Practice opening hours

What is ‘Non-NHS work'?

The practice offers a number of services that are considered ‘Non-NHS work'. These services can be completed by general practice, but are not funded by the Government’s contract with NHS in General Practice.

Non-NHS work includes, but is not limited to:

Insurance forms, Medical assessments, GP letters, DVLA forms, Proof of address letters etc.

When patients request non-NHS work to be completed, a private fee is payable in advance of the work being passed onto a clinician. This is in accordance with the British Medical Association (BMA).

Why is there a fee?

There is a fee as the practice does not receive Government funds to pay Doctors for the extra work, which has to be completed outside of normal clinic hours.

What is the fee?

Fees vary depending on what work needs to be carried out. Standard letters start at £25, while full medical assessments that include an in-person appointment can be £200. Once you have requested a payable service, we will come back to you with information on the fee before proceeding. The fees must be paid before any clinical or admin work begins. Fees can be paid by cash or card at the reception desk. Unfortunately, at this time we do not have the option for online payment.

Download a list of our current fees here.

How long will it take for Non-NHS work to be completed?

Once the fee is paid we will make arrangements for the completion of the work. Depending on the type of work, this may or may not require an appointment. If an appointment is needed we will contact you.

Non-NHS work can take up to 4 weeks to be completed.

However, during particularly busy periods (i.e. during the pandemic or in the lead up to Christmas) work can take up to 6 weeks to be completed. This is because the work is deemed by the NHS as ‘non urgent’. NHS appointments have to take priority, therefore non-NHS work is only given to clinicians when they have capacity. On days or weeks when we have a lot of staff on leave, non-NHS work is unlikely to be given to clinicians. Warning patients that there can be up to a 4 week turnaround time gives us the flexibility to ensure our clinicians are not overworked.

We encourage patients to let us know what work they need completing as soon as possible and inform us when this work is due. For example, we know taxi license medicals have to be returned within 6 weeks.

Please note: There will not be a choice of who can fill your form in or write your letter. We will decide which Clinician is best suited depending on your notes.

What Non-NHS work won’t the practice help with?

We look at each request for non-NHS work to be completed on an individual basis. There are some cases where we cannot complete the work. For example, we cannot make any comment on a patient's past illness if at the time of the illness we did not see, speak to or treat the patient.

As a practice we have decided to no longer sign any documents relating to passports or proof of identity. Likewise, we reserve the right to refuse to take on any work with a short deadline unless there are extenuating circumstances.

What work we can or can do also varies on what Clinicians we currently have working. For instance, Dr James Benton is the only GP who can sign fitness for driving forms. If Dr Benton is on leave or has ultimately left the practice, we would no longer be able to offer this service.

What if all you need is a Doctor's signature?

Whenever a clinician signs a completed form or writes a simple letter it is considered a legal document. Our clinicians will never sign something without reading it fully and ensuring the facts presented are true. This can involve cross referencing with a patient's paper records, talking to the patient over the phone or at an in-person appointment.

An inaccurate report can have serious consequences for the patient and for the Doctor who may become the subject of an investigation by the General Medical Council (the Doctors’ regulatory body) or even the Police. Given this, even if you are just requesting a clinicians signature we request you respect and understand this will still take time. A copy is always taken for your primary care record.

New patients:

If you are a new patient, we may not have your medical records immediately. Our clinicians must wait for these before completing any forms or reports. These can take up to 3-4 months.

How to request Non-NHS work to be completed?

If you would like some non-NHS work to be completed, please visit this page and select 'Admin query' then 'Something else'. Please provide as much information as possible. We will then come back to you with a secure link for you to upload your paperwork to if needed.

How is my request actioned?

The Practice uses a processor, iGPR Technologies Limited (“iGPR”) to assist us with responding to report requests relating to your patient data, such as subject access requests that you submit to us (or that someone acting on your behalf submits to us) and report requests that insurers submit to us under the Access to Medical Records Act 1988 in relation to a life insurance policy that you hold or that you are applying for. iGPR manages the reporting process for us by reviewing and responding to requests in accordance with our instructions and all applicable laws, including UK data protection laws. The instructions we issue to iGPR include general instructions on responding to requests and specific instructions on issues that will require further consultation with the GP responsible for your care.

Canbury Medical Centre/Berrylands Surgery prides itself in maintaining professional standards.

For certain examinations during consultations, an impartial observer (a chaperone) will be required.

This impartial observer will be a practice nurse or health care assistant who is familiar with the procedure and be available to reassure and raise any concerns on your behalf. If a nurse in unavailable at the time of your consultation then your examination may be rescheduled for another time.

You are free to decline any examination or chose an alternative examiner or chaperone. You may also request a chaperone for any examination or consultation if one is not offered to you. The GP may not undertake an examination if a chaperone is declined.

The role of a chaperone:

• Maintains professional boundaries during intimate examinations.

• Acknowledges a patient’s vulnerability.

• Provides emotional comfort and reassurance.

