When we process your personal information, we will only do so where there is a legal basis. Much of our processing relates to your direct care and treatment:
- Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Where we have a specific legal obligation that requires the processing of personal data, the legal basis will be:
- Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject.
Where we process special category data, for example data including health, racial or ethnic origin, or sexual orientation, we need to meet an additional condition in the UK GDPR.
Where we are processing special category personal data for purposes related to the commissioning and provision of health services the condition will be:
- Article 9(2)(h) - processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services; or
- Article 9(2)(i) - processing is necessary reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices.
Where we process your personal data for the purposes of research, the legal basis for doing so will be:
- Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.
Where we are processing special category personal data for purposes related to research, the legal basis will be:
- Article 9(2)(a) - you have provided your explicit consent; or
- Article 9(2)(j) - processing is necessary for scientific or historical research purposes or statistical purposes.
The Practice may also process personal data for the purpose of, or in connection with, legal proceedings, including prospective legal proceedings, for the purpose of obtaining legal advice, or for the purpose of establishing, exercising or defending legal rights.
Where we process personal data for these purposes, the legal basis for doing so will be:
- Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject; or
- Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
- Article 6(1)(f) - processing is necessary for the purposes of legitimate interests pursued by the controller.
Where we process special category personal data for these purposes, the legal basis for doing so will be:
- Article 9(2)(f) - processing is necessary for the establishment, exercise or defence of legal claims; or
- Article 9(2)(g) - processing is necessary for reasons of substantial public interest.
On occasions, we may need to share your information with law enforcement agencies or to protect the wellbeing of others. For example, to safeguard children or vulnerable adults.
Where we process personal data for these purposes, the legal basis for doing so will be:
- Article 6(1)(c) - processing is necessary for compliance with a legal obligation to which the controller is subject; or
- Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; or
- Article 6(1)(f) - processing is necessary for the purposes of legitimate interests pursued by the controller.
Where we share special category personal data for these purposes of safeguarding, the legal basis for doing so is:
- Article 9(2)(g) - processing is necessary for reasons of substantial public interest.