What we do with information about you

Clinical Practice Research Datalink (CPRD) works with GP practices to provide de-identified coded medical data to support health-related research and public health studies. In order to do this, CPRD holds data on GP practices across the UK, including contact details and information on the GP software systems used, gathered from contacts at conferences, practice websites, and the NHS ODS Portal.

The data held includes key contacts information about individuals who work at the GP Practice. The personal data we hold consists only of name, phone numbers, email, and role at the practice (for example ‘Office Manager’) and records of any direct communications with the individual (for example ‘Spoke to JK at conference; asked for more detail on CPRD’). We are keen to have the correct and up-to-date contact details for the practice, so ask you to let us know of any changes.

If you would like to contact us, then please email us at gpnetwork@mhra.gov.uk. More information about how and why we use administrative data, such as GP contact details, is available at: www.gov.uk/government/publications/mhra-privacy-notice/mhra-privacy-notice

Compliance information

The Clinical Practice Research Datalink (CPRD) is a centre of the Medicines and Healthcare products Regulatory Agency (MHRA), an executive agency of the Department of Health & Social Care (DHSC), which regulates medicines, medical devices and blood components for transfusion in the UK. The DHSC is the legal ‘controller’ of the data which we hold. You may contact the Data Protection Officer at:

Data Protection Officer

DHSC
1st Floor North
39 Victoria Street
London SW1H 0EU

or at data_protection@dh.gsi.gov.uk

The legal bases for processing this information

We hold information primarily about GP practices and whether they wish to participate in CPRD data collection or not. As part of collecting this information, we will hold contact details for key contacts at the GP practice. Normally we will have the name of the individual, their job title or role at the practice, their email address, and possibly their mobile phone number. While this is collected purely for the purposes of appropriate interaction with the GP practice itself, it is now considered ‘personal data’ under GDPR. Please let us know if any of these contact details are incorrect or if there are more appropriate contact details (e.g. a switchboard number or generic email address to use).

The legal basis for processing these data is:

  • GP engagement and enquiries: Article 6(c) – ‘legal obligation’ as a public body to keep proper records and be accountable; Article 6(e) – ‘exercise of official authority’ in order to fulfil our public task to provide data for research purposes

We only retain information on an individual while they are known to be a relevant contact at a GP practice, except in respect of past communications where we will hold records in line with legal requirements or the MHRA Data Retention Schedule.

Your data subject rights under the General Data Protection Regulation

The General Data Protection Regulation came into force in the UK from 25 May 2018 and this provides for a number of data rights for individuals:

  • the right to be informed about the processing of any data about you (which is what this notice is intended to cover);
  • the right of access to see or receive a printed copy of any personal data relating to you;
  • the right to rectification – to correct any material errors in the personal data we may hold about you;
  • the right to erasure of your personal data and the right to restrict processing (to ask that some or all processing ceases) – we would simply remove you as an appropriate contact at the Practice and ask for a more appropriate contact or for generic contact details (e.g. reception phone number and email address);
  • the right to data portability – this only applies to data you would have provided directly;
  • the right to object to and not to be subject to automated decision-making, including profiling. We do not have any automated decision-making.
[Page last reviewed 26 September 2018]