Privacy Notice

The Primary Care Alliance C.I.C. ("PCA", "we", "us") is a community interest company. We are not run for profit. We are a GP federation, owned by and working on behalf of GP practices, and we deliver NHS-funded clinical services to patients registered with those practices and, where we are asked to, to patients registered elsewhere.We are registered in England and Wales, company number 14938777. Our registered office is Chalfont Surgery, Chalfont Close, Earley, Reading RG6 5HZ. Until 19 March 2026 we were named Berkshire West Primary Care Alliance Ltd.We are registered with the Care Quality Commission (CQC) as a provider of the regulated activity "Treatment of disease, disorder or injury". Our CQC provider identifier is 1-22154459354. Our Registered Manager is Dr Amit Sharma.We are not your GP practice. Your GP practice holds your GP record and is the data controller for it. When you are invited to, referred into, or treated by one of our services, we create and hold our own clinical record about that care, in our own clinical record systems. PCA is the data controller for that record.At the end of an episode of care we send a summary back to your GP practice, which is added to your GP record. From that point your practice is the controller of the copy held in your GP record, and we remain the controller of ours.Appendix A sets out, activity by activity, what we do and on what legal basis.

Health care professionals who provide you with care are required by law to maintain records about your health and any treatment or care you have received. These records help to provide you with the best possible healthcare and help us to protect your safety.We collect and hold data for the purpose of providing healthcare services to our patients and running our organisation, which includes monitoring the quality of care that we provide. In carrying out this role we will collect information about you which helps us respond to your queries or secure specialist services. Your information is held in digital form and is supported by written records as appropriate.

Not all of the information we hold about you comes from you directly. We also receive information about you from:your GP practice, including by viewing your GP record directly through GP Connect;hospitals, community services, social care and other NHS providers involved in your care;the Thames Valley and Surrey (TVS) Care Records, known locally as ConnectedCare, a shared care record which brings together information recorded by GP practices, hospitals, community services and social care across the region;pathology (laboratory) services, including Berkshire and Surrey Pathology Services (BSPS) and the Royal Berkshire NHS Foundation Trust ICE system;NHS England and other national NHS services. Where we obtain information about you from a source other than you, we explain this in Appendix A, and, where we then contact you, in the message or letter we send you.

All of our clinicians, staff and associated practitioners are committed to protecting your privacy and will only process data in accordance with the Data Protection Legislation. This includes the General Data Protection Regulation (EU) 2016/679 (GDPR), now known as the UK GDPR, the Data Protection Act (DPA) 2018, the Data (Use and Access) (DUA) Act 2025, the Law Enforcement Directive (Directive (EU) 2016/680) (LED) and any applicable national Laws implementing them as amended from time to time. The legislation requires us to process personal data only if there is a legitimate basis for doing so and that any processing must be fair and lawful.Where we rely on Article 9(2)(h) of the UK GDPR to process information about your health, we also meet the condition at paragraph 2 of Schedule 1 to the Data Protection Act 2018: the processing is carried out by, or under the responsibility of, a health professional, or by another person who owes an equivalent duty of confidentiality.In addition, consideration will also be given to all applicable Law concerning privacy, confidentiality, the processing and sharing of personal data including the Human Rights Act 1998, the Health and Social Care Act 2012 as amended by the Health and Social Care (Safety and Quality) Act 2015, the common law duty of confidentiality and the Privacy and Electronic Communications (EC Directive) Regulations.We are a signatory to the Regional Health and Social Care Information Sharing Agreement (the "Regional ISA") as an independent-sector healthcare provider, and we meet the qualifying standard set out in that agreement. This governs how we access and use information held in the TVS Care Records / ConnectedCare.

Records which PCA will hold or share about you will include the following:Personal Data: any information relating to an identified or identifiable natural person ('data subject'); an identifiable natural person is one who can be identified, directly or indirectly, in particular by reference to an identifier such as a name, an identification number, location data, an online identifier or to one or more factors specific to the physical, physiological, genetic, mental, economic, cultural or social identity of that natural person.Special Categories of Personal Data: this term describes personal data revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, and the processing of genetic data, biometric data for the purpose of uniquely identifying a natural person, data concerning health or data concerning a natural person's sex life or sexual orientation.Confidential Patient Information: this term describes information or data relating to their health and other matters disclosed to another (e.g. patient to clinician) in circumstances where it is reasonable to expect that the information will be held in confidence. Including both information 'given in confidence' and 'that which is owed a duty of confidence'. As described in the Confidentiality: NHS code of Practice: Department of Health guidance on confidentiality 2003.Pseudonymised: the process of distinguishing individuals in a dataset by using a unique identifier which does not reveal their 'real world' identity.Anonymised: data in a form that does not identify individuals and where identification through its combination with other data is not likely to take place.Aggregated: statistical data about several individuals that has been combined to show general trends or values without identifying individuals within the data.

Improvements in information technology make it possible for us to share data with other healthcare organisations for the purpose of providing you, your family and your community with better care. For example, it is possible for healthcare professionals in other services to access your record with or without your permission when your GP practice is closed. Where your record is accessed without your permission it is necessary for them to have a legitimate basis in law. This is explained further in the Local Information Sharing at Appendix A.Whenever you use a health or care service, such as attending Accident & Emergency or using Community Care services, important information about you is collected in a patient record for that service. Collecting this information helps to ensure you get the best possible care and treatment.The information collected about you when you use these services can also be used and provided to other organisations for purposes beyond your individual care, for instance to help with:improving the quality and standards of care providedresearch into the development of new treatmentspreventing illness and diseasesmonitoring safetyplanning services This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law.Most often, anonymised data is used for research and planning so that you cannot be identified, in which case your confidential patient information isn't needed.

Some of our services work proactively. That means we look at information already recorded about you to work out whether you might benefit from a review, and then contact you to offer one, rather than waiting for you to contact us. This is sometimes called "case finding".We do this using the search tools within ConnectedCare (the TVS Care Records). We only do this where we have been commissioned to provide the service, and we only look at the health conditions relevant to it. Where you are identified, we copy the information we need in order to contact you and provide your care into our own clinical record system.Once we have copied your information out of ConnectedCare and into our own system, PCA is solely responsible for that copy. Your GP practice and the other organisations that contribute to ConnectedCare remain responsible for the records they hold.You do not have to take up an invitation, and you can tell us at any time that you would prefer not to be contacted.Appendix A explains each of these services, what information is used, and the legal basis for it.

We use GP Connect to support your direct care. It is a national NHS England service that lets an authorised clinician view the record held by your registered GP practice, whichever clinical system that practice uses.Our clinicians use it so that they have your current medicines, allergies, test results and relevant history in front of them, rather than working from what has been copied across or from what you can remember on the day. We will ask your permission at the point we speak to you.GP Connect is not used for any purpose other than direct care. We do not use it to find patients, and we do not use it for planning, research or reporting.Our view of your record is read-only. Your GP practice remains in control of your GP record, and nothing we see through GP Connect changes it. We also use GP Connect to send the outcome of your appointment to your practice, so that it reaches them quickly and securely.Your practice's system does not release everything. Information your practice has marked as not for sharing is withheld, and a national exclusion list keeps certain sensitive conditions out of what we can see. Every time one of our clinicians opens your record this way, it is logged.The legal basis is the same as for the rest of your care with us, and your rights over this information are the same. These are set out above and in Appendix A.Find out more about GP Connect

If we have significant concerns or hear about an individual child or vulnerable adult being at risk of harm, we may share relevant information with other organisations, such as local authorities and the Police, involved in ensuring their safety.

Sometimes we are duty bound by laws to disclose information to organisations such as the Care Quality Commission, the Driver and Vehicle Licencing Agency, the General Medical Council, the Nursing and Midwifery Council, the General Pharmaceutical Council, His Majesty's Revenue and Customs and Counter Fraud services. In these circumstances we will always try to inform you before we are required to disclose, and we only disclose the minimum information that the law requires us to do so.This may only take place when there is a clear legal basis to use this information. All these uses help to provide better health and care for you, your family and future generations. Confidential patient information about your health and care is only used like this where allowed by law or with consent.Pseudonymised or anonymised data is generally used for research and planning so that you cannot be identified.A full list of details including the legal basis, any Data Processor involvement and the purposes for processing information can be found in Appendix A.

We follow the NHS Records Management Code of Practice. The periods below are minimums. A record may be kept longer where there is a clear reason, and the period restarts if a record comes back into use.Records of the care we provideWhere we assess, advise or treat you, our record of that care is kept for at least eight years from the end of your care with us.Where a condition is long-term or may recur, the Code sets a longer minimum of 20 years, or 10 years after death. We expect this longer period to apply to records made by our services for long-term conditions.Call recordingsRecordings of calls are kept for six years from the date of the call, in line with the Code and the Limitation Act 1980. Where clinical information from a call cannot be written into your record, the recording is treated as part of your health record and kept for the same period as that record.Telephone system recordsCall logs and related system records are kept for at least one year.Where we contact you and you do not take up the offerIf we identify you through case finding, contact you, and you do not respond or you decline, no episode of care takes place. The Records Management Code does not set a period for this kind of record, so we have set one using the factors the Code directs us to consider, including the purpose of the record and the fact that it relates to a single event with no follow-on action.We delete your name, date of birth, contact details and clinical information six months after our last attempt to contact you.We keep a short administrative entry for six years. This is your NHS number, the date we contacted you, the outcome, and whether you had asked not to receive text messages. This is so that we can show that an offer of care was made, avoid contacting you again if you have declined, and report on the programme without holding your clinical details.DisposalOnce information we hold has been identified for destruction it is disposed of in the most appropriate way for the type of information it is. Personal confidential and commercially confidential information is disposed of by approved and secure confidential waste procedures. We keep retention schedules within our information asset registers.

Under UK GDPR the Law provides the following rights for individuals. The NHS upholds these rights in a number of ways:The right to be informedThe right of accessThe right to rectificationThe right to erasure (not an absolute right), which only applies in certain circumstancesThe right to restrict processingThe right to data portabilityThe right to objectRights in relation to automated decision making and profiling We do not make decisions about your care by automated means. Where a search tool identifies you as someone who may benefit from a review, that is an invitation only. Every clinical decision is made by a qualified clinician.

The NHS Constitution states, 'You have a right to request that your personal and confidential information is not used beyond your own care and treatment and to have your objections considered'.Type 1 Opt OutThis is an objection that prevents an individual's personal confidential information from being shared outside of their general practice except when it is being used for the purposes of their individual direct care, or in particular circumstances required by law, such as a public health screening, or an emergency like an outbreak of a pandemic disease. A Type 1 Opt Out is applied by your GP practice. If you wish to apply one, you should make your wishes known to your Practice Manager.Our clinical services are provided as part of your individual direct care. Where a Type 1 Opt Out has been recorded, the Thames Valley and Surrey Care Records apply it automatically, and those records are not available to our case finding. This means we will not contact you about a service on the basis of a Type 1 Opt Out record. If you have a Type 1 Opt Out and would like to be considered for one of our services, please speak to your GP practice, who can refer you to us directly.National data opt-out (NDOO)The National Data Opt-Out enables patients to opt out from the use of their data for research or planning purposes. It does not apply to information used for your individual care and treatment, and it therefore does not prevent us contacting you about a service you may benefit from.We apply the National Data Opt-Out wherever we use confidential patient information for purposes beyond individual care.For more information go to National data opt out programme.To find out more or to register your choice to opt out, please visit www.nhs.uk/your-nhs-data-matters. On this web page you will:See what is meant by confidential patient informationFind examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual careFind out more about the benefits of sharing dataUnderstand more about who uses the dataFind out how your data is protectedBe able to access the system to view, set or change your opt-out settingFind the contact telephone number if you want to know any more or to set/change your opt-out by phoneSee the situations where the opt-out will not applyYou can also find out more about how patient information is used at:NHS Health Research Authority (which covers health and care research); andUnderstanding Patient Data (which covers how and why patient information is used, the safeguards and how decisions are made).You can change your mind about your choice at any time.Data being used or shared for purposes beyond individual care does not include your data being shared with insurance companies or used for marketing purposes, and data would only be used in this way with your specific agreement.Objecting to a particular serviceSeparately from the opt-outs above, you can tell us that you do not wish to be contacted by, or take part in, a particular PCA service. This will not affect your care from your GP practice or anywhere else.

Under Data Protection Legislation everybody has the right of access to, or request a copy of, information we hold that can identify them, this includes medical records. You are only entitled to confirmation, personal data and other information that we are able to provide based on a reasonable and proportionate search for the information. There are some safeguards regarding what you will have access to, and you may find information has been redacted or removed for the following reasons:It may be deemed to risk causing harm to you or othersThe information within the record may relate to third parties who are entitled to their confidentiality, or who have not given their permission for the information to be shared You do not need to give a reason to see your data, and requests can be made verbally or in writing. Although we may ask you to complete a form so that we can ensure that you receive the correct information.Please note that we hold only the records relating to care provided by PCA. If you want a copy of your full GP record, you should ask your GP practice.Where multiple copies of the same information are requested, we may charge a reasonable fee for the additional copies.You will need to provide proof of identity to receive this information. We will not share information relating to you with other individuals without your explicit instruction or without sight of a legal document.

It is important that you tell us if any of your contact details such as your name or address have changed, or if any of your other contact details are incorrect, including third-party emergency contact details. It is important that we are made aware of any changes immediately in order that no information is shared in error.You should also tell your GP practice, as much of the information we hold about you originates from your GP record.Mobile telephone numberIf we hold your mobile telephone number, we will use it to send you text messages about your care with us, for example an invitation to book an appointment, an appointment reminder, a request to attend for a blood test, or information about your treatment.These messages are part of providing you with care. They are not marketing, and we do not use your contact details to promote products or services.Our text messages are sent from 07414 650801. We will never ask you for your bank details, your password, or payment of any kind.These messages are sent under the Privacy and Electronic Communications (EC Directive) Regulations 2003 as service communications rather than direct marketing, so we do not need your prior consent to send them. You can still ask us to stop.If you do not wish to receive text messages from us, please contact us using the details in the "Contact us" section below. We will record your preference and contact you another way.Email addressWhere you have provided us with your email address, we will use this to send you information relating to your health and the services we provide. If you do not wish to receive communications by email, please let us know.TelephoneWe may telephone you where we have not been able to reach you by text message, or where the matter is better dealt with by a conversation.

Data Protection Legislation requires organisations to register a notification with the Information Commissioner to describe the purposes for which they process personal and sensitive information.We are registered as a Data Controller and our registration can be viewed online in the public register at: Register of fee payers and certificate downloads | ICOOur ICO registration number is ZB712369.Any changes to this notice will be published on our website.

Should you have any data protection questions or concerns, please contact our Data Protection Officer:Lucy Hunt, 360 GovernanceEmail: enquiries@360governance.co.uk

Telephone: 0118 227 4990Write to us at:The Primary Care Alliance CIC, Chalfont Surgery, Chalfont Close, Earley, Reading RG6 5HZContact us: www.primarycarealliance.nhs.uk/contactPlease use the contact form, or write to us, rather than attending in person. This address is our registered office and is shared with a GP surgery.

The Freedom of Information Act 2000 (FOIA) gives people a general right of access to information held by or on behalf of public authorities. PCA is a community interest company and is not itself listed as a public authority under the Act, so the Act does not give a general right of access to information we hold.We are nevertheless committed to being open about how we work. Requests for information about NHS-commissioned services may also be made to the commissioning organisation.You cannot ask for information about yourself under FOIA. That is dealt with under a right of access request. See 'Right of access to your information' above.

If you have concerns or are unhappy about any of our services, please contact us using the details above. You can also contact the Information Commissioner's Office (ICO).For independent advice about data protection, privacy, and data-sharing issues, you can contact: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AFPhone: 0303 123 1113 Website: https://ico.org.uk/global/contact-us

The NHS Constitution establishes the principles and values of the NHS in England. It sets out the rights patients, the public and staff are entitled to. These rights cover how patients access health services, the quality of care you'll receive, the treatments and programmes available to you, confidentiality, information, and your right to complain if things go wrong. The NHS Constitution for England - GOV.UKIn our use of health and care information, we satisfy the common law duty of confidentiality because:you have provided us with your consent (we have taken it as implied to provide you with care, or you have given it explicitly for other uses);we have support from the Secretary of State for Health and Care following an application to the Confidentiality Advisory Group (CAG) who are satisfied that it isn't possible or practical to seek consent;we have a legal requirement to collect, share and use the data;for specific individual cases, we have assessed that the public interest to share the data overrides the public interest served by protecting the duty of confidentiality (for example sharing information with the police to support the detection or prevention of serious crime). This will always be considered on a case-by-case basis, with careful assessment of whether it is appropriate to share the particular information, balanced against the public interest in maintaining a confidential health service.