• Assists in the examination.

• Assists with undressing patients, if required.

All patients are entitled to have a chaperone present for any consultation. Please let us know at the time of requesting an appointment or speak to your GP.

Children can experience serious harm and child abuse at home, at school or in fact anywhere. Usually, the harm is caused by someone the child knows and rarely by a stranger.

What should you do if you are worried about a child?

If you are worried about a child, contact Children’s Social Care or the Police and talk about your concerns. Your identity is kept confidential. Everyone in the community has a responsibility to make sure that children grow up safe from harm. Children’s Social Care will make enquiries about the child’s safety and assess what services will help. This is done in strictest confidence.

The child, family and those professionals who work with the family will be involved in the assessment. In all cases, what the family does well for the child is considered alongside the concerns.

In most situations, children remain at home safely with their family, while professionals work with the parents to get the right services involved. In all circumstances action will be taken to safeguard the welfare of the child and improve the situation.

If you are not sure, you should always ask for advice.

Some children require greater levels of support from Children’s Social Care along with other agencies. They are children in need. Usually, these services support children living at home. If you think a child may require services as a child in need, you can seek advice from Children’s Social Care.

Worries about a child

Parents, children and young people, relatives, members of the community and professionals may have concerns that a child has been or might be harmed.

Some children live in circumstances where they do not receive enough basic care such as food, clothing, warmth or safety. This can cause their health and development to be neglected and harmed. Help and services are available for parents to improve the situation.

In a small number of cases, a concern may be that an adult or older child is deliberately harming a child. Sometimes, a single hurtful event may cause serious harm, for example, a violent assault, sexual assault or poisoning.

Harm can also be caused by ongoing incidents, which damage the child’s physical, emotional and psychological development, for example, domestic violence.

Family life

Family life is varied and there is no perfect way to bring up a child. Parenting involves providing for a child’s basic needs, keeping them safe, showing them warmth and love.

Children need the support of their parents, family and community to grow up and help them achieve their full potential.

A wide range of services and professionals provide support to families so that their children grow and develop successfully, especially in relation to their health and education.

Parenting can be challenging. All parents may at times feel they need to talk about worries they have about their child. This can feel difficult, but making sure a child is safe, healthy and growing up successfully sometimes needs the support of others.

Seeking support not only helps the child but can also strengthen the family and community and is a positive step.

Advice and support for parents

Teachers at your child’s school and health visitors and doctors at your local health centre can all help provide more information about where to find the right support for you and your child. Asking for advice early on can lead to you receiving the right support and services.

Services are free and all parents, or people caring for a child, can seek help and advice. You can also find out what help is available for children who have disabilities, children with long term ill health, school problems, bullying and children with special educational needs and children who

are young carers.

Arranging extra support

If you would like services from a number of different agencies talk to your teacher, health visitor or doctor. You should be invited to be involved in the assessment of your child’s needs. This is called a Common Assessment and it helps the people supporting you to understand what services you and your child need and how all the agencies can work together in the best way.

You can also get help and information, in confidence, about problems related to pregnancy, parenthood, housing, ill health, depression, alcohol or drug problems or domestic violence.

Contacts

If you are concerned about a child or would like advice, you can contact NSPCC Child Protection Helpline on 0808 800 5000 or for more information, you can visit their website www.nspcc.org.uk.

Patients have a right to expect that information about them will be held in confidence by their doctor.

Whilst we shall continue to presume you are happy for us to share relevant details to those to whom you agree to be referred, we can assure you that private medical information will never be released to non-medical third parties (such as your insurance company), without your signed consent.

If we are asked to provide information about patients we will:

• Seek their consent to disclosure of information wherever possible, whether or not we judge that patients can be identified from the disclosure.

• Ensure that the person given access to records will be subject to a duty of confidentiality.

Under 16?

We provide a confidential service to everyone, including under 16 year olds. This means that you can tell others about your visit, but we won’t.

The only reason we might have to consider passing on your confidential information would be to protect you or someone else from serious harm. We would always try to discuss this with you first.

If you do have any worries about confidentiality please feel free to ask a member of staff.

Due to the number of patients failing to attend appointments, it may be that you are not able to see the doctor on the day that you wish to.

In an attempt to try and resolve this, the practice has developed the following policy. If you fail to attend appointments without informing us, we will write to you asking if there are any specific problems preventing you from letting us know.

Please contact the practice if you are unable to attend your appointment. If you repeatedly fail to attend for appointments, you may be removed from the practice list and have to find an alternative GP Practice.

Information about the GPs and the practice required for disclosure under the Freedom of Information Act 2000 can be made available to the public.

There are seven classes of information:

Who we are and what we do

What we spend and how we spend it

What our priorities are and how we are doing

How we make decisions

Our policies and procedures

Lists and registers

Services the practice offers

This covers any recorded organisational information such as reports, policies or strategies, that is held by a public authority in England, Wales and Northern Ireland, and by UK-wide public authorities based in Scotland, however, it does not cover personal information such as patient records which are covered by the Data Protection Act 2018.

