that relating to your race, ethnic origin, and health for the purposes of providing you with health and / or social care or the management of health and / or social care systems and services. Such processing will only be carried out by a health or social work professional or by another person who owes a duty of confidentiality under legislation or a rule of law. 

In some circumstances, we may process your personal information on the basis that: 

• it is necessary to protect your vital interests; 
• we are required to do so in order to comply with legal obligations to which we are subject;
• we are required to do so for the establishment, exercise or defence of a legal claim;

or

• you have given us your explicit consent to do so.

2. The data protection officer

The Data Protection Officer at the Surgery is Laura North. You can contact her on 0300 111 6432:

• If you have any questions about how your information is being held
• If you require access to your information or if you wish to make a change to your information
• If you wish to make a complaint about anything to do with the personal and healthcare information we hold about you
• Or any other query relating to this policy and your rights as a patient.

3. About us

We, at Salisbury Medical Practice (‘the Surgery’) located at the addresses below are a Data Controller of your information. This means we are responsible for collecting, storing and handling your personal and healthcare information when you register with us as a patient. 

There may be times where we also process your information. That means we use it for a particular purpose and, therefore, on those occasions we may also be Data Processors. The purposes for which we use your information are set out in this Privacy Notice.

Our premises

• Fisherton House, Fountain Way, Salisbury, Wiltshire. SP2 7FD
• Pembroke Road, Salisbury, Wiltshire. SP2 9DJ
• 28 St Clements Way, Salisbury, Wiltshire. SP1 3FF

4. Why do we collect your personal information?

Healthcare professionals who provide you with care are required by law to maintain records about your health and any treatment or care you have received within any NHS organisation. These records help to provide you with the best possible healthcare and help us to protect your safety.

We collect and hold data for the purpose of providing healthcare services to our patients and running our organisation which includes monitoring the quality of care that we provide. In carrying out this role we will collect information about you which helps us respond to your queries or secure specialist services. We will keep your information in written form and/or in digital form. The records will include both personal and special categories of data about your health and wellbeing.

5. What types of personal information do we collect about you?

We may collect the following types of personal information:

• Your name, address, email address, telephone number and other contact information
• Gender, NHS Number and date of birth and sexual orientation
• Details of family members and next of kin details
• Health (Medical) information, including information relating to your sex life
• Details of any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments and telephone calls.
• Results of investigations such as laboratory tests or x-rays
• Biometric data
• Genetic information 
• CCTV footage

6. How will we use the personal information we collect about you?

We may use your personal information in the following ways:

• To help us assess your needs and identify and provide you with the health and social care that you require
• To determine the best location to provide the care you require
• To comply with our legal and regulatory obligations  
• To help us monitor and manage our services
• To support medical research 

7. Information about you from others

We also collect personal information about you when it is sent to us from the following:

A. A hospital, a consultant or any other medical or healthcare professional, or any other person involved with your general healthcare.

B. Police Force regarding application and ownership of firearms

C. Statutory services, such as Social Services, Council, Police etc

8. Text (SMS) messages

If you have provided your mobile telephone number, we may use this to send automatic appointment reminders, requests to complete surveys or to make you aware of services provided by the surgery that we feel will be to your benefit.

If you do not wish to receive these text messages, please let the reception team know.

9. Call recording

Recordings of calls made and received by Salisbury Medical Practice may be used to support the learning and development of our staff and to improve the service we provide to our patients.

They may also be used when reviewing incidents, compliments or complaints.

Call recordings will be managed in the same way as all other personal information processed by us and in line with current data protection legislation.

10. CCTV footage

Salisbury Medical Practice use Close Circuit Television (CCTV) to record images within public areas of the practice for the safety and security of our patients and staff.

CCTV footage is managed in the same way as all other personal data processed by us and in line with current legislation.

11. Data processors

iGPR

We use a processor, iGPR Technologies Limited (“iGPR”), to assist us with responding to report requests relating to your patient data, such as subject access requests that you submit to us (or that someone acting on your behalf submits to us) and report requests that insurers submit to us under the Access to Medical Records Act 1988 in relation to a life insurance policy that you hold or that you are applying for.  iGPR manages the reporting process for us by reviewing and responding to requests in accordance with our instructions and all applicable laws, including UK data protection laws.  The instructions we issue to iGPR include general instructions on responding to requests and specific instructions on issues that will require further consultation with the GP responsible for your care.

12. How will we share your personal information?

We may share your personal information with other health and social care professionals and members of their care teams to support your ongoing health and or social care and achieve the best possible outcome for you. This may include:

Primary care network

Salisbury Medical Practice is a member of the Sarum Cathedral Primary Care Network (PCN) so you may be contacted by or treated by one of the other practices within the PCN. In order to support and provide healthcare services to you, they will require access to your patient record.

A. Care home and frailty service team (CHFS)

We provide specialist services to patients aged 75 and older and in care homes on behalf of Sarum Cathedral Primary Care Network (PCN). In order to provide you with these services, we have formal arrangements in place with the Integrated Care Board (ICB) and with other member practices. This means, every member of the CHFS within Sarum Cathedral PCN will have access to your medical record to be able to offer you the service.  Please note to ensure that those practices and personnel comply with the law and to protect the use of your information, we have very robust data sharing agreements and other clear arrangements in place to ensure your data is always protected and used for those purposes only.

The Sarum Cathedral PCN practices are as follows:

• Salisbury Medical Practice
• Harcourt Medical Centre

B. Commissioned services – extended access (EA)

We provide additional Monday to Friday 6.30pm to 8pm and Saturdays 9am to 5pm to patients of the following practices within Sarum Cathedral Primary Care Network.  The Sarum Cathedral PCN practices are:

• Salisbury Medical Practice
• Harcourt Medical Centre

In order to provide you with these services, we have formal arrangements in place with the Integrated Care Board (ICB) and with other member practices. This means, every member of Sarum Cathedral PCN (for the purposes of direct and direct patient care) will have access to your medical record to be able to offer you the service. Please note to ensure that those practices and personnel comply with the law and to protect the use of your information, we have very robust data sharing agreements and other clear arrangements in place to ensure your data is always protected and used for those purposes only.

C. Commissioned services – minor surgery contract

We provide minor surgery services to our patients and other patients registered to a Wiltshire GP practice, in the specialist area of Vasectomies, Carpal Tunnel and Basal Cell Carcinoma (BCC). In order to provide you with these services, we have formal arrangements in place with the Integrated Care Board (ICB) and with other Wiltshire GP practices. This means, key personnel involved in the minor surgery contract will have access to your medical record to be able to offer you the service. Please note to ensure that those practices and personnel comply with the law and to protect the use of your information, we have very robust data sharing agreements and other clear arrangements in place to ensure your data is always protected and used for those purposes only.

D. Non-commissioned services – military vasectomy and carpal tunnel (minor surgery) contract

We provide minor surgery services to serving military personnel patients who are registered with a Military GP in England, in the specialist area of Vasectomies.  In order to provide patients with these services, we have formal arrangements in place with NHS England.  This means, those key personnel involved in the minor surgery contract will have access to your medical record to be able to offer you the services above.  Please note to ensure that those key personnel comply with the law and to protect the use of your information, we have very robust data sharing agreements and other clear arrangements in place to ensure your data is always protected and used for those purposes only.

Patient referrals

With your agreement, we may refer you to other services and healthcare providers for services not provided by Salisbury Medical Practice. 

Other providers of healthcare

We will share your information with other providers of healthcare services to enable them to support us in providing you with direct healthcare. This may include NHS organisations or private companies providing healthcare services for the NHS.

Care homes or social care services

Sometimes the clinicians caring for you may need to share some of your information with others who are also supporting you outside of the practice.

Local authority

The local authority (council) provides health or social care services or assists us in providing direct healthcare services to you. We will share your personal information with them to enable this to take place.

