Privacy Notice: Sandbach GPs Private GP Service - Thriving Clinics

This privacy notice explains how Sandbach GPs of Ashfields Primary Care Centre collects, uses, stores, and shares your personal data when you use our private primary care medical services (branded as Thriving Clinic - Sandbach).

We operate as a commercial service separate from our NHS services. This service is provided exclusively to patients who are not registered on our practice's NHS patient list.

1. Who We Are (Data Controller)

Sandbach GPs is the "Data Controller" for your information. This means we are legally responsible for deciding how and why your personal data is processed.

• Data Protection Officer (DPO): Dr. Neil Paul
• Caldicott Guardian: Dr. Delon Bengston
• Address: Ashfields Primary Care Centre, Middlewich Road, Sandbach, CW11 1EQ

2. The Information We Collect & How We Get It

We collect personal and special category (health) data directly from you when you book an appointment online, complete digital intake forms, or during your consultations with our clinicians.

We process the following types of data:

• Personal Demographics: Your name, home address, date of birth, age, sex, gender, email address, and phone number
• Financial Information: Billing and payment details used to generate invoices and process transactions
• Special Category (Health) Data: Clinical consultation notes, physical and mental health conditions, medical history, medications, living habits (e.g., smoking, alcohol use, exercise), and details of prescriptions issued or dispensed on-site.

Technical Isolation Note

Your private medical record is held on a secure, cloud-based platform called Cliniko. This database is completely distinct, siloed, and isolated from our NHS primary care system (EMIS Web). Your data cannot be blended or automatically synced between these platforms.

3. Our Lawful Bases for Processing Data

Under the UK General Data Protection Regulation (UK GDPR), we rely on the following legal frameworks to process your information:

4. How We Share Your Information

We strictly minimize data sharing. Your records are only shared out of the Cliniko system in the following workflows:

• Your Registered NHS GP: To ensure continuity of care, we will write a clinical summary letter to your registered NHS GP. This letter is printed on-site and sent via secure postal mail. Under the Common Law Duty of Confidentiality, we will ask for your explicit consent before doing this. If you object or ask us to suppress this communication, we will honor your request unless a critical safeguarding or public safety override applies.
• On-site Dispensing Labels: Physical labels are printed locally to display dosage instructions on your dispensed medications.
• To other healthcare professionals as part of a referral: With your permission.

5. Where Your Data Is Stored (Data Sovereignty)

Clinical Data: All patient records, intake forms, and billing charts are hosted on secure, UK-only servers provided by Amazon Web Services (AWS) via Cliniko. Cliniko's official UK Privacy Representative under UK GDPR Article 27 is VeraSafe United Kingdom Ltd.

6. How Long We Keep Your Data

We retain your private electronic health record strictly in line with statutory timeframes required by UK law. Once the statutory retention period expires, your personal data is permanently and securely erased from Cliniko, leaving behind only audited destruction logs.

Private GP Practice: Record Retention Schedule

Critical Exceptions and Legal Holds

Healthcare records that have surpassed their standard minimum retention date must never be destroyed if they are subject to any of the following circumstances:

• Active or Pending Litigation: Any records relevant to an ongoing or explicitly threatened clinical negligence claim, insurance dispute, or legal investigation must be securely held until all proceedings are fully concluded.
• Subject Access Requests (SARs): If a patient, legal representative, or authorized third party has submitted a live SAR, the records cannot be destroyed until the data has been provided and the statutory window for the applicant to appeal or complain to the ICO has passed.
• Statutory Holds & Public Inquiries: Records must be preserved if they fall under the scope of a formal preservation order or an ongoing Public Inquiry (for example, the UK Covid-19 Inquiry).
• Obligation to share: e.g. HMRC, the courts, police (mandatory and vital interest requests), medical defense or legal representative, CQC.
• Practice Closure or Practitioner Retirement: The closure of a private GP service or the retirement of its principal doctor does not dissolve Data Controller liabilities. Records cannot be destroyed prematurely. They must either be transferred to a nominated successor (another registered Data Controller) or managed via a secure legacy data storage service to fulfill the remainder of their legal retention lifecycles.

7. Your Data Protection Rights

Under UK GDPR, you have the following rights regarding your data:

• Right to be Informed: Met through the publication of this privacy notice and the mandatory consent checkboxes completed when you book online.
• Right of Access: You can request a complete, structured copy of your personal data file. We can natively extract your profile directly from Cliniko upon successful identity verification.
• Right to Rectification: You can request the immediate correction of inaccurate personal or demographic details in your active record.

8. How to Complain

If you have any questions or are unhappy with how we handle your personal information, please contact our Data Protection Officer, Dr. Neil Paul, directly at Ashfields Primary Care Centre, Middlewich Road, Sandbach.

You also have a legal right to log a formal complaint at any time with the UK supervisory authority:

• Authority: Information Commissioner's Office (ICO)
• Website: https://ico.org.uk
• Telephone: 0303 123 1113