Privacy

Version 3.0 · Effective 15 July 2026 · Next review due 15 July 2027

Who we are

Eastfield Medical Practice is a GP partnership providing NHS primary medical services under a General Medical Services contract with NHS Lothian. The practice is the data controller for personal information where it decides how and why that information is used.

Data controller

Eastfield Medical Practice, Eastfield Farm Road, Penicuik, EH26 8EZ · 01968 675 576

Local privacy lead

Practice Manager · clinical.s77036@nhs.scot

Data Protection Officer

NHS Lothian Information Governance, Woodlands House, 74 Canaan Lane, Edinburgh EH9 2TB · 0131 465 5444 · Loth.DPO@nhs.scot

This notice applies to patients and may also apply to carers, representatives, complainants, visitors, contractors, suppliers and others whose information is handled by the practice.

Information we use and where it comes from

We may use identifying and contact details; CHI and NHS identifiers; health history, symptoms, diagnoses, medicines, allergies, results, vaccinations, referrals and care plans; appointment and attendance records; communication and accessibility needs; safeguarding information; prescription, fit-note and administrative requests; complaints, incidents and legal correspondence; call recordings; and information about representatives.

Most information comes from you. We may also receive relevant information from hospitals, NHS Lothian, NHS 24, community services, pharmacies, laboratories, screening services, other GP practices, social care, carers or representatives, and public bodies where there is a lawful reason.

Why we use information and our lawful bases

We use information to identify patients; provide and coordinate care; prescribe safely; manage appointments, results, referrals and correspondence; contact patients; process requests; maintain accurate records; safeguard people; manage complaints and incidents; support audit, quality improvement, public health and NHS contractual functions; run the practice; and meet legal or regulatory duties.

For most NHS care and related administration, the lawful basis is UK GDPR Article 6(1)(e), public task. We may also rely on legal obligation, vital interests or another lawful basis where appropriate. Health information is usually processed under Article 9(2)(h), health or social care. Other Article 9 conditions may apply for public health, substantial public interest, safeguarding, legal claims, research or statistics with appropriate safeguards.

We are also bound by duties of confidentiality. Confidential information is only used or shared for care, with consent where required, where another lawful basis applies, where there is an overriding public interest, or where disclosure is required by law.

Who we may share information with

Where necessary and lawful, relevant information may be shared with hospitals, NHS Lothian services, NHS 24, out-of-hours services, community nursing, health visiting, maternity, mental health, physiotherapy, pharmacies, laboratories, screening services, social care, other GP practices, Practitioner Services, NHS National Services Scotland, Public Health Scotland, regulators, auditors, courts, police or safeguarding bodies.

For planning, audit and service management, information is anonymised or de-identified wherever possible. We do not sell patient information.

Systems and communication channels

Clinical and document systems

Authorised staff use electronic clinical and document-management systems for records, appointments, consultations, prescribing, results, referrals, correspondence and workflow. Access is controlled through individual accounts, role-based permissions and audit logs. Staff must have a legitimate work-related reason to access information.

Email, SMS and Patient Services

NHS email and approved messaging systems may be used for care and administration. Messages may be saved to the clinical record where relevant. SMS can be seen by anyone with access to a device, so we limit sensitive content. Patient Services processes prescription and other enabled online requests under its own privacy arrangements and the practice records relevant requests where needed.

This website

This website has no practice submission forms, analytics, advertising cookies or profiling. Search terms and checklist choices are processed only in your browser. Local browser caching supports offline access and is not used to track you. Hosting and content-delivery providers may process limited technical information, such as IP address, requested page, device information and security logs, to deliver and protect the site.

MedLink details update service

Existing patients can use MedLink to submit changes to registration and contact details. MedLink acts as an external service provider and processes the information needed to send the request securely to the practice. Relevant information is matched to the patient record, reviewed by authorised staff and entered into the clinical system where appropriate. MedLink has its own privacy information on the form service.

Telephone calls and call recording

Calls to and from the practice telephone system may be recorded. Callers are informed through a recorded message or other suitable notice. Recordings may be used for patient and staff safety, quality monitoring, training, complaints, incident review, checking information given during a call, establishing facts, regulatory or professional standards, crime prevention, investigating abusive or threatening behaviour and effective telephone-system operation.

Access is restricted to authorised staff. Recordings are normally retained for one calendar month. A recording may be kept longer where needed for a complaint, incident, safeguarding concern, patient-safety review, abusive behaviour, legal claim, police request, regulatory requirement or other lawful investigation. Recordings are not routinely added to the medical record, although relevant information from a call may be documented.

CCTV

CCTV supports safety, security and crime prevention in reception, corridors, entrances and external areas. There is no CCTV in consulting rooms, examination rooms or toilets. The current system is live-view only and does not store retrievable footage. This notice will be updated if recording is enabled.

Suppliers and international access

Approved suppliers may support clinical systems, document management, telephone services, hosting, NHS email, SMS, security, finance or IT. Suppliers acting for the practice must follow contractual confidentiality, security and data-protection requirements. Where access or hosting outside the UK is involved, an appropriate lawful transfer safeguard must be in place.

Safeguarding, incidents and research

Relevant information may be used or shared to protect children or adults at risk, respond to serious harm, manage incidents or breaches, meet public-health duties, support legal claims or participate in approved audit, planning or research. The minimum necessary information and appropriate safeguards are used.

How long we keep information

Records are kept in line with the Scottish Government Records Management Code of Practice for Health and Social Care, NHS requirements and applicable law.

Your data-protection rights

Depending on the circumstances, rights include being informed, access, correction, restriction, objection, erasure in limited circumstances, portability in limited circumstances and safeguards around automated decision-making. Erasure and portability are often limited for NHS medical records because accurate information must be retained for care and legal duties.

Subject access requests

You may ask verbally or in writing for a copy of your personal information. We may request proportionate proof of identity or authority. We normally respond within one month. Complex requests may be extended by up to two further months with an explanation. Requests are usually free, although a reasonable fee is permitted in limited circumstances.

Information may be redacted where it identifies another person, contains confidential third-party information, disclosure could cause serious harm, or another legal restriction applies.

Automated decisions

The practice does not make decisions about care, treatment or legal rights solely through automated processing. Digital tools may support alerts, coding, risk identification or workflow, but appropriate people make care decisions.

Concerns and complaints

Contact the Practice Manager or DPO using the details above. You may also complain to the Information Commissioner's Office at ico.org.uk or 0303 123 1113.

Common questions