Privacy Notice

Brook Preventative Care is the trading name of:

BPC provides and coordinates preventative healthcare programmes. BPC is a separate legal entity from The Brook Surgery Limited.

Where your BPC programme involves clinical assessment, medical advice, clinical interpretation of results or other regulated clinical services, those services are provided by appropriately qualified clinicians acting through:

TBS is registered with the Care Quality Commission and is responsible for the clinical services provided through its clinicians.

View The Brook Surgery Limited on the CQC register ↗

BPC and TBS are separate organisations and each may be a data controller for personal information it processes for its own purposes.

This means that each organisation is responsible for deciding why and how it uses the personal information for which it is responsible.

Brook Preventative Care

BPC is principally responsible for information used to:

• manage your registration and BPC account;
• administer the BPC programme;
• manage bookings and appointments;
• communicate with you;
• coordinate services between you, TBS and diagnostic providers;
• process payments;
• administer your membership or programme;
• operate and improve the BPC service;
• respond to enquiries and complaints concerning BPC services; and
• send marketing communications where permitted.

BPC may also process health information where this is necessary to coordinate your preventative healthcare programme.

The Brook Surgery Limited

TBS is responsible for personal information processed as part of the clinical services it provides.

This includes information used to:

• assess your health;
• provide clinical consultations;
• determine which investigations may be appropriate;
• interpret clinical information and investigation results;
• make clinical recommendations;
• maintain your clinical record;
• manage abnormal or incidental findings;
• make or facilitate clinical referrals;
• communicate with other healthcare professionals; and
• meet its professional, clinical governance and regulatory obligations.

TBS's processing of clinical information is governed by its own professional, legal and regulatory responsibilities.

BPC does not determine the clinical decisions made by TBS clinicians.

The information collected will depend upon the services you use.

We may collect the following categories of information.

Identification and contact details

This may include:

• name;
• title;
• date of birth;
• sex;
• postal address;
• telephone number;
• email address;
• emergency contact details; and
• details of your usual GP or other healthcare professionals.

Account and administration information

This may include:

• registration details;
• BPC account information;
• appointment information;
• correspondence;
• preferences;
• programme or membership information;
• invoices;
• payments and transaction records; and
• records relating to enquiries, cancellations or complaints.

Health and medical information

Because BPC is a preventative healthcare service, information processed within the service may include particularly sensitive information about your health.

This may include:

• current and previous medical conditions;
• symptoms;
• medication;
• allergies and adverse reactions;
• family medical history;
• lifestyle information;
• smoking and alcohol history;
• diet and exercise;
• height, weight and other measurements;
• blood pressure and other physiological measurements;
• previous investigations;
• blood and laboratory results;
• imaging results;
• clinical reports;
• diagnoses;
• risk assessments;
• clinical recommendations;
• referrals;
• specialist correspondence; and
• information about treatment and follow-up.

Depending upon the services provided, this may also include genetic, biometric or other special-category information where relevant.

We only seek health information which is reasonably relevant to the provision, coordination or administration of your healthcare.

Most information will be provided directly by you.

For example, you may provide information when you:

• visit our website;
• complete an enquiry form;
• join a waiting list;
• register for BPC;
• complete a health or lifestyle questionnaire;
• book an appointment;
• communicate with BPC;
• attend a consultation;
• provide previous medical records or test results;
• consent to an investigation;
• make a payment; or
• contact us with a question or complaint.

It is important that information you provide about your health is accurate and complete to the best of your knowledge.

We may also receive information about you from other healthcare organisations and professionals involved in your care.

These may include:

• The Brook Surgery Limited;
• your usual GP;
• NHS organisations;
• private GPs;
• laboratories;
• imaging providers;
• hospitals;
• consultants and specialists;
• pharmacies;
• other healthcare professionals; and
• diagnostic or treatment providers.

For example, a laboratory may send the result of a blood test and an imaging provider may send a radiology report following an investigation arranged as part of your BPC programme.

Where information is obtained from another source, it will only be used where there is an appropriate lawful basis for doing so.

We may use your personal information to:

Provide and administer your BPC service

Including:

• registering you;
• managing your account;
• arranging appointments;
• administering your programme;
• communicating with you;
• coordinating investigations;
• processing payments; and
• providing customer support.

Coordinate healthcare

This can include providing relevant information to TBS so that its clinicians can provide clinical services and coordinating investigations with laboratories and imaging providers.

Provide clinical care

TBS may use your information to:

• undertake clinical assessment;
• provide medical advice;
• assess health risks;
• determine appropriate investigations;
• interpret results;
• make recommendations;
• communicate findings;
• arrange referrals; and
• manage follow-up.

Protect patient safety

Information may be used where necessary to:

• identify and manage abnormal results;
• manage urgent or critical findings;
• investigate incidents;
• contact you about an important clinical matter;
• communicate with another healthcare professional; or
• protect you or another person from serious harm.

