GP Online Consultation Service Privacy Notices

Introduction

By law, all organisations that use personal information (personal data) must provide a clear description of how it is used and also provide any related information to ensure the processing is carried out lawfully and fairly. Your GPs main Privacy Notice is available on their website (or please contact their reception).

The additional information provided below describes only the use of your information when you use your GPs online consultation service. Where there are differences depending on the location of your Practice (England, Wales, Scotland or Northern Ireland), these are specifically noted below.

Please ensure you read your GPs main Privacy Notice and if you wish to use their online consultation service here, please also read the supplementary information below:

Online Consultation Service if your GP Practice is in England

Your GP Practice has engaged a specialised online consultation supplier which is approved to NHS England technical standards and has gone through stringent scrutiny and achieved all necessary requirements to provide Online Consultations. NHS England, on behalf of your GP, contracts with the supplier and acts as a Joint Controller with your GP for this system. However, NHS England will not receive any of your personal information, so your GP remains responsible for your data and will ensure that any data you provide to use this service is used for the online consultation purposes only.

The name of the organisation we have engaged to provide this service is eConsult Health Ltd. (eConsult), who will act as a Processor of your personal data under GDPR.

NHS Digital enables your connection to eConsult, your GPs specialised online consultation supplier through their secure authentication service known as NHS login. NHS Digital does this on behalf of your GP. If you use NHS login, NHS Digital will also act as a Processor under GDPR.

Online Consultation Service if your GP Practice is in Wales, Scotland or Northern Ireland

Your GP Practice has engaged a specialised online consultation supplier which has gone through stringent scrutiny and achieved all necessary requirements to provide Online Consultations. Your GP has contracted with the supplier and acts as a Controller for this system. Your GP remains responsible for your data and will ensure that any data you provide to use this service is used for the online consultation purposes only.

The name of the organisation your GP has engaged to provide this service is eConsult Health Ltd (eConsult), who will act as a Processor of your personal data under GDPR.

What is the lawful basis for your GPs online consultation service?

The following legal bases set out in the General Data Protection Regulation (GDPR) and UK Data Protection Act 2018 allow your GP to use your information when you use this online consultation service provided by them:

  1. When using your Personal Information (Personal Data):

    Article 6 (1) (e) of the GDPR, which permits us to process your personal information that is necessary to provide a service which is in the public interest

  2. When using your Sensitive Personal Information (Sensitive Personal Data):

    Article 9(2) (h) of the GDPR which permits us to process your health information which is necessary for the provision of health treatment.

What are the purposes of the processing?

Online consultations allow the GP’s patients to contact the Practice without having to wait on the phone or take time to come into the practice in person especially if a patient is not sure whether they need a face to face consultation. Online consultations enable patients to use a secure online system to ask questions, report symptoms and we can then respond by signposting patients to the right person e.g. a Doctor or to appropriate service or support.

What personal information is used?

Because this service is online, your GP’s need to ensure that they continue to provide you with a confidential and high-quality service. To do so, they need to properly identify you, accurately note both your request and their responses. If they were prevented from using this essential information, then they would be unable to provide the service securely and confidentially.

Information which is not needed for the service is not collected by eConsult.

If your GP practice is in England:

Your GP uses the following information to identify and deal with your request.

  1. Identity and Contact Information: includes name, gender, date of birth, NHS number, email address and telephone number, postal address. If you have created an NHS login account you will already have verified who you are and you can, if you wish, use those details from your NHS login account to save you time and avoid having to manually enter your details to re-identify yourself to use the Online Consultation service.
  2. Special Categories of Personal Information: your health information such as your symptoms, conditions, medication and other details which are already held in your GP records and / or which you provide through the online consultation process.

If your GP Practice is in Wales, Scotland or Northern Ireland:

Your GP uses the following information to identify and deal with your request.

  1. Identity and Contact Information: includes name, gender, date of birth, NHS number, email address and telephone number, postal address.
  2. Special Categories of Personal Information: your health information such as your symptoms, conditions, medication and other details which are already held in your GP records and / or which you provide through the online consultation process.
    Please refer to your GP Practice’s main Privacy Notice for any further information.

Do we share your personal information?

Your GP controls your information

For GP Practices in England, NHS England confirms that they will only use your information to provide you with health services.

For GP Practices in Wales, Scotland and Northern Ireland, please refer to the individual GP Practice’s main Privacy Notice in relation to the use of your information.

As mentioned earlier, your GP has engaged eConsult, a specialised organisation to provide this online consultation service on their behalf, so your personal data will be shared with them in order for them to provide this service to you.

If you are advised to seek urgent care, your information will not be shared with other health and care providers. 

If your GP practice is in England:

The online consultation service is also made available to our patients who use the NHS App which can be downloaded from the App Store and Google Play. The NHS App is provided by NHS Digital and provides health services such as viewing your medical record. If you are logged into the NHS App, then you will also have access to your GPs online consultation service and the requests you make to them will be securely sent from the NHS App to their Practice system via NHS Digital. 

Whenever your GP shares your information, they will always comply with the law.

Where is your information processed and stored?

It is processed and stored within the United Kingdom.

How long is your personal information kept?

Your GP practice sets the retention periods for your information and instruct eConsult, their engaged contractor that provides this service on your GP practice’s behalf, to comply with these periods.  When your information has been copied to your GP’s own systems then your sensitive information will be deleted by eConsult. eConsult retain your contact details (name, email) for up to 5 weeks, in order to facilitate communication relating to the consultation, after which they are automatically deleted.

If you have been advised online to seek urgent care elsewhere, then your information will not be transferred to us and will not be retained after you have read the advice given.