Safeguarding

We will share your personal information with the safeguarding teams of other health and social care providers where there is a need to assess and evaluate any safeguarding concerns. Your personal information will only be shared for this reason when it is required for the safety of the individuals concerned.

Summary care record (SCR)

Your Summary Care Record is an electronic record of important patient information created from the GP medical records. It contains information about medications, allergies and any bad reactions to medications in the past. It can be seen by staff in other areas of the health and care system involved in your direct care.

You have the option to opt out of having a Summary Care Record, opt-back in to having a Summary Care Record or opt back in to allow sharing of Additional Information. 

Further details about the SCR and your choices can be found on the NHS England website

Integrated care records (ICR)

Bath and North East Somerset, Swindon and Wiltshire Integrated Care Record (BSW ICR) is a digital care record system for sharing information in Bath and North East Somerset, Swindon and Wiltshire.  It allows instant, secure access to your health and social care records for the professionals involved in your care. 

Relevant information from your digital records is shared with people who look after you.  This gives them up-to-date information making your care safer and more efficient.

Salisbury Medical Practice uses the system in the following way:

• We can access your data stored within the system
• We can access your data stored within the system and provide relevant information about you and your health

Further details about the BSW ICR and how your information can be found on the Bath and North East Somerset, Swindon and Wiltshire ICB website

GP connect

We use a facility called GP Connect to support your direct care. GP Connect makes patient information available to all appropriate clinicians when and where they need it, to support direct patients care, leading to improvements in both care and outcomes.

GP Connect is not used for any purpose other than direct care.

Authorised Clinicians such as GPs, NHS 111 Clinicians, Care Home Nurses (if you are in a Care Home), Secondary Care Trusts, Social Care Clinicians are able to access the GP records of the patients they are treating via a secure NHS Digital service called GP connect. 

The NHS 111 service (and other services) will be able to book appointments for patients at GP practices and other local services.

Further details about GP Connect are available on the NHS England website

Population health management

This practice may at any time be participating in local Population Health Management (PHM) initiatives aimed at improving physical and mental health outcomes and the wellbeing of our patients. This requires us to share pseudonymised personal data (anything that can identify an individual is replaced with code) with other organisations involved in the initiative. Further details are contained in our detailed supplementary PHM privacy notice.

NHS England

In order to comply with its legal obligations this practice may send data to NHS England when directed by the Secretary of State for Health under the Health and Social Care Act 2012.

This practice contributes to national clinical audits and will send the data, which are required by NHS England when the law allows. This may include demographic data, such as date of birth and information about your health, which is recorded in coded form. For example, the clinical code for diabetes or high blood pressure.

National services

There are some national services like the national Cancer Screening Programme that collect and keep information from across the NHS. This is how the NHS knows when to contact you about services like cancer screening.

OpenSAFELY covid-19 service and OpenSAFELY data analytics service

NHS England has been directed by the government to establish and operate the OpenSAFELY COVID-19 Service and the OpenSAFELY Data Analytics Service. These services provide a secure environment that supports research, clinical audit, service evaluation and health surveillance for COVID-19 and other purposes. 

Each GP practice remains the controller of its own GP patient data but is required to let approved users run queries on pseudonymised patient data. This means identifiers are removed and replaced with a pseudonym. 

Only approved users are allowed to run these queries, and they will not be able to access information that directly or indirectly identifies individuals. 

Patients who do not wish for their data to be used as part of this process can register a type 1 opt-out with their GP. 

Here you can find additional information about OpenSAFELY.

Risk stratification

Risk Stratification, also known as ‘Health Risk Screening’, is a process that helps your GP determine whether you are at risk of any unplanned admission or sudden deterioration in health. By using information such as age, gender, diagnosis, and consideration of existing long-term conditions, medication history, patterns of attendance at hospital, admissions and periods of access to community care, your GP supported by the local Integrated Care Board (ICB) will be able to judge if you are likely to need more support and care from time to time, or if the right services are in place to support the local population’s needs. 

As part of the automated Risk Stratification process your pseudonymised personal data (anything that can identify an individual is replaced with code) will be shared with the Bath, Northeast Somerset, Swindon and Wiltshire ICB.

You have the right to object to your information being used in this way. However, you should be aware that your objection may have a negative impact on the timely and proactive provision of your direct care.

Further details about Risk Stratification can be found on the Bath and North East Somerset, Swindon and Wiltshire ICB website

Care quality commission (CQC)

The CQC regulates health and care services to ensure that safe care is provided. The law requires that we must report certain serious events to the CQC, for example, when patient safety has been put at risk.

Further information about the CQC can be found on their website

UK health security agency

The law requires us to share data for public health reasons, for example to prevent the spread of infectious diseases or other diseases which threaten the health of the population. We will report the relevant information to local health protection team or the UK Health Security Agency.

Further information can be found on the UK government website

Other NHS organisations

Sometimes the practice will share information with other NHS organisations that do not directly care for you, such as the Integrated Care Board (ICB). However, this information will be anonymous and does not include anything written as notes by the GP and cannot be linked to you.

SystmConnect

We use SystmConnect, provided by The Phoenix Partnership Ltd (TPP), to assist us in delivering healthcare services to our patients.  

TPP will share your personal data with us if you require advice, an appointment or remote consultation.

Full details about how TPP will process your personal information can be found on their privacy notice.

We will not share your information with organisations other than health and social care providers without your consent unless the law allows or requires us to.

13. NHS national data opt-out

Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care Services, important information about you is collected in a patient record for that service. Collecting this confidential patient information helps to ensure you get the best possible care and treatment.

The confidential patient information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care where allowed by law.

You have a choice about whether you want your confidential patient information to be used in this way. If you are happy with this use of information, you do not need to do anything. If you choose to opt out your confidential patient information will still be used to support your individual care.

Where data is anonymised, the opt-out does not apply because the information is no longer confidential patient information.

Information being used or shared for purposes beyond individual care does not include your confidential patient information being shared with insurance companies or used for marketing purposes and information would only be used in this way with your specific agreement.

Health and care organisations that process confidential patient information must have systems and processes in place to comply with the National Data Opt-Out. They must respect and apply your opt-out preference if they want to use or share your confidential patient information for purposes beyond your individual care. 

Salisbury Medical Practice is committed to applying the National Data Opt-Out where it is required. This means that where we use or share confidential patient information for purposes beyond your individual care and the policy applies, we will respect your opt-out choice.

To find out more or to register your choice to opt out, please visit the NHS website.

You can change your choice at any time.

14. How long do we keep your personal information

We follow the NHS Records Management Code of Practice which states that electronic patient records should be retained for 10 years from the date of death. This retention period is a recommended minimum retention period; records may be retained longer where required for legal, regulatory, safeguarding, complaint, or public inquiry reasons.

We keep recordings of our calls for 30 days.

We keep CCTV footage for 25 days.

15. Your rights

You have a right to:

• ask for a copy of the information we hold about you;
• correct inaccuracies in the information we hold about you
• withdraw any consent you have given to the use of your information;
• complain to the relevant supervisory authority in any jurisdiction about our use of your information
• in some circumstances:
  • ask us to erase information we hold about you;
  • request a copy of your personal data in an electronic format and require us to provide this information to a third party;
  • ask us to restrict the use of information we hold about you; and
  • object to the use of information we hold about you. 

You can exercise these rights by contacting us as detailed below. 

Access to patient records through the NHS app

Your health record will also be accessible via the NHS app.

Please visit the NHS England Access to Patient Records information page for more information

You have the right to stop your health record entries being displayed in the NHS app. Please contact your GP should you wish to do so.

16. Anonymised information 

Sometimes we may provide information about you in an anonymised form.  If we do so, then none of the information we provide to any other party will identify you as an individual and cannot be traced back to you.

