Your information will be held by Devon Doctors Group. This privacy notice is to let you know how the group will undertake to look after your personal information. This includes what you tell us about yourself and what we learn in the course of providing you with care or treatment. This notice also tells you about your privacy rights and how the law protects you.
Who we are
Devon Doctors Group is made up of all the partly and wholly owned companies owned by Devon Doctors Limited, which is a not-for-profit social enterprise, owned by the GP practices of Devon. The group hold contracts for healthcare services including:
Devon Doctors Limited provides GP out-of-hours services in Devon, as part of the integrated urgent care service for the county and now also provides the out-of-hours service in Somerset. Other contracts include district nurse message handling in Devon and end-of-life and palliative care services such as the EpPaCCS end-of-life register.
Access Dental provides out-of-hours and prison dental care and treatment, including emergency dental helplines and waiting list support, in Devon and Somerset.
Access Health Care provides primary care services including:
- Clock Tower surgery in Exeter and the Mayflower Group in Plymouth
- Appointment and referral services including physiotherapy and the Special Allocation Scheme for violent patients in Devon, Cornwall and Somerset
Our registered address is: Suite 1, Osprey House, Osprey Road, Sowton Industrial Estate, Exeter, England EX2 7WN. Telephone: 01392 822345.
You may be interested to know that privacy information is also available on our website in other formats to make this information as widely accessible as possible.
When you contact us by phone
We record all calls made to and from this organisation.
The following patient announcement is provided to all callers accessing our service via our patient lines to inform them of the following:
All telephone calls to and from our organisation are recorded for your protection, and for monitoring purposes. They may be used for training and audit purposes to maintain our quality and high standards. Patient confidentiality is important. However, in certain circumstances, it may be necessary to share your details with third parties including health and social care professionals.
eConsult and consulting your doctor online
We use an online tool, eConsult, where you can get advice and treatment or self-help.
eConsult is provided by a third-party organisation and by using this tool you are submitting your information to them. This information is then submitted to our practice for review by our GPs.
The eConsult privacy notice can be found here: https://econsult.net/privacy-policy/
How the law protects you
Your privacy is protected by legislation and below is an explanation of how this works in practice.
The law says that we are allowed to use personal information only if we have good reason to do so and this includes sharing it outside Devon Doctors Group. The law says we must have one or more of these reasons to process your data. The law requires us to have a separate reason for processing special category data such as health data. These reasons are grouped and summarised below.
|Any type of personal data||Special category data, eg medical information|
|Performing a public interest task||With your explicit consent|
|Legal obligation||Protecting your other vital interests|
|Protecting your or other vital interests||Defend legal claims|
|With your consent||Medical purposes|
|For entering into a contract||Research purposes|
The table below lists the individual purposes we may use your data and identifies the reason or the legal basis that the law permits us to do this.
|What we use your information for||Our reason / legal basis|
|To inform the decisions made about your care||Public interest task /
|To help ensure that your treatment and advice, and the
treatment of others is safe and effective
|Public interest task / medical purpose / vital interests|
|To help us work effectively with other organisations and healthcare
professionals who may be involved in your care
|Public interest task /
|We send it to your registered GP practice so that your GP, nurse, or other medical professionals involved in your care can assess your health and any care you may need||Public interest task / medical purpose|
|Help us to thoroughly investigate any feedback, including patient surveys,
or concerns you may have about the contact with our service
|Consent / explicit consent|
|Provided to other health professionals involved in your direct care,
eg specialist in an acute hospital
|Public interest task /
|Help us to investigate complaints, legal claims, and untoward events||Consent / explicit consent / legal claims|
|Supply data to help plan and manage services; check that the care being
provided is safe; prevent infectious diseases from spreading
|Legal obligation / public interest task / medical purpose|
|Help us conduct clinical audit to ensure we are providing a safe, high quality
service and support the provision of care by other healthcare professionals
|Public interest task /
|To facilitate payment for dental treatment or NHS prescriptions||For entering into a contract|
|To participate in national screening programmes||Public interest task /
|To support medical research when the law allows us to do so, eg to learn
more about why people get ill and what treatments might work best
|Public interest task / research / medical purpose|
|To support safeguarding for patients who, for instance, may be particularly
vulnerable to protect them from harm or other forms of abuse
|Public interest task / vital interest / safeguarding|
|Using risk profiling tools to help in the identification of patients at
risk of particular diseases or unplanned hospital admissions
|Public interest task /
|For an administrative purpose to help manage how we provide you with services, eg
where you nominate individuals to manage your appointments on your behalf
National data opt-out programme
Devon Doctors is one of many organisations working in the health and care system to improve care for patients and the public.
Whenever you use a health or care service, such as attending Accident & Emergency or using community care services, or one of our treatment centres, important information about you is collected to help ensure you get the best possible care and treatment.
The information collected about you when you use these services can also be provided to other approved organisations, where there is a legal basis, to help with planning services, improving care provided, research into developing new treatments and preventing illness. All of these help to provide better health and care for you, your family and future generations. Confidential personal information about your health and care is only used in this way where allowed by law and would never be used for insurance or marketing purposes without your explicit consent.
You have a choice about whether you want your confidential patient information to be used in this way.
To find out more about the wider use of confidential personal information and to register your choice to opt out if you do not want your data to be used in this way, visit https://www.nhs.uk/your-nhs-data-matters/. If you do choose to opt out you can still consent to your data being used for specific purposes.
If you are happy with this use of information you do not need to do anything. You can change your choice at any time.
Groups of personal information
This explains what all the different types of personal information mean, that are covered by data protection law.
We use different kinds of personal information. The groups are all listed here so that you can see what categories of information we hold about you.
|Type of personal information||Description|
|Contact||Name, contact details and address|
|Medical||Record of treatment or care received. Medical diagnosis,
referrals and history of prescribed medicine
|Transactional||Details of any payments you have made, including payments
for out-of-hours dental treatment or prescriptions
|Locational||Where you received treatment or care; the address where you connect a computer to the internet|
|Communication||This includes correspondence or online submissions relating to concerns, complaints, or feedback about the services you have received. All telephone calls received by the organisation are recorded|
Where we collect your data from
We collect data that you provide to us when you:
- Contact us by phone
- Complete a paper or electronic form
- When you receive treatment or care from us
- Visit our websites
We also receive information about you from other sources to ensure that we provide you with effective and comprehensive treatment. These sources include:
- GP practices
- NHS trusts
- Clinical commissioning groups
- Social networks [for instance if you communicate with us through Facebook or Twitter]
- NHS Digital
- NHS England
- Local authorities
How long we retain your records
We only hold on to your information for as long as is necessary and in line with Retention Schedule of the NHS Records Management Code of Practice for Health Social Care 2016. Please click on the link for more information about how long we retain certain types of personal data.
If you choose not to give personal information
You can choose not to give us personal information. In this section we explain the effects this may have.
In some instances we may require your consent to collect personal information about you. If you choose not to give it to us it may, in some instances, delay or prevent us from providing you with a service. For instance we may be unable to follow up or deal effectively with any concerns or complaints you have reported to us.
We may sometimes ask for information that is useful, but not essential. We will make this clear when we ask for it. You do not have to give us these extra details and it won't affect the care or treatment you receive from us.
This section contains a link to our Cookies Policy
Cookies are small computer files that get sent down to your PC, tablet or mobile phone by websites when you visit them. They stay on your device and get sent back to the website they came from, when you go there again. Cookies store information about your visits to that website, such as your choices and other details. Some of this data does not contain personal details about you but it is still protected by this Privacy notice.
Your data - your rights
The following sections contain information about how you can exercise your rights to have control on the personal data we hold on you.
How to complain
This section gives details of how to contact us to make a complaint about data privacy. It also shows you where you can get in touch with the Information Commissioner Office (ICO) who is the UK supervisory authority and regulates data protection law.
Please let us know if you are unhappy with how we have used your personal information. You can contact us at email@example.com or by writing to the Governance Team at the above address.
You also have the right to complain to the regulator, and to lodge an appeal if you are not happy with the outcome of a complaint by using the ICO’s report a concern.
Alternatively you can contact them in writing at: Information Commissioners Office, Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF or by telephone on 0303 123 1113.
How to withdraw your consent
If we are using your consent as the basis for processing your data you have the right to withdraw it at any time. Once you have indicated that you no longer give consent we will cease to process it for this purpose.
Please note that this will only apply in circumstances where we are relying on your consent to use your personal data.
Please also be aware that if you withdraw your consent, we may in certain circumstances not be able to provide certain services to you. If this is the case, we will tell you.
Letting us know if your personal information is incorrect
Here you can find out how to contact us if you think the information we hold for you is wrong, incomplete or out of date.
You have the right to question any information we have about you that you think is incorrect. We’ll take reasonable steps to check this for you and correct it.
If you want to do this please contact us at firstname.lastname@example.org or by writing to the Governance Team at the above address.
How to get a copy of your personal information
You can request a copy of the information we hold about you by writing in to us. You will need to provide forms of identification however the service is free of charge, although the law permits us to charge in certain limited circumstances and we let you know if this is the case. You can read more about requesting your data by going to the link.
What if you want us to stop using your personal information? This section explains about your right to object and other data privacy rights you have – as well as how to contact us about them.
You can object to us keeping or using your personal information. This is known as the ‘right to object’.
You can also ask us to delete, remove, or stop using your personal information if there is no need for us to keep it. This is known as the ‘right to erasure’ or the ‘right to be forgotten’.
Please be aware that this is not an absolute right and there may be reasons why we why we cannot comply with your request. However please tell us if you think that we should not be using it.
We may sometimes be able to restrict the use of your data. This means that it can only be used for certain things, such as legal claims or to exercise legal rights.
You can ask us to restrict the use of your personal information if:
- It is not accurate
- It has been used unlawfully but you don’t want us to delete it
- It is not relevant any more, but you want us to keep it for use in legal claims
- You have already asked us to stop using your data but you are waiting for us to tell you if we are allowed to keep on using it
If we do restrict your information in this way, we will not use or share it in other ways while it is restricted.
If you want to object to how we use your data, or ask us to delete it or restrict how we use it or, please contact us at email@example.com or by writing to the Information Governance Team at the above address.
Who we may share information with
Sometimes we need to share your information with other organisations. For example, you may be receiving care from social services and we may need to share information about you to facilitate this.
We will only ever use or pass on information about you if others involved in your care have a genuine need for it. Anyone who receives information from us is also under a legal duty to keep it confidential and secure.
Please be aware that when assisting the police with the investigation of a serious crime, or if there are concerns regarding child protection/vulnerable adults, it may be necessary for us to share your personal information with external agencies without your knowledge or consent.
We may also share information with organisations such as:
- NHS Trusts [eg hospitals]
- Clinical commissioning groups
- Community / district nurses
- The ambulance or other emergency services
- General Practitioners
- Local authorities
- Multi-Agency Safeguarding Hub [MASH]
- NHS 111
- The Care Quality Commission, ICO and other regulated auditors
- Public Health England
- NHS Digital
- Non-NHS health care providers
Furthermore in supporting the treatment and care we deliver to our patients we engage the professional services of other organisations to assist us in delivering our objectives. This may sometimes require the need for these organisations to process personal data on our behalf. Please note that your information will only be used in support of the purposes for processing your data, which have been listed in the table above and only under our instruction. We have contractual or similar agreements with these organisations which strictly govern how any personal data is used. Under no circumstances will your data be used for any marketing purposes.
The organisations that may process personal data on our behalf are from the following sectors:
- Auditing and consultation services
- Call handling service 111
- Courier services
- Information Management services [eg secure data destruction]
- IT system support services [eg clinical systems and office support]
- Legal services
- Payment card services [to facilitate card payment transactions]
- Scanning and data storage services
- Translation services
Processing of data for the purpose of public protection
The organisation may provide information to, and receive information from, other agencies for the purpose of protecting the public from individuals who may pose a risk eg MAPPA. The organisation may process this information either as a public task function or because it has a legal duty to do so. Further information, including the other agencies involved in the data sharing, can be found here.
Not a patient but perhaps a relative, friend, next of kin or otherwise have an involvement with a patient?
It is possible that the we also hold information on you as part of someone else’s record. The nature of the information held about you will depend on the circumstances in which that the information was collected. For instance, if you have been named as a patient's next of kin we will hold your name and a means of contacting you such as a phone number or address. Under data protection law, you will be entitled to receive a copy of this information unless there is good reason not to provide it.
If our clinicians are attending a call-out to attend a patient they will carry a ‘lone worker’ device that is designed to keep them safe. When activated, which will only be in the event that they or someone else is at risk of harm or otherwise threatened, an alarm will be relayed to an external call centre provider which will monitor and record the audio received and if necessary direct assistance to them. The audio recordings are not designed to capture any medical information and would only be retained, where necessary, for the purpose of an investigation. Devon Doctors will be processing this data on the basis of Legitimate Interest. If you have any questions around how this affects your personal data please contact our DPO using the contact details below.
Sending data outside of the European Economic Area [EEA]
In the normal course of our business we do not send personal data outside the EEA. However in the event that this is required we would only do it with your explicit consent.
Date Protection Impact Assessments conducted by Devon Doctors
Click on the link below for more details of the data protection impact assessments undertaken by Devon Doctors.
Data Protection Impact Assessments.pdf
Data Protection Officer
Devon Doctors Group has appointed a Data Protection Officer and they can be contacted at firstname.lastname@example.org or by post: Data Protection Officer, Devon Doctors Ltd, Osprey House, Osprey Road, Exeter, EX2 7WN.