Privacy
Privacy notice
We take the confidentiality of your health information seriously. This notice explains what we collect, why, who we share it with and the rights you have.
Last updated 8 September 2026. This page is a template prepared for the practice and is to be reviewed by the practice manager before launch.
Who we are
Dermatox Ltd (“the practice”, “we”) is the data controller for the personal information you give us, at At the rear of Grovelands Medical Centre, 1 Grovelands Rd, Palmers Green, London, N13 4RJ. Company number 12342451. You can contact us about privacy at info@gpline.co.uk.
What we collect
- Identity and contact details: name, date of birth, address, phone number and email.
- Health information: the reason for your appointment, the doctor’s notes, test results, prescriptions, referrals and correspondence.
- Booking and payment records: appointments, invoices and whether a fee has been paid. Fees are taken at the practice; card details are processed by the card terminal provider and are never stored by the practice.
- Website information: enquiries you send us and technical data needed to keep the site secure.
Why we use it and our lawful basis
- To provide you with medical care: UK GDPR Article 6(1)(b) (contract) and Article 9(2)(h) (provision of health care), under a duty of confidentiality.
- To run the practice, keep records, respond to complaints and meet our obligations to regulators: Article 6(1)(c) (legal obligation) and 6(1)(f) (legitimate interests).
- To send appointment confirmations, reminders and results: Article 6(1)(b).
- To send marketing or service updates only where you have opted in: Article 6(1)(a) (consent). You can withdraw consent at any time.
Who we share it with
- Your NHS GP, with your consent, so your NHS record is complete.
- Laboratories, imaging providers, pharmacies and specialists involved in your care.
- Providers who process data on our behalf under contract: our clinical record system, secure email and hosting providers, and our card terminal provider. We use providers that store data in the UK or the EU, or under UK-approved safeguards.
- Regulators, courts and authorities where the law requires it.
We never sell your information.
How long we keep it
Medical records are kept in line with the Records Management Code of Practice for Health and Social Care, which for most adult records is at least ten years after your last contact with us, and longer for children’s records and some other categories. Enquiries and booking records not linked to care are kept for up to two years.
Your rights
You can ask for a copy of your records, ask us to correct inaccurate information, ask us to restrict or object to certain uses, and, where the lawful basis is consent, withdraw it. Requests are free and answered within one month. If you are unhappy with our response you can complain to the Information Commissioner’s Office (ico.org.uk).
Security
Records are held in an encrypted clinical system with access limited to the staff who need it. Our website uses HTTPS throughout, and administrative access is protected by individual accounts and audited.
Cookies
The website uses only cookies that are necessary for it to work. See our cookies page.
Changes
We will update this notice if our practices change and show the date of the latest version at the top of the page.