GDPR Compliance Notices from people we work with:

We carry out NHS Health Checks at the Crane Surgery, which involves sending some information about the people we check to the Health Authority and an organisation called Health Diagnostics:

2018-01-12 Privacy Impact Assessment for the processing of NHS Health Checks - ANNEX A(3).pdf


After they go to the Pharmacy, prescription requests are processed, and the cost of the drugs is reimbursed, by NHS Business Services:

2018-03 NHS Business Services (prescriptions).pdf


EMIS provide our computer system, and all our electronic patient records are saved by EMIS onto a server in Leeds. However EMIS are in the process of transferring all data to a third-party hosted cloud-based environment, for the sake of greater interoperability - namely Amazon Web Services (AWS).

2018-04 EMIS Group and the GDPR (General Data Protection Regulation).pdf

2019-07 Data Protection Impact Assessment for Third party processor Emis Health-Draft.docx

2019-07 EMIS Privacy notice Third party processor_draft.docx


An organisation called Eclipse accesses the information on our computer system in order to analyse details of blood results and prescribing, and they then produce alerts to warn us if patients' health seems to be at risk because of the medication they are taking:

2018-04-11 Eclipse Information Governance Overview.pdf


Box-It is the organisation which takes away and incinerates our confidential waste:

2018-06 Box-it statement of compliance & contract addendum.pdf


iGPR is a system which accesses information from our computer system in order to produce medical reports for life insurance companies:

2018-06 iGPR compliance notice.docx


NHS England extract anonymised data about Fit Notes issued by us:

2018-08 NHS England re Fit Notes.docx


From October 2019 Health Intelligence will be taking over administration of the Diabetic Eye Screening programme (screening for diabetic retinopathy) in the West Kent Area. In order to run this service they will be extracting data about known diabetic patients from our clinical database.

2019-07 Health Intelligence (Diabetic Eye Screening Programme).pdf


The Primary Care Network is a network of local practices in the Weald area which have grouped together in order to offer shared services to their patient populations - for example Improved Access, which allows patients to be seen on Saturdays and in the evenings, and physiotherapy assessment, which allows patients with musculoskeletal problems to be assessed by a qualified physiotherapist instead of seeing the GP. For these purposes patient records are shared and made accessible across the Network.

2019-07 Improved Access Data Sharing Agreemt.doc


The West Kent Federation (an association of all the practices in West Kent) provides diabetes services for all the practices in the area, and we share information with them for this purpose.

2019-07 West Kent Federation Diabetes Service data sharing agreement Signed.pdf


2020 Coronavirus (Covid-19) arrangements: During the 2020 Coronavirus cris there are special arrangements in place for data-sharing across health and social care organisations. You can read about them here:

Covid 19 Privacy Notice (version 2)

Diabetes Team Data Impact Assessment

Kent and Medway Care Record (KMCR): from July 2020 this new system will allow surgeries to meet their statutory obligations to share information with other agencies such as Social Services.

KMCR compliance notice

KMCR Privacy Notice


Accurx: This is a system that allows us to send text messages to patients and also to make video calls to them, sharing information (such as their mobile phone numbers, or a record of any text sent) with our clinical computer system.

2020-10-13 Accurx Data Processing Agreement


West Kent CCG and iPlato: iPlato is another system that allows text messages to be sent to patients with mobile phones, using the contact details from clinical computer systems. The West Kent CCG (which is our local Health Authority) are using iPlato to send out health information to patients, for example about Covid-19.


Hospice in the Weald: Hospice in the Weald are our local Hospice, based in Pembury, and they help us with patients who are terminally ill and/or suffering from long-term incurable conditions such as dementia. In order to collaborate with them more closely we allow them access to our patient records via EMIS, our clinical computer system.

Hospice in the Weald Data Sharing Agreement


The Medicines Management team at West Kent CCG access data on our clinical system in order to analyse our prescribing and alert us to any potential risks. 

Medicines Management Data Protection Deed


The Diabetes Team at West Kent CCG access data on our clinical system in order to contact patients in the 'pre-diabetic' category and offer them support (see also below, "Xyla Health and Wellbeing").

Diabetes Team Data Impact Assessment


Xyla Health and Wellbeing: NHS England has commissioned a provider, Xyla Health and Wellbeing, to provide the ‘Your local Healthier You: NHS Diabetes Prevention Programme’ for patients at risk of type 2 diabetes. Once a patient is referred, they will be contacted for a motivational interview with the provider (Xyla) to help them enrol onto the course and to have an opportunity to ask any questions they have at this time, including if you don’t want to enrol in the programme. Xyla Health and Wellbeing is part of the Acacium Group and sometimes, if required and legally allowed, Xyla may share some of your basic details such as your name and contact details with providers who have been identified as suitable to contact you to provide support for you during this programme. Any sharing of your data is done as little as possible, under due diligence and in compliance with applicable laws. For full details on how Xyla would use your data for the diabetes prevention programme, see their privacy notice at: For general information on the national diabetes prevention programme, please visit the NHS England website on this at:


Ardens is a software company specialising in clinical reports and templates for GP surgeries. As approved by the Primary Care Network, we allow them limited access to our clinical system so that they can create some of their reports.

Ardens Data Impact Assessment


The Primary Care Mental Health Service is part of the Kent and Medway NHS and Social Care Partnership Trust, and in order to help them look after our patients with mental health issues we share clinical data with them.

Primary Care Mental Health Services Information Sharing Agreement


General Practice Data for Planning and Research: This data is extracted automatically from our clinical software system, EMIS, by NHS Digital. The purpose of the collection is to support the data needs of the health and social care system including policy development, public health, planning and commissioning of services and research. More information about this data collection and the general practice obligation to provide data for this purpose is contained in the Provision Notice issued by NHS Digital to GP practices. The Data Provision Notice includes appendices which explain data minimisation, additional protections, pseudonymisation and the data set specification. - ACR project for patients with diabetes: The data is being processed for the purpose of delivery of a programme, sponsored by NHS Digital, to monitor urine for indications of chronic kidney disease (CKD) which is recommended to be undertaken annually for patients at risk of chronic kidney disease e.g., patients living with diabetes. The programme enables patients to test their kidney function from home. We will share your contact details with to enable them to contact you and confirm that you wish them to send you a test kit. This will help identify patients at risk of kidney disease and help us agree any early interventions that can be put in place for the benefit of your care. will only use your data for the purposes of delivering their service to you. If you do not wish to receive a home test kit from we will continue to manage your care within the Practice. are required to hold data we send them in line with retention periods outlined in the Records Management code of Practice for Health and Social Care. Further information about this is available at