17. Your rights as a patient

The Law gives you certain rights to your personal and healthcare information that we hold, as set out below:

A. Access and subject access requests 

You have the right to see what information we hold about you and to request a copy of this information. 

If you would like a copy of the information we hold about you, please email our Data Protection Officer. We will provide this information free of charge however, we may in some limited and exceptional circumstances have to make an administrative charge for any extra copies if the information requested is excessive, complex or repetitive. 

We have 30 calendar days to reply to you and give you the information that you require. We would ask, therefore, that any requests you make are in writing and it is made clear to us what and how much information you require.  

B. Online access

You may ask us if you wish to have online access to your medical record. However, there will be certain protocols that we have to follow in order to give you online access, including written consent and production of documents that prove your identity.

Please note that when we give you online access, the responsibility is yours to make sure that you keep your information safe and secure if you do not wish any third party to gain access.

C. Correction 

We want to make sure that your personal information is accurate and up to date. You may ask us to correct any information you think is inaccurate. It is very important that you make sure you tell us if your contact details including your mobile phone number has changed. 

D. Removal

You have the right to ask for your information to be removed however, if we require this information to assist us in providing you with appropriate medical services and diagnosis for your healthcare, then removal may not be possible.

E. Objection 

We cannot share your information with anyone else for a purpose that is not directly related to your health, e.g. medical research, educational purposes, etc. We would ask you for your consent in order to do this however, you have the right to request that your personal and healthcare information is not shared by the Surgery in this way  Please note the Anonymised Information section in this Privacy Notice. 

F. Transfer 

You have the right to request that your personal and/or healthcare information is transferred, in an electronic form (or other form), to another organisation, but we will require your clear consent to be able to do this.

18. Third parties mentioned in your medical record

Sometimes we record information about third parties mentioned by you to us during any consultation. We are under an obligation to make sure we also protect that third party’s rights as an individual and to ensure that references to them which may breach their rights to confidentiality, are removed before we send any information to any other party including yourself. Third parties can include: spouses, partners, and other family members.  

19. Legal justification for collecting and using your information

The Law says we need a legal basis to handle your personal and healthcare information.

Contract

We have a contract with NHS England to deliver healthcare services to you. This contract provides that we are under a legal obligation to ensure that we deliver medical and healthcare services to the public.

We also have a contract with BSWICB to deliver minor surgery procedures to patients registered with a Wiltshire GP practice. This contract provides that we are under a legal obligation to ensure that we deliver medical and healthcare services to the public.

Consent

Sometimes we also rely on the fact that you give us consent to use your personal and healthcare information so that we can take care of your healthcare needs. 

Please note that you have the right to withdraw consent at any time if you no longer wish to receive services from us.

Necessary care

Providing you with the appropriate healthcare, where necessary. The Law refers to this as ‘protecting your vital interests’ where you may be in a position not to be able to consent.  

Law

Sometimes the Law obliges us to provide your information to an organisation (see above).

20. Special categories

The Law states that personal information about your health falls into a special category of information because it is very sensitive. Reasons that may entitle us to use and process your information may be as follows:

Public interest

Where we may need to handle your personal information when it is considered to be in the public interest.  For example, when there is an outbreak of a specific disease and we need to contact you for treatment, or we need to pass your information to relevant organisations to ensure you receive advice and/or treatment;

Consent

When you have given us consent;

Vital interest

If you are incapable of giving consent, and we have to use your information to protect your vital interests (e.g. if you have had an accident and you need emergency treatment);

Defending a claim

If we need your information to defend a legal claim against us by you, or by another party;

Providing you with medical care

Where we need your information to provide you with medical and healthcare services

21. How long we keep your personal information

We carefully consider any personal information that we store about you, and we will not keep your information for longer than is necessary for the purposes as set out in this Privacy Notice. 

22. Under 16s

Parents may access their children’s records (including online access) up until the day before their 12th birthday.  For children and young people aged 12 and over we will assess their competency for giving informed consent before giving access (this will require a routine face to face appointment with a GP).  This access will be granted to the child or young person.  We will not give full proxy access to a parent or guardian for detailed coded or full record access.  We will, with consent of the child or young person, give proxy access to requesting appointments and prescriptions.

23. If English is not your first language

If English is not your first language you can request a translation of this Privacy Notice. Please contact our Data Protection Officer 

24. Complaints

If you have concerns about how we have used your personal data, you have the right to make a complaint to us.

You can raise a data protection complaint by contacting us using the details below:

• Email the data protection officer

You do not need to use specific wording or complete a form. We will accept complaints made through any reasonable channel.

Once the complaint has been received, we will send an acknowledgement within 30 days of receipt.

Your complaint will be investigated without undue delay, and you will be kept informed of progress as appropriate.

Once the investigation of your complaint has been completed we will provide you with the outcome.

You also have the right to raise any concerns about how your personal data is being processed by us with the Information Commissioners Office (ICO) or telephone 0303 123 1113

25. Our website

The only website this Privacy Notice applies to is the surgery’s website. If you use a link to any other website from the surgery’s website then you will need to read their respective privacy notice. We take no responsibility (legal or otherwise) for the content of other websites.

26. Cookies

The surgery’s website uses cookies. For more information on which cookies we use and how we use them, please see our Cookies Policy.

27. Security

We take the security of your information very seriously and we do everything we can to ensure that your information is always protected and secure. We regularly update our processes and systems and we also ensure that our staff are properly trained. We also carry out assessments and audits of the information that we hold about you and make sure that if we provide any other services, we carry out proper assessments and security reviews.

28. Where to find our privacy notice

You may find a copy of this Privacy Notice in the surgery’s reception, on our website, or a copy may be provided on request. 

29. Changes to our privacy notice

We regularly review and update our Privacy Notice. This Privacy Notice was last updated on 29th June 2026

Salisbury Medical Practice: tele-dermatology hub data sharing protocol

Tele-dermatology Image Taking Hubs are operating from a number of locations across Wiltshire. This service is a technical service, with no clinical decision-making taking place. The purpose of the service is to take high-quality images of lesions to support the triage process at Royal United Hospital Bath and Salisbury NHS Foundation Trust. 

What is a tele-dermatology hub?

• When a clinician decides to send an Urgent Skin Cancer referral, they will invite the patient for an appointment to take a high-quality image within the image taking hub at the practice.
• Patients will be seen within 5 days of referral. If this is not possible, their referral will be sent to Royal United Hospital Bath or Salisbury NHS Foundation Trust for an urgent face-to-face appointment. 
• The patient will be contacted by telephone, letter or email to offer them an appointment within the Image Taking Hub, if they have not been directly booked already by their practice. 

What happens to the information I share?

• Salisbury Medical Practice will remain the data controller for the provision of this service. 
• The Image Taking Hub staff will use SystmOne from practice computers to access the patient record and add images to the referral before onward submission. 
• The images will be taken on a Casio DZ-D100 camera. The camera will be connected to the practice PC and stored on a shared drive on the PC, only accessible to Image Taking Hub staff. The images will be stored for up to two months to ensure access if there are any difficulties accessing the images at the Trust.  
• Every month, relevant expired images should be deleted from shared drives. The images will remain part of the patient record.
• Once the images have been taken and added to the referral, the Image Taking Hub staff will send the referral on to the appropriate Royal United Hospitals Bath or Salisbury NHS Foundation Trust service.
• All further communication about the patient and the referral will come from the Trusts. 

Where will the information be stored?

All data will continue to be held within eReferrals and TPP SystmOne. All data is held in secure data centres and is accessed via the secure HSCN network. Role Based Access Controls are in place to restrict the level of access and are clinically appropriate. If there is a requirement for GP surgeries to share personal data via email, this will be sent and received from NHSmail as per standard protocol.