Privacy Notice

Last updated: 3 October 2026

Who we are and who this notice covers

BrisDoc Healthcare Services Ltd provides NHS health services. This notice covers BrisDoc, Broadmead Medical Centre, Charlotte Keel Medical Centre, Homeless Health Service and Severnside Integrated Urgent Care. It includes the hospital-based GP services provided through Severnside and the mental health service arrangements described below.

It applies when you receive care, contact us, visit our premises or websites, or apply for or hold a role with us. The information we need depends on how you use our services.

BrisDoc Healthcare Services Ltd is the data controller, meaning we are responsible for deciding how we use your information. Our company number is 5526203. Our Information Commissioner’s Office registration number is Z9771266.

Our address is Unit 21 Osprey Court, Bristol, BS14 0BB.

What we collect and where it comes from

Depending on the service you use, we may collect:

• Your name, address, contact details, date of birth, gender, country of residence, NHS number and language.
• Your marital status, family history, next of kin and details of anyone authorised to act for you, including a lasting power of attorney.
• Your health history, test results, treatment, care needs, outcomes and information about risk or safeguarding.
• Letters, messages, photographs, and recordings of telephone or video calls.
• Feedback, survey answers, complaints and incident information.
• Payment information where you make a payment to us.
• Website information, including your device’s internet address, also called an IP address, and pages visited.
• Video or sound recordings where recording takes place on our premises.

Some information has extra legal protection. This includes health and genetic information, ethnicity, religion, sex life, sexual orientation and biometric information used to identify someone. The law calls this special category data. Criminal offence information is protected by separate rules.

We collect information when you register, receive care, fill in a form or survey, make an enquiry, or contact us by phone, email, social media or an online discussion.

Information may also come from your family, carers, representatives, interpreters, GP, hospitals or other care providers. Other sources include emergency services, councils, the police, NHS systems, shared care records and relevant service, technical, payment or delivery providers. We may also use publicly available sources to keep records up to date.

For children, information may come from a parent or guardian and may include education details. We consider the child’s own rights and confidentiality. Employment-related information and sources are explained in the jobs and employment section.

Please help us keep your details up to date. If you give us someone else’s contact details, let them know where possible.

Why we use information and our legal grounds

We use information to assess your needs, provide and coordinate care, manage appointments and share results. This includes screening and vaccination invitations, video consultations, photographs needed for care, reminders and requests for feedback.

We also use information to protect people from harm, respond to complaints, investigate incidents, meet legal duties and deal with legal claims. Other uses include checking service quality, planning improvements, research, medical trials and training health professionals. Where relevant to a service we provide, we may use information for occupational medicine or to assess someone’s ability to work.

We must have a lawful basis for using personal information. Health and other special category information also need an additional legal condition. We follow the UK General Data Protection Regulation, the Data Protection Act 2018 and applicable patient confidentiality rules.

• NHS care and service management: we rely on carrying out a task in the public interest and the condition for providing or managing health or social care. These are Article 6(1)(e) and Article 9(2)(h) of the UK GDPR.
• Legal duties: we use information where needed to meet a legal obligation, including required disclosures to regulators or other public bodies.
• Protecting life: vital interests may apply where using information is necessary to protect someone’s life. The vital-interests condition for health or other special category information applies only where the person is physically or legally unable to give consent.
• Legitimate interests: where this basis is available, we use it for activities such as maintaining records, analysing and improving services, managing relationships with suppliers and other organisations, and organisational changes. Our interests must not override your rights.
• Consent: where a use depends on your consent, we explain the purpose and your choice. You can withdraw that consent by contacting us.

Additional conditions may apply to special category information used for employment duties, legal claims, research or substantial public-interest purposes, such as protecting people from harm or preventing serious malpractice. We use these conditions only where their legal requirements are met. Information you have deliberately made public may also be relevant where the law permits.

A data-protection basis does not remove our duty of confidentiality. Sharing confidential information for research or other purposes beyond your care needs consent or another valid legal justification.

Using our services or reading this notice does not, by itself, give consent to use your information. If you are concerned about providing information, please speak to us so we can explain why it is needed.

Profiling and messages about services

We may use profiling and screening methods to understand patients’ needs and target support or resources. Profiling means using automated processing to assess aspects of someone’s circumstances. You can ask us about this use and any decisions affecting you.

We may send information about services you request or would reasonably expect to hear about, subject to applicable marketing rules. You can ask us to stop direct marketing at any time. Marketing emails or texts include an unsubscribe option. Messages about your care, such as appointment reminders, are different from marketing.

Who we share information with

Our staff access information where it is appropriate for their role. We also share relevant information with others where there is a lawful reason. Depending on the purpose, this can include:

• Your GP, hospitals, clinics, diagnostic services, first responders, ambulance teams, care homes and other health or social care professionals.
• Associated GP practices and Primary Care Networks, which are groups of practices working together.
• Safeguarding organisations, screening services, NHS bodies, national registers and government authorities.
• The police, courts, coroners or funeral services, where appropriate and lawful.
• Organisations supporting authorised research, trials or professional training.
• Suppliers providing IT, hosting, communications, enquiry handling, analysis, profiling, payment processing or other services on our behalf.
• Auditors, professional advisers and organisations involved in a merger or transfer of services.
• Organisations you ask us to contact, or those requesting an authorised reference.

Suppliers processing information on our behalf work under contracts covering confidentiality, security and data protection. Other care providers and public bodies may have their own legal responsibilities for information they receive.

If you are concerned about sharing with your GP or another care provider, please tell us. We will consider your wishes and explain any effect on your care. Sharing may still be needed where the law requires it or an overriding public interest justifies it, for example to prevent serious harm.

Research, planning and your opt-out choices

Information can help improve standards, develop treatments, prevent illness, monitor safety and plan services. Wherever possible, information used for research and planning is anonymised so that you cannot be identified.

We share information that does not identify you with the Bristol, North Somerset and South Gloucestershire Integrated Care Board. This supports contract monitoring, quality checks, NHS statistics, understanding local health needs and planning or evaluating services.

Where confidential information is needed beyond your individual care, the relevant data-protection and confidentiality requirements must be met.

The national data opt-out

You can choose whether your confidential patient information is used for research and planning where the national data opt-out applies. We apply the national data opt-out policy to relevant uses and disclosures.

Opting out does not stop information being used for your care. It does not apply to anonymous information, and there are other exceptions, including some sharing required by law and uses you have specifically consented to.

You can change your choice at any time. The NHS information-sharing choices website explains the exceptions and how to make your choice online or by phone.

Shared records and service-specific arrangements

These arrangements apply where the relevant service is involved in your care. Contact us if you are unsure which apply to you.

Connecting Care

Connecting Care is a shared digital care record for Bristol, North Somerset and South Gloucestershire. Professionals involved in your care can access relevant information from health and social care records to support safer, coordinated care.

The Connecting Care website explains access, privacy and your sharing choices. These choices are separate from the national data opt-out for research and planning.

Mental health services and shared records

Clinicians supporting the MHCAS mental health service use RIO, a clinical record system provided by Avon and Wiltshire Mental Health Partnership NHS Trust. The service supports demand from NHS 111 and the Emergency Services Mental Health Professional Line.

RIO also enables access to Connecting Care through Orion, and the Bath and North East Somerset, Swindon and Wiltshire Integrated Care Record through Graphnet. We can access relevant information and provide information about your care.

Find out more about the Bath and North East Somerset, Swindon and Wiltshire care record and your choices.

GP services and lung health checks

For eligible patients, relevant lung health information is shared with the service operated by the Somerset, Wiltshire, Avon and Gloucestershire Cancer Alliance and InHealth, commissioned by NHS England. This supports invitations for lung health checks and possible CT scans, a type of scan using X-rays.

Information may also be shared with hospitals and other professionals involved in further care. Visit the lung health check and screening website for further information.

GP services and child health information

Relevant information from children’s GP records is shared with South, Central and West Child Health Information Services, commissioned by NHS England. This helps monitor screening, physical examinations and vaccinations so that children have access to the care they need.

Contact our Data Protection Officer if you would like more information about this sharing.

Patient records and medical reports through iGPR

We use iGPR Technologies Limited to help respond to requests for patient information. This includes requests for copies of records from you or someone acting for you, and life-insurance report requests under the Access to Medical Reports Act 1988.

iGPR works under our instructions and applicable law. Matters needing further clinical consideration are referred to the GP responsible for your care. Requests for insurance reports are subject to the relevant consent and medical-report rules.

Security and processing outside the UK

We use organisational and technical measures to protect information against loss, damage, unauthorised access and unlawful use. Access is limited according to people’s roles and responsibilities.

No internet transmission is completely secure. Contact us if you need advice about sending sensitive information.

IT hosting or maintenance may involve storing or accessing information outside the UK, including outside the European Economic Area. UK data-protection rules on international transfers apply to these arrangements.

Contact our Data Protection Officer for information about the locations and protections involved, and how to obtain details of relevant safeguards.

How long we keep information and CCTV

We keep information only for as long as it is needed for its purpose. The period depends on the type of record and:

• Legal requirements and guidance from regulators and professional bodies.
• Time limits for making or defending legal claims.
• Any continuing need to manage our relationship with you or run our services.

Contact our Data Protection Officer if you want to know how long we keep a particular record.

CCTV

Where our premises are monitored by CCTV, this is for the safety of visitors and staff. We keep CCTV images for 30 days.

Your rights

You have the right to understand how we use your information and to request a copy. You can ask us to correct inaccurate information or complete missing information.

Depending on why we use your information, you may also have rights to:

• Ask us to limit its use or delete it.
• Receive certain information in a format you can reuse or transfer.
• Withdraw consent where we rely on it.
• Receive information about significant decisions made without meaningful human involvement, express your views, obtain human intervention and challenge those decisions.

These rights have limits. For example, the rights to deletion and transfer in a reusable format do not apply to information used on a public-task basis. We may need to keep accurate medical records for care or legal reasons. We will explain our response to your request.

Withdrawing consent does not affect the lawfulness of earlier use based on that consent.

Your right to object

You can object to uses based on public task or legitimate interests. We will consider your circumstances and explain our decision. You can always object to direct marketing.

Making a request

Contact dpo@brisdoc.org or write to us using the address below. We may need to check your identity. Requests are usually free, and we normally respond within one month. We will explain any lawful extension or exception.

Websites and cookies

Cookies are small files stored on your device. Our websites use cookies to support their operation and help us understand how they are used. Depending on the website and its features, these may include:

• Necessary cookies to make website features work.
• Analytics cookies to measure visits and help improve the site.
• Functionality cookies to remember choices such as language or other preferences.
• Targeting cookies to record visits and interests and make content or advertising more relevant. Where used, these may involve sharing information with third parties.

Where consent is required, cookies must not be used before you agree. Continuing to browse does not give that consent. Some cookies can be used without consent where a legal exception applies.

You can manage cookies through your browser settings. Blocking some cookies may affect website features. Contact our Data Protection Officer for information about cookies used on a particular website.

Other websites linked from ours have their own privacy and cookie information.

Jobs, employment and other roles

If you apply for or hold a role with BrisDoc, we may use employment details, your National Insurance number, references and relevant health or working-capacity information. Where relevant, information may come from employers, referees, fraud or credit-reference agencies and Disclosure and Barring Service checks.

We use this information to assess or manage your role, meet employment duties, support occupational health and manage our working relationship. We may provide references to organisations where you apply for a role, where appropriate and lawful.

The rights, security, retention and contact information in this notice also apply. Contact our Data Protection Officer for details about a particular use.

Help, contact details and complaints

Contact us with questions, to use your rights or to complain about how we handle your information. If you need help understanding this notice, or need another format or language, please let us know.

We will acknowledge data-protection complaints within 30 days, investigate, keep you appropriately informed and explain the outcome without unnecessary delay.

You also have the right to complain to the Information Commissioner’s Office, the UK data-protection regulator. Visit ico.org.uk/make-a-complaint or call 0303 123 1113.

We review this notice when our services or uses of information change and tell you about relevant changes where required.

Back to the top of this privacy notice