Public authorities include government departments, local authorities, the NHS, state schools and police forces.

This is enforced by the Information Commissioner who regulates both the Freedom of Information Act 2000 and the Data Protection Act 2018.

All requests for such information should be made to the reception.

NHS England require that the net earnings of doctors engaged in the practice is published and the required disclosure is shown below. However, it should be noted that the prescribed method for calculating earnings is potentially misleading because it takes no account of how much time doctors spend working in the practice and should not be used to form any judgement about GP earnings, nor to make any comparisons with any other practice.

All GP practices are required to declare the mean earnings (eg average pay) for GPs working to deliver NHS services to patients at each practice.

The average pay for GPs working in Canbury Medical Centre in the last financial year (2022/23) was £69,735 before tax and National Insurance. This is for 1 full time GP, 7 part time GPs and 1 locum who worked in the practice for more than six months.

The current Central NHS Computer System is called the Summary Care Record (SCR). It is an electronic record which contains information about the medicines you take, allergies you suffer from and any bad reactions to medicines you have had.

Why do I need a Summary Care Record?

Storing information in one place makes it easier for healthcare staff to treat you in an emergency, or when your GP practice is closed. This information could make a difference to how a doctor decides to care for you, for example, which medicines they choose to prescribe for you.

You may need to be treated by health and care professionals that do not know your medical history. Essential details about your healthcare can be difficult to remember, particularly when you are unwell or have complex care needs. Having an SCR means that when you need healthcare you can be helped to recall vital information.

SCRs can help the staff involved in your care make better and safer decisions about how best to treat you.

You can choose to have additional information included in your SCR, which can enhance the care you receive. This information includes:

•    Your illnesses and health problems.

•    Operations and vaccinations you have had in the past.

•    How you would like to be treated – such as where you would prefer to receive care.

•    What support you might need.

•    Who should be contacted for more information about you.

Who can see it?

Only healthcare staff involved in your care can see your Summary Care Record.

How do I know if I have one?

If you are registered with a GP practice in England you will have a Summary Care Record (SCR), unless you have previously chosen not to have one. Over half of the population of England now have a Summary Care Record. You can find out whether Summary Care Records have come to your area by looking at our interactive map or by asking your GP. It includes important information about your health:

•    Medicines you are taking.

•    Allergies you suffer from.

•    Any bad reactions to medicines.

Do I have to have one?

No, it is not compulsory. If you choose to opt-out of the scheme, then you will need to complete our online

Summary Care Record Opt Out form. For further information visit the NHS Care Records website

When you register with us, you will be allocated a named, accountable GP, or if you prefer, you can request a GP of your choice.  Have a named GP is a requirement, but it doesn't mean that you are prevented from seeing any other doctor in the practice of your choice.

Similarly since none of the GPs here work five days a week, if your named doctor isn’t working on the day that you want to see or speak to someone, you can speak to any other doctor here as they all have full access to your medical records.

If you wish to be told the name of your GP, please ask Reception.  There is no need to telephone the practice for this information.

All newly registered patients will be given/allocated a named accountable GP on registration. There is no requirement to write to any patients regarding their named GP.

If you wish to change to another GP please let us know and we will make every effort to accommodate your preference.

Canbury Medical Centre and Berrylands Surgery have always been training practices for future GPs and this will continue with the merged practice. Dr Bower and Dr Jeevaratnam are both  qualified trainers.

The trainees are called GP Registrars and they normally complete a year with us before qualifying to practice independently.  Their training with us forms part of their speciality training to qualify as a GP.

Our current GP Registrar details can be found on the 'meet the team' page on this website. 

You may not be aware but when you turn 16 you become responsible for your own healthcare decisions. This information is for both you and your parent or guardian.

Canbury & Berrylands Surgery provides a confidential service to all our patients including under 16’s. You can contact a nurse online or contact a doctor online for advice and specifically request an appointment with a male or female clinician.

Confidentiality means that your consultation and visits to the surgery will not be discussed with anyone apart from you. The only time that information may be shared without consent is when you could be considered a danger to yourself or others.

If you have given proxy access to your parent or guardian to discuss your health, then this will be revoked once you turn 16. If you have been sharing a mobile phone number or email address with a parent or guardian, then those details will be removed from your medical record once you turn 16 and will then be replaced with your own contact details.

Something you may still wish to discuss with your parent or guardian is giving consent for treatment. A lot depends on the seriousness or difficulty of the proposed treatment. Health care professionals would encourage you to include your parent or guardian in any decision making process, however, they will always try to respect your wishes if you do not wish anyone else to be involved.

You may not be aware, but once you turn 16 you will have to start paying for your prescriptions, unless you are in full-time education, pregnant or receiving benefits. Please look at our website for prescriptions advice and how to register to order repeat medications online.

We offer a full range of sexual health services and all contraception including implants. If you need advice or have any questions, please call the practice on 02085 474270.

It is very important that we hold up to date contact details. Please ensure that we have your correct telephone numbers (home and mobile) and have a personal email address for you.

You may be interested in registering for Patient Access online, which will enable you to re-order repeat medication and view parts of your medical records. You may wish to check whether your parents have already registered for this on your behalf.

If you have always had someone order your medication for you, you can still allow this to happen by giving us written consent to allow your parent/guardian to make contact on your behalf with any queries about your medication or health. Your consent can be restricted to just ordering medications only if you choose or they can have access to your health information just as before you turned 16.

Patients should value the members of the practice team as professional advisers. This includes extending the same courtesy and politeness as they would expect to receive.

The practice is determined to ensure that no member of staff is subjected to intimidation and violence. ‘Violence’ means any incident where staff are abused, threatened or assaulted in circumstances related to their work, involving an explicit or implicit challenge to their safety, wellbeing or health.

Every violent incident, including verbal abuse, will be dealt with seriously and, where appropriate, reported to the police. Violence against fellow patients will be dealt with in the same way.

We are always looking for ways to enhance your experience and provide the best possible care.  We are now using AI to assist with clinical note-taking during consultations.  This technology allows us to spend less time typing and more time actively listening to and engaging with you, ensuring a more personalised and attentive consultation.

We understand the importance of your privacy.  We and our AI supplier have complied with stringent NHS guidelines regarding patient data.  However, if you prefer not to use this technology, we will happily continue with our traditional note-taking methods.  Your care will not be affected in any way by declining the use of AI.

Canbury & Berrylands Surgery Privacy Notice

Address: 1 Elm Road, Kingston, KT2 6HR/ Surbiton Health Centre, Ewell Road, Surbiton KT6 6EZ

General phone number: 02085474270/ 02083996362

Website: www.canburymedicalcentre.nhs.uk/ www.berrylandssurgery.nhs.uk

How do we get information and why do we need it?

We collect personal data directly from the data subject in the following circumstances:

• you have registered with us as a patient

• you have otherwise provided information to seek diagnosis or treatment

• you have submitted a request via our online request form

• you have signed up to our newsletter/patient participation group

• you have written to us with a complaint, enquiry, or request

We also receive personal information about you indirectly, and from other organisations in the following scenarios:

• from other health and care organisations involved in your care so that we can provide you with care and safeguard your best interests.

• from family members or carers to support your care

• from the ICB when you have made a complaint to them, or you have sought funding for continuing health care or personal health budget support

• from the local authority or other public authorities as necessary to perform their statutory functions

• from your advocates or solicitors when acting on your behalf

What information do we collect?

Personal data

Personal data is defined as any information which identifies or relates to a living individual who can be identified from that information.

We currently collect and use the following categories of personal data:

• your name, address, and contact details

• demographic information like your date of birth

• links to other people, such as carers, partners, or children

• information about your employment, workplace, social care, or education

• photographic identity (photo ID) when necessary to verify your identity

• voice/call recordings when you speak with us on the telephone

• CCTV imagery when you visit the practice

• your feedback, surveys, and general correspondence with the practice

Sensitive information

The UK GDPR requires organisations to apply extra protection to more sensitive information known as ‘special category data’. Information concerning health and care falls into this category and needs to be treated with extra care. Data that relates to criminal offences is also considered particularly sensitive.

We collect very sensitive, confidential data linked to your healthcare which is known as ‘special category personal data’. This is likely to include information about your health and care, religious beliefs, ethnicity, sexual orientation, and/or gender (if these are necessary in a healthcare context).

This is obtained during the services we provide to you and through other health providers or third parties who have provided you with treatment or care, e.g. NHS Trusts, other GP surgeries, Walk-in clinics etc.

We process the following more sensitive data (including special category data):

• Notes and reports about your physical and mental health

• Records about your treatment and care

• Results of investigations such as laboratory tests, x-rays etc

• Relevant information from other health professionals,

• Information about your relatives or those who care for you

• data revealing racial or ethnic origin

• data concerning a person’s sex life

• data concerning a person’s sexual orientation

• genetic data (for example, details about a DNA sample taken from you as part of a genetic clinical service)

• data revealing religious or philosophical beliefs

• data relating to criminal history or suspected criminal offences

e.g. CCTV imagery capturing suspicious or criminal behaviour, information shared with us by Local Authorities or law enforcement.

Appropriate Policy Document

In addition to this privacy notice, we have also published an appropriate policy document which relates to processing of sensitive patient and HR data.

This policy outlines the details we are required by law to make available to data subjects where we process special category or criminal offence data.

Common law duty of confidentiality

Common law confidentiality is not one law. Instead, it has been built up from centuries of court judgments. The key principle is that confidential information should not be used or disclosed, except as originally understood by the confider, or with their permission. However, our duty of confidentiality can be breached ‘in the public interest’ in exceptional circumstances, or when other legislation overrides it.

We sincerely value our patients’ trust and safety, and we are committed to respecting their privacy and ensuring confidential access to health care. So, we will only ever disclose the minimum confidential health information necessary when we are satisfied that we can do so lawfully.

For example, when you agree to receive direct care, we will rely on ‘implied consent’ and not ask you every time to share information with other health and social care services. This is because we have a legal duty to share confidential patient information in circumstances where a patient is unlikely to object, sharing is in their best interests, and doing so is likely to facilitate their direct care.

Examples of other reasons we may share confidential information include:

• the patient has provided us with explicit consent

• we have a legal obligation to collect, share or use the data without consent

• we have support from the Secretary of State for Health and Care following an application to the Confidentiality Advisory Group (CAG) who are satisfied that it isn’t possible or practical to seek consent

• for specific individual cases, we have assessed that the public interest in sharing the data overrides the public interest served by protecting the duty of confidentiality to the patient.

For example, sharing information with the police to support them in the detection or prevention of a violent crime and disclosure by the practice is reasonably likely to safeguard the patient or any other person from serious harm to their health or wellbeing.

This will always be considered on a case-by-case basis, including with advice from the Caldicott Guardian to support a careful assessment of whether the benefit of disclosing the minimum information outweighs the public interest in maintaining patient confidentiality.

Who do we share information with?

To provide safe, effective care around-the-clock, and improve the sharing of relevant information to our partner organisations when they are involved in looking after you, we will share information to our partner organisations.

Below is a list of organisations we are likely to share information with for your direct care:

The GP Practices within the Canbury, Churchill, Orchard and Berrylands (CCOB) Primary Care Network NHS Trusts/Foundation Trusts

Emergency services or NHS 111

Other GP Practices Local Authorities

Independent Contractors

e.g. dentists, opticians, pharmacists Community Services (District Nurses, Rehabilitation Services and out of hours services)

South West London Integrated Care Board (ICB) Care Homes and other social care services

Child Health Information Services (CHIS) Non-NHS Healthcare Providers

Primary Mental Health Multi Agency Teams (PCN MAT) NHS Cervical Screening Management System

Voluntary Sector Providers IT and service suppliers

Educational Services and Universities

This is list of organisations we are likely to share information with for your other purposes:

Care Quality Commission (CQC) General Medical Council (GMC)

Office for Health Improvement and disparities NHS England (NHSE) and NHS Digital

UK Health Security Agency (UK HSA) South West London ICB

Local Authorities Police and Judicial Services

Office for the Public Guardian Members of Parliament (MPs)

Other Public Authorities and Government Departments Insurers, prospective employers, and solicitors

Research providers OneLondon Data Services

What are your data protection rights?

Under data protection law, you have rights relating to your personal information, including:

Your right to be informed

This notice, along with all other written and verbal notification of our activities and your rights comply with our obligation to ensure you are informed about what we do with your information.

If you have any concerns or feedback on how we can do this better, please contact our DPO on swl.gpdpo@swlondon.nhs.uk.

Your right of access

You have the right to ask us for copies of your personal information (known as a subject access request).

Your right to rectification

You have the right to ask us to rectify personal information you think is factually inaccurate. You also have the right to ask us to complete information you think is incomplete.

This does not include professional opinions you disagree with.

More information about medical record amendment can be found here.

Your right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

However, requests for rectification and erasure will generally result in notes added rather than deletion or amendment of records due to legal restrictions.

Your right to restriction of processing

You have the right to ask us to restrict the processing of your personal information in certain circumstances.

Your right to object to processing

You have the right to object to the processing of your personal information in certain circumstances.

Your right to data portability

You do not have the right to ask that we transfer the personal information you gave us to another organisation, or to you, for the purpose of data portability.

However, we have a legal obligation to transfer your medical records to your new GP or to Primary Care Support England (PCSE) when you are no longer registered with us.

How do I make a request?

If you would like to make a request to exercise any of these rights, you can do so by contacting us with your request or asking to speak to the practice manager, Sarah Benton.

Please do not send information access requests or patient data to the Data Protection Officer (DPO).

It is important to explain that making a request does not necessarily mean the practice will be able to comply as we are not processing your information based on consent. We often have legal obligations to process information in a particular way which means we can’t stop using or delete information about you. However, you always have a right to ask, and we will carefully review each request on a case-by-case basis to make sure we are meeting our data protection obligations.

Online access via the NHS App

You can usually use the NHS app to access your recent medical records online by registering an account in the app, or on their website: www.nhsapp.service.nhs.uk/login.

If you are having difficulty using the app for any reason, or you would like to be able to see your older records, you can contact the practice and we will support you to access information you are seeking.

Data subject access requests (SARs or DSARs)

A SAR or DSAR is a request to access your personal information under UK data protection legislation. We always encourage patients to check whether the app will satisfy their needs first, wherever this is appropriate. However, you remain entitled to make a SAR if you prefer by contacting us via our website.

You are also entitled to make a request verbally in person or by phone, but we are usually able to respond more quickly if you make your request in writing. If you make a request to access your personal information, we will respond to you as soon as possible within one calendar month from the date we receive the request, or proof of your authority to request the information. We are allowed to extend this to a maximum of three months if complying with a request is complex.

The Information Commissioner’s Office (ICO) has an online tool which will help you to format your request in such a way that we are likely to be able to respond quickly: https://ico.org.uk/for-the-public/make-a-subject-access-request/.

If you are acting on behalf of someone else, you may wish to review our policy on sharing information with other people.

Charging a fee

You are not usually required to pay any charge for exercising your rights. However, we are entitled to refuse to comply or charge a fee for requests which are excessive, repeated, or request copies of your information in multiple formats. We will notify you of the fee and await confirmation before proceeding.

Charging a fee is an exceptional course of action, not routine. We reserve the right to refuse any request under this exemption outright. The charge to comply with a manifestly unfounded or excessive request will be calculated on a case-by-case basis to ensure that fees are based on proportionate, reasonable and justifiable. Doing so represents a cost‑recovery exercise for reasonable administrative costs only. This includes costs such as staff time and copying or postage; it is not applied as a deterrent or penalty.

Amending your medical record

You have the right to have any factual inaccuracies corrected. If you believe any information we hold contains a factual error, you can discuss this with your GP, or request that we investigate by contacting us via the practice website.

We are only able to rectify or erase information which is inaccurate or misleading as to any matter of fact. There is no obligation to amend professional opinion; however, sometimes it is difficult to distinguish between fact and opinion.

Where you and the health professional cannot agree on whether the information in question is accurate, you can ask that a statement is included to set out that the accuracy of the information is disputed by you.

More information about what we can and can’t change can be found on the ICO, the Londonwide Local Medical Committee, and the Medical Protection Society websites - which we rely on when making decisions about how to handle disputed records.

Contact with you

When you register with Canbury & Berrylands Surgery, we will ask you for your preferred methods of contact and any reasonable adjustments you would like to request.

If you do not specify any preference, we will use any channel provided to communicate with you about your healthcare, i.e. by letter (postal address), voicemail or voice-message (telephone or mobile number), text message (mobile number) or by email (email address).

You can let us know or change your contact preferences at any time by contacting us via our website or by phone.

Please note: we record all inbound and outbound calls with the practice for training and monitoring purposes. These are stored and automatically deleted after 6 months amount of time.

What is our lawful basis for using information?

Personal information

Under the UK General Data Protection Regulation (UK GDPR), we must identify the lawful basis we rely on for using personal information.

To provide routine NHS care and treatment we rely on:

UK GDPR - Article 6(1)(e) - ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’

This is sometimes referred to as the ‘Public Task’ basis because it relates to delivery of public services. This list shows the most likely laws that apply when using and sharing information in health and care.

Sensitive personal data (special category and criminal offence)

Under UK GDPR, Data Controllers are not allowed to use sensitive types of personal information unless it is the minimum necessary and is lawful for a specific reason.

When we are using your sensitive information to perform our public tasks, like information about your health to provide you with direct care, we must also have an additional lawful basis for specific processing purposes.

To rely on these lawful bases, we must also meet some additional conditions and safeguards, like ensuring that all processing of special category personal data for health and social care purposes is carried out under the responsibility of registered health professional and/or other professionals subject to duties of confidentiality under UK law.

More detailed information about this processing can be found in our Appropriate Policy Document.

Some examples of activities we perform as part of this lawful basis are:

Running the Practice

We use your personal information to provide high‑quality NHS care and ensure continuity when you move between services.

This includes contacting you, booking appointments, recording consultation notes, making referrals, and issuing fit notes, letters, and prescriptions.

We also use your information for essential administration, such as handling complaints and processing requests or payments for NHS‑funded services.

Primary Care Networks (PCN)

We work closely with local practices and care organisations as part of our Primary Care Network to support direct patient care.

Clinicians and administrators from other practices may access your information, but only where necessary to provide you with direct care you have agreed to receive, or to support us with administrative and IT maintenance tasks.

Extended Access

We offer medical services outside normal hours through formal arrangements with the Integrated Care Board and designated ‘hub’ practices. These practices need access to your medical record to provide the service. Robust data‑sharing agreements ensure your information is protected and used only for this purpose.

Medicines Management

The practice may review your prescribed medications to ensure treatments are appropriate, up‑to‑date and cost‑effective. Specialist pharmacists employed by the local ICB may access your records to support this work and help manage your care.

Individual Funding Requests

With your consent, a clinician may submit an Individual Funding Request for specialised treatment not routinely funded by the ICB. Requests are considered where there are exceptional clinical circumstances or when the treatment is new or experimental. A detailed decision, including criteria considered, is provided to your clinician.

Safeguarding and serious crime

We work closely with local authorities who arrange health, education, and social care support, and law enforcement authorities where necessary to protect children and vulnerable adults at risk of harm.

We will share whatever information we consider is necessary in the best interests of the patient, or where the law places a duty on us to do so. This includes suspicion of serious harm to vulnerable individuals, or any other member of the public we consider is likely to be at risk of serious harm.

We will only ever share the minimum information necessary with another health provider or law enforcement authority, and only do so where you have consented, or where the law allows.

Patient Engagement and other contact necessary to provide you with appropriate NHS services

We will contact you where it is necessary to provide you with care, offer suitable care, and perform our public duties and obligations to consult with patients and seek their views.

You are sometimes able to object to this processing, and we will no longer contact you using that contact method or about a particular subject or service.

Invoice Validation

Invoice validation is an important process. It involves using your NHS number to check that the ICB is responsible for paying for your treatment.

Section 251 of the NHS Act 2006 provides a statutory legal basis to process data for invoice validation purposes. We can also use your NHS number to check whether your care has been funded through specialist commissioning, which NHS England will pay for.

The process makes sure that the organisations providing your care are paid correctly.

Workforce planning

Analysis of patients’ health data as necessary to generate insights on current activity and identify opportunities to improve effectiveness and efficiency of health provision.

Legal claims and Legal Professional Privilege

We are permitted to process the minimum patient information necessary establish, exercise or defend legal claims without notifying you or requesting your consent.

Most of our work falls under our public tasks. However, there are some circumstances where we rely on other lawful bases:

Lawful basis Specified Purposes

Article 6(1)(a) – Consent

‘the data subject has given consent to the processing of his or her personal data for one or more specific purposes’

We rely on this lawful basis to collect analytics information through cookies on our website.

It also applies when we send our newsletters, ask for your feedback, or any other contact we make with you that is not related to your individual healthcare.

You can refuse or withdraw your consent for these activities at any time, and we will not keep, use, or share your data for the relevant purpose.

Article 6(1)(b) – Contract with you

‘processing is necessary for the performance of a contract to which the data subject is party or in order to take steps at the request of the data subject prior to entering into a contract’

We rely on this lawful basis when providing non-NHS or private services which are chargeable. For example, non-NHS funded travel vaccinations, medical letters and examinations.

Our list of chargeable services can be found on our website.

We also rely on this lawful basis when processing information necessary for employment.

Article 6(1)(c) – Legal obligation

‘processing is necessary for compliance with a legal obligation to which the controller is subject’

This lawful basis applies when we have an obligation laid down in legislation which requires the practice to process specified information in order to comply with the law. Examples of applicable legal obligations include:

• provide data to NHS England under Data Direction or Provision Notice

• notify CQC of serious injuries, allegations of abuse, or incidents involving the police

• report notifiable diseases to the UK Health Security Authority

• produce information as instructed by a court order, warrant, or other statutory notice

• comply with a police request to assist in identification of a driver alleged to have committed a road traffic offence.

• notify the police of any suspected or declared terrorist activities

• notify the police of any known cases of female genital mutilation (FGM)

• complying with an FOI or UK GDPR request

Public Health, Research, and Planning Purposes

The information collected about you when you use health and care services is often also used and provided to other organisations for purposes beyond your individual care, for instance to help with:

● improving the quality and standards of care provided

● research into the development of new treatments

● preventing illness and diseases

● monitoring safety

● planning services and workers

All these uses of data help to provide better healthcare services for you, your family and future generations. Confidential health and care information is only used like this when allowed by law.

More detailed information about this can be found on the NHS Digital’s ‘How data is used to improve health and care’ webpage.

Whenever possible, patient-level data used for research and planning is anonymised, so that you cannot be identified and your confidential information is not accessed outside of the practice. However, it is sometimes ‘pseudonymised’ or ‘de-identified’ when necessary - which means that the practice or another NHS organisation would be able to re-identify you, but the people using it can’t.

This is usually done in your best interest, as it allows researchers to inform the practice if they identify anything which indicates a problem that should be investigated further.

The other organisations who most often access GP patient data for these reasons and some examples of their work can be found below:

South West London ICB

Population Health Management

Risk Stratification

NHS England/NHS Digital

Individual GP level data

General Practice Extraction Service (GPES)

General Practice Data for Planning and Research (GPDPR)

NHS Federated Data Platform

OpenSAFELY Data Analytics Service pilot

Clinical Audits and Registries

Universities and Research bodies

OneLondon Secure Data Environment

RM Partners Cancer Alliance

National Institute for Health and Social Care Research (NIHR) – Clinical Research Network

Archiving Medical Records in the public interest

Under the Public Records Act 1958, all NHS organisations are expected to appraise and consider transferring up to 5% of its records (including confidential health and care records) for long-term preservation on an annual basis. This is done to benefit the public interest so that future generations can use them for scientific and historical research.

If we are considering whether to transfer your records while you are alive, we will consider your views as part of our public interest balancing test when deciding whether to transfer the records for preservation.

If you object, we will respect your wishes not to transfer copies of these records during your lifetime. However, you cannot opt out of this processing.

We may continue to retain them for potential transfer in the public interest for up to 30 years after you have passed away.

More detailed information about this processing can be found in our Appropriate Policy Document.

Can I opt-out of data sharing?

We respect your right to consent to care, refuse treatment, and control who your information is shared with whenever possible. However, you can’t usually opt out of the things we need to use your personal data for direct care purposes without refusing that care, or reducing the efficiency and security of it, because there are lots of laws and duties that we have to comply with.

This means that in most cases, we collect, share, and retain whatever is the minimum data necessary to provide you with the direct care you need, and make sure the public can receive safe, high-quality NHS care. However, there are some cases where you have a choice to register your objection, share your preferences, and minimise the number of things your data can be used for apart from your direct health care.

More information about the different ways you can restrict access to your NHS patient record for purposes other than providing you with direct care can be found in our Opt-Out guidance.

How do we store your personal information?

We store personal information in a variety of different locations and systems. More detailed information about the systems in use by the practice that are used to store personal data managed using the guidelines from this code can be found in our Websites and Digital Systems notice.

We store identifiable data about patients in the following formats:

Records Format Storage system

Digital patient health records Specialist IT and software solutions

Paper patient health Records Filing/Archive room secured by ID key card

Filing cabinets secured by physical key.

Digital Call recordings

Call recording service provider or onsite server maintained by service providers e.g. X-on Health

Digital correspondence

Specialist IT and software solutions

Paper correspondence

Filing/Archive room secured by ID key card

Filing cabinets secured by physical key.

Physical media

Photographs, slides, and images, Audio and video tapes, CD-ROM etc

Filing/Archive room secured by ID key card

Filing cabinets secured by physical key.

Metadata & access logs

Specialist IT and software solutions

How long will you keep it?

Your information is securely stored for the time periods specified in the NHS Records Management Code of Practice. For example, your GP health record must be retained for your entire life, plus a minimum of 10 years after your death.

We also dispose of information we no longer need in accordance with the NHS Records Management Code of Practice and any other contractual or policy standards set by the government.

For example, we will:

● Securely dispose of your digital information by deleting the data or wiping devices or hard drives. All digital disposals will be undertaken to legal standards of destruction and certified.

● Securely destroy confidential paper records by transferring them to Data Shred who destroy them according to legal security standards.

● Archive your information at the Local Place of Deposit in line with the Public Records Act 1958.

Is information transferred outside the UK?

Under the UK GDPR and other data protection law, information about you may only be transferred from your region to other regions if certain requirements are met.

In most cases, we don’t transfer information outside of the UK, and we store your digital information in the UK or EU.

While providing our services, we may occasionally need to transfer your data to doctors working in countries outside of the jurisdiction in which you reside. For example, if you are have dual-nationality or fall ill on holiday we may ask for consent to share information about you with local health professionals.

These countries may have data protection laws that differ from those in the UK. We will take all necessary steps to ensure that your personal data is adequately protected as required by applicable data protection laws. The transfer of your personal data outside of your country of residence may be necessary for a consultation to take place between you and a Canbury & Berrylands Surgery clinician. Additionally, your explicit consent may serve as the legal basis for certain data transfers.

When transferring your personal data internationally, we will employ appropriate safeguards to ensure its security and protection. Such safeguards may include:

Standard Contractual Clauses: We may use contractual agreements approved by relevant data protection authorities to ensure that your personal data receives the same level of protection as required in your country of residence.

Adequacy Decisions: If the UK authorities have determined that a specific country ensures an adequate level of data protection, we may rely on such decisions for the transfer of personal data to that country. The current list of countries currently granted ‘adequacy’ status can be found here. Appropriate data transfer risk assessments and international data transfer assessments will be undertaken as required to meet appropriate legislative requirements.

Canbury & Berrylands Surgery also confirm that the clinicians we retain to provide our services are required to adhere to our Privacy Policy and principles as well as all applicable Data Protection Laws and Regulations.

Automated decision making

We do not currently use personal information in any ways which would result in an automated decision being made about you without human involvement.

How do I complain?

If you have any concerns about our use of your personal information, you can make a complaint to us by contacting us at the surgery.

Following this, if you are still unhappy with how we have used your data, you can then complain to the ICO on their website: https://ico.org.uk/make-a-complaint/data-protection-complaints/

If you need any extra help or have any questions, you can also contact them by phone on 0303 123 1113, or one of their other contact methods.

Data Protection Officer contact details

Our Data Protection Officer is Laura Watson. They are responsible for monitoring our compliance with data protection requirements.

You can contact them with queries or concerns relating to the use of your personal data at swl.gpdpo@swlondon.nhs.uk.

Please include the practice name in any correspondence. Our GP DPO service supports lots of practices across SWL – not just Canbury & Berrylands Surgery.

Please do not send requests or patient clinical data to the DPO. Send these directly to the practice via our website.

Date of last review: June 2026 – next review in 12 months