Maintain appropriate records

TBS is required to maintain appropriate clinical records.

BPC also maintains appropriate administrative, financial and operational records.

Meet legal and regulatory obligations

Information may be processed where necessary to meet obligations relating to:

• healthcare regulation;
• professional standards;
• safeguarding;
• complaints;
• taxation and accounting;
• fraud prevention;
• data protection;
• legal claims; and
• other applicable laws.

Improve our services

We may analyse information to understand how our services operate, improve patient experience, develop services and maintain quality.

Where reasonably possible, information used for analysis or service improvement will be anonymised or aggregated.

UK data protection law requires us to have a lawful basis for processing personal information.

Different lawful bases may apply to different activities.

Ordinary personal information

Depending upon the circumstances, we may rely upon:

Contract

Processing may be necessary to provide services you have requested or to take steps at your request before entering into an agreement with you.

For example, this may apply to registration, booking, programme administration and payment.

Legal obligation

We may need to process information to comply with legal or regulatory obligations.

Legitimate interests

We may process information where this is necessary for legitimate interests pursued by BPC, TBS or another organisation and those interests are not overridden by your rights and interests.

This may include appropriate administrative, security, operational, fraud-prevention and service-management activities.

Vital interests

In exceptional circumstances, information may be processed where necessary to protect someone's life.

Consent

We may rely on your consent where appropriate, particularly for optional activities such as certain forms of direct marketing.

Where we rely on consent, you may withdraw that consent.

Information concerning your health is classed as special-category personal data under UK data protection law and receives additional protection.

TBS will normally process health information where this is necessary for:

• medical diagnosis;
• provision of healthcare;
• treatment;
• preventative healthcare;
• management of healthcare services; and
• associated clinical governance,

in accordance with applicable UK data protection legislation and professional duties of confidentiality.

BPC may process health information where necessary and lawful for the administration and coordination of your preventative healthcare programme.

The precise legal basis will depend upon the purpose for which the information is being used.

Where the law requires specific or explicit consent for a particular use of special-category information, this will be obtained separately.

Consent to medical treatment or an investigation and consent under data protection law are separate concepts.

Accepting this Privacy Notice does not constitute consent to a medical procedure, investigation or treatment.

BPC and TBS need to share certain information to operate the BPC patient pathway safely and effectively.

For example:

• BPC may provide registration information and health questionnaires to TBS;
• TBS may provide information necessary to coordinate investigations;
• clinical results may need to be available to the responsible TBS clinician;
• BPC may need information concerning the status of an appointment, investigation or referral;
• clinically important information may need to be communicated to enable appropriate follow-up.

Only information reasonably necessary for the relevant purpose should be shared.

Clinical records held by TBS remain subject to TBS's clinical confidentiality and information-governance responsibilities.

Where investigations are arranged, information may need to be shared with laboratories, imaging centres and other diagnostic providers.

This may include information necessary to:

• identify you;
• arrange the investigation;
• establish that the investigation is appropriate;
• identify contraindications or clinical risks;
• conduct the investigation safely;
• report the result; and
• enable clinical interpretation and follow-up.

Diagnostic providers may also be independent data controllers and may provide you with their own privacy information.

Where further assessment or treatment is recommended, relevant information may be shared with:

• your usual GP;
• another GP;
• hospital clinicians;
• consultants;
• specialists;
• physiotherapists;
• dietitians or nutrition professionals;
• pharmacists; or
• other healthcare professionals involved in your care.

Where appropriate, we will discuss referral or information sharing with you.

Healthcare professionals may sometimes have a professional or legal obligation to share information without consent, for example where this is necessary to protect someone from serious harm or where disclosure is required by law.

We strongly encourage patients to ensure that their usual GP has access to important information relevant to their ongoing healthcare.

With appropriate authority and where clinically appropriate, TBS may send relevant reports, results or clinical recommendations to your GP.

There may also be circumstances in which a clinician considers it necessary or appropriate to contact your GP because of a significant clinical or safeguarding concern.

Any such disclosure will be considered in accordance with applicable law and professional confidentiality obligations.

We may use third-party organisations to help operate BPC and TBS services.

These may include providers of:

• patient-record systems;
• appointment systems;
• secure communications;
• video consultations;
• cloud hosting;
• website hosting;
• payment processing;
• telephony;
• email and SMS;
• document storage;
• IT support;
• accounting;
• professional advice; and
• other administrative or technical services.

Where an organisation processes personal information on our behalf, appropriate contractual and security arrangements will be put in place as required by law.

Some providers will instead act as independent controllers for the information they process.

Payments may be processed through a specialist payment provider.

BPC does not need to retain full payment-card information where payment is handled by an authorised third-party payment processor.

The payment provider may process your information under its own privacy terms.

We may contact you about BPC services where permitted by law.

Where consent is required, we will obtain it separately.

Choosing whether to receive marketing communications will not affect your clinical care or your ability to use BPC healthcare services.

You may unsubscribe from marketing communications at any time using the unsubscribe facility in the communication or by contacting us.

Clinical or important service communications are not marketing communications and you may continue to receive these where necessary.

We will not sell your health information to third parties for marketing purposes.

When you use our website, we may collect technical information such as:

• IP address;
• browser type;
• device information;
• pages visited;
• website interactions; and
• cookie information.

Some cookies are necessary for the website to operate.

Other cookies, such as analytics or advertising cookies, will only be used in accordance with applicable law and the choices available through our cookie-management system.

Further information is available in our Cookie Notice.

BPC and TBS may use technology to support administration, information management, clinical workflow or analysis.

We do not intend to make decisions about your clinical care that have legal or similarly significant effects on you solely through automated processing without appropriate human involvement.

Clinical decisions remain the responsibility of appropriately qualified healthcare professionals.

If we introduce processing involving automated decision-making which requires additional information to be provided to you under data protection law, we will update this notice and provide the necessary information.

We seek to ensure that personal information is stored and processed using systems with appropriate technical and organisational security measures.

Some technology providers may store or process information outside the United Kingdom.

Where personal information is transferred internationally, BPC or TBS, as applicable, will ensure that an appropriate legal mechanism is in place as required by UK data protection law.

This may include:

• transfers to countries recognised as providing an adequate level of protection; or
• approved contractual safeguards and any additional protections considered necessary.

You may contact us for further information about relevant safeguards.

We do not keep personal information for longer than reasonably necessary.

Different categories of information are retained for different periods depending upon:

• the purpose for which they were collected;
• legal and regulatory requirements;
• professional healthcare record-retention requirements;
• taxation and accounting requirements;
• clinical governance requirements; and
• the potential need to establish, exercise or defend legal claims.

Clinical information held by TBS will be retained in accordance with the retention requirements applicable to private healthcare records and TBS's records-management policy.

BPC administrative, financial and operational information will be retained in accordance with BPC's retention schedule.

When information no longer needs to be retained, it will be securely deleted, destroyed or anonymised as appropriate.

You may contact us for further information concerning the retention period applicable to particular information.

BPC and TBS take reasonable technical and organisational measures to protect personal information against:

• unauthorised access;
• inappropriate disclosure;
• accidental loss;
• alteration;
• destruction; and
• misuse.

Measures may include, as appropriate:

• access controls;
• authentication;
• encryption;
• secure systems;
• staff confidentiality obligations;
• audit controls;
• data-protection policies;
• supplier due diligence;
• staff training; and
• incident-management procedures.

No electronic system can be guaranteed to be completely secure, but we seek to maintain safeguards appropriate to the sensitivity of the information involved.

Information concerning your health is subject not only to data protection law but also to healthcare professionals' duties of confidentiality.

Clinical information will only be accessed or disclosed where there is an appropriate reason to do so.

Staff and contractors with access to confidential information are required to handle it appropriately.

Depending upon the circumstances, you have rights under UK data protection law including:

Right of access

You can ask for a copy of personal information held about you.

Right to rectification

You can ask for inaccurate information to be corrected.

Right to erasure

In certain circumstances you may ask for personal information to be deleted.

This right is not absolute. For example, healthcare providers may be required or permitted to retain clinical records notwithstanding a request for deletion.

Right to restriction

In certain circumstances you may ask us to restrict how information is processed.

Right to object

You may have the right to object to particular types of processing.

Right to data portability

In certain circumstances you may be entitled to receive information you supplied in a structured, commonly used and machine-readable format or have it transmitted to another organisation.

Rights relating to automated decision-making

You have rights concerning certain decisions made solely by automated means.

Right to withdraw consent

Where processing depends upon your consent, you may withdraw that consent.

Withdrawal does not affect the lawfulness of processing carried out before consent was withdrawn.

Not every right applies in every situation.

We will explain any relevant exemption or limitation if it applies to a request you make.

For information principally held or processed by BPC, please contact:

For your TBS clinical record or clinical information principally controlled by TBS, please contact:

If you contact the wrong organisation, we will seek to direct your request appropriately.

We may need to verify your identity before releasing personal information.

If you have concerns about the use of your personal information, please contact us in the first instance so that we can investigate.

You also have the right to complain to the UK's data protection regulator:

Information Commissioner's Office (ICO)

Information about making a complaint is available at the ICO website.

ico.org.uk/make-a-complaint ↗

Making a complaint to BPC or TBS does not affect your right to complain to the ICO.

We may update this Privacy Notice from time to time to reflect:

• changes to our services;
• changes to suppliers or technology;
• changes in the way information is used;
• regulatory developments; or
• changes in applicable law.

The current version will be published on our website with its effective date.

Where we make a material change affecting how we use your information, we will take appropriate steps to bring that change to your attention.

For general privacy enquiries relating to Brook Preventative Care: