Privacy notice
How Quayside Medical Practice collects, uses and protects your personal information.
Last updated: 2 October 2026.
About this notice
This privacy notice explains how Quayside Medical Practice (the 'practice') collects, uses, stores and shares your personal information. It applies to patients, carers and anyone who contacts us. We are committed to protecting your privacy and handling your information in an open and transparent way, in accordance with UK GDPR, the Data Protection Act 2018, and NHS guidance.
Data controller
Quayside Medical Practice is the data controller for the personal information we hold about you. Our ICO registration number is available on request.
Quayside Medical Practice, Keppel Street, Oldham, OL1 1LