Privacy Notice

Primary Care Data Services Ltd ("we", "us" or "our") is committed to protecting personal information and respecting the privacy of individuals who visit our website, contact us or use our services.

This Privacy Notice explains how we collect, use, store, disclose and protect personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018 and applicable privacy legislation.

For personal information collected through our own website and business enquiries, Primary Care Data Services Ltd will generally act as the data controller.

Where we process information on behalf of a healthcare practice or another client, our role may instead be that of a data processor, depending on the services and contractual arrangements.

Depending on your interactions with us, we may collect:

• •Name, job title and organisation
• •Business email address and telephone number
• •Information submitted through website contact forms
• •Enquiry details, correspondence and service requirements
• •Contractual, billing and transaction information
• •Technical information such as IP address, browser type and website usage information
• •Information provided during business discussions and service delivery

We may process personal information to:

• •Respond to enquiries and requests for quotations
• •Provide information about our services
• •Communicate with prospective and existing customers
• •Prepare proposals and manage commercial contracts
• •Deliver agreed business and administrative services
• •Coordinate relevant referrals to independent service providers
• •Maintain website functionality, security and performance
• •Comply with legal, regulatory and accounting obligations
• •Send marketing communications where permitted by law

We will not use personal information for purposes incompatible with those for which it was collected unless permitted by law.

We rely on the following lawful bases, as applicable:

Where we rely on consent, it may be withdrawn at any time without affecting earlier lawful processing.

Primary Care Data Services Ltd collaborates with independent service providers, including Tia Software Solutions, to help respond to enquiries relating to technology, software development and digital services.

Where an enquiry would be more appropriately handled by an independent provider, we may offer to introduce the prospective customer.

We will explain the proposed referral and obtain any permission required before sharing contact details.

Information shared will be limited to what is reasonably necessary for the introduction, such as the customer's name, business contact information and relevant service requirements.

An independent provider may act as a separate data controller for information it receives and will be responsible for its own privacy obligations.

Our services may include healthcare administration, clinical document processing, medical coding, records summarisation and related operational support.

Where we are appointed by a healthcare organisation to process patient information on its behalf, we will only process that information under appropriate documented instructions and contractual arrangements.

The healthcare organisation will generally determine the purposes and lawful basis for processing patient information.

Any processing of health information must meet the applicable requirements of UK GDPR, including a valid Article 6 lawful basis and Article 9 condition where required.

Access to patient information will be restricted to appropriately authorised personnel and governed by relevant confidentiality and security requirements.

This website privacy notice does not replace any specific privacy information required for patient-data processing carried out on behalf of a healthcare client.

Where necessary and lawful, we may share relevant information with:

• •Authorised employees and contractors
• •Website hosting, IT and email service providers
• •Professional advisers, including accountants and legal advisers
• •Independent service providers where a relevant introduction is authorised
• •Public authorities or regulators where legally required

We require appropriate confidentiality and data protection safeguards when third parties process information on our behalf.

Some technology providers may store or access information outside the United Kingdom.

Where international transfers of personal data occur, we will assess the applicable legal requirements and use an appropriate transfer mechanism, such as UK adequacy regulations or approved contractual safeguards, where required.

Information about relevant transfers and safeguards may be requested using the contact details above.

We take reasonable technical and organisational measures designed to protect personal information against unauthorised access, alteration, disclosure, loss and destruction.

Measures may include access controls, account authentication, security updates, encrypted communications where appropriate, staff confidentiality obligations and secure data handling procedures.

No internet transmission or storage system can be guaranteed to be completely secure.

We retain personal information only for as long as reasonably necessary for its intended purposes, including legal, accounting and regulatory requirements.

Retention periods depend on the nature of the information, the purpose of processing and any applicable contractual or statutory obligations.

When information is no longer required, we will securely delete, anonymise or otherwise dispose of it, subject to lawful retention requirements.

Our website may use cookies or similar technologies for functionality, security, analytics and website performance.

Strictly necessary technologies may be used without consent where permitted by law.

Where consent is legally required for non-essential cookies or similar technologies, we will request it before using them and provide a way to manage preferences.

Details of the technologies actually used, their providers, purposes and retention periods will be provided in our cookie information or consent interface.

We may communicate with business contacts about relevant services where permitted under applicable data protection and electronic marketing laws.

Where consent is required, we will obtain it before sending marketing communications.

Recipients may opt out of marketing at any time by contacting us or using an unsubscribe mechanism where provided.

Subject to applicable legal conditions and exemptions, individuals may have the right to:

• •Access their personal information
• •Request correction of inaccurate information
• •Request erasure of information
• •Request restriction of processing
• •Object to certain processing, including direct marketing
• •Request data portability where applicable
• •Withdraw consent where processing relies on consent
• •Challenge certain solely automated decisions with legal or similarly significant effects

If you have concerns about how we handle personal information, please contact us first so we can investigate.

You also have the right to complain to the UK Information Commissioner's Office (ICO).

Our website may contain links to third-party websites and services.

We are not responsible for the privacy practices of independently operated websites. Visitors should review the relevant third party's privacy information before providing personal details.

We may update this Privacy Notice to reflect changes to our services, technology, legal obligations or data handling practices.

The latest version will be published on our website with an updated revision date.

For questions about this Privacy Notice or the handling of personal information: