The General Data Protection Regulation (GDPR) provides several rights to individuals. The practice must generally respond to requests in relation to you exercising any of these rights within one month, although there are some exceptions to this. The availability of some of these rights depends on the legal basis that applies in relation to the processing of your personal data, and there are some other circumstances in which we may not uphold a request to exercise a right. Your rights and how they apply are described below.
Right to be informed
Your right to be informed is met by the provision of this privacy information, and similar information when we communicate with you directly; at the point of contact.
Right of access
You have the right to obtain a copy of the personal information that we hold about you and other information specified in the GDPR, although there are exceptions to what we are obliged to disclose. A situation in which we may not provide all the information your request is where, in the opinion of an appropriate health professional, disclosure would be likely to cause serious harm to you, or somebody else’s physical or mental health. See the ‘How can you access your information?’ section for further details.
Right to rectification
You have the right to ask us to rectify any personal information that we hold about you that you consider is inaccurate.
Right to erasure (‘right to be forgotten’)
You have the right to request that we erase personal information about you that we hold. This is not an absolute right, and depending on the legal basis that applies, we may have overriding legitimate grounds to continue to process the information.
Right to restriction of processing
You have the right to request that we restrict processing of personal information that we hold about you. You can ask us to do this, for example, where you contest the accuracy of the data.
Right to data portability
This right is only available where the legal basis for processing under the GDPR is consent, or for the purposes of a contract between you and the Practice. For this to apply the information must be held in electronic form. The right is to be provided with the data in a commonly used electronic format.
Right to object
You have the right to object to the processing of your personal information about you on the grounds relating to your particular situation. The right is not absolute, and we may continue to use the data if we can demonstrate compelling legitimate grounds.
Rights in relation to automated individual decision-making including profiling
You have the right to object to being subject to a decision based solely on automated processing, including profiling. Should we perform any automated decision-making, we will record this in our privacy information, and ensure that you have an opportunity to request that the decision involves personal consideration.
Right to complain to the Information Commissioner
You have the right to complain to the Information Commissioner if you are not happy with any aspect of the Practice processing your personal information or you believe that we are not meeting our responsibilities as a data controller.
The contact details are:
Address: Information Commissioner’s Office, Wycliffe House Water Lane, Wilmslow SK9 5AF
Phone: 0303 123 1113
Website: www.ico.gov.uk