This privacy notice explains how Annan North Surgery uses personal information in line with data protection law and NHS confidentiality requirements.
Annan North Surgery is committed to protecting your personal information and being clear about how we use it. This notice explains how we collect, use, store and share your personal data when you use our services or contact the practice.
Who we are
Annan North Surgery is the data controller for the personal information we hold about our patients and service users.
- Practice address: Greencroft Medical Centre, Greencroft Wynd, Annan DG12 6GN
- Telephone: 01461 202745
- Email: dg.annannorth@nhs.scot
- Privacy contact: Practice Manager, Annan North Surgery
- Data Protection Officer: DPO Office, DGRI, Cargenbridge, Dumfries
- DPO email: dg.dataprotection@nhs.scot
What information we collect
Depending on the service you use, we may collect and use:
- your name, address, date of birth, CHI number and contact details
- information about your health, care, treatment and medicines
- appointment, referral, correspondence and test result information
- information provided by you, your representative, other healthcare providers or other public bodies involved in your care
- website or communication information if you contact us online, by email or by telephone
How we use your information
- to provide direct care and treatment
- to manage appointments, referrals, recalls and follow-up care
- to maintain accurate patient records
- to communicate with you about your care and the services we provide
- to meet legal, regulatory, safeguarding, clinical governance and public health obligations
- to plan and improve healthcare services where permitted by law
Our lawful basis for using your information
We process personal data because it is necessary for the performance of tasks carried out in the public interest and in the exercise of official authority in providing NHS healthcare services. In some circumstances we also process information to comply with legal obligations.
Because we use information about health, we also rely on an additional condition for processing special category data. This is usually because processing is necessary for the provision of health or social care, treatment or the management of health or social care systems and services. In some situations we may also process information for reasons of public health, substantial public interest, safeguarding or where you have given consent.
Where we get your information from
- directly from you or someone acting on your behalf
- other NHS organisations involved in your care, including hospitals, laboratories, community services and pharmacies
- NHS Board services, Practitioner Services and other national NHS systems
- other public bodies where information sharing is lawful and necessary
Who we may share your information with
We only share your information when it is lawful and necessary to do so. This may include sharing with:
- other NHS organisations and healthcare professionals involved in your care
- pharmacies, laboratories, hospitals and community health services
- NHS Board services and NHS National Services Scotland where required for patient administration, records management or national systems
- service providers acting on our behalf under appropriate contracts and confidentiality arrangements
- regulators, courts, auditors or law enforcement where required or permitted by law
If you use a third-party service linked from this website, such as eConsult, that service will have its own privacy information and terms.
How long we keep your information
We keep patient information in line with NHS Scotland and Scottish Government records management requirements. Different records are kept for different lengths of time depending on the type of record and the legal or clinical purpose for holding it.
If you want more information about retention periods, contact the practice or our data protection contact.
Transfers outside the UK
We do not routinely transfer your personal data outside the United Kingdom. If this changes, we will update this notice and ensure appropriate safeguards are in place where required.
Your rights
Under data protection law, you may have rights in relation to your personal information, including the right to:
- be informed about how your information is used
- request access to the personal information we hold about you
- ask us to correct information that is inaccurate or incomplete
- ask us to restrict how your information is used in some circumstances
- object to processing where the law gives you that right
- complain if you are unhappy with how your information has been handled
Some rights are limited in healthcare settings because we may need to keep or use information to provide safe care, meet legal obligations or protect other people.
How to complain
If you have concerns about how we use your personal information, please contact the practice first using the details above.
You also have the right to complain to the Information Commissioner’s Office (ICO):
- Website: ico.org.uk
- Helpline: 0303 123 1113
Review date: 30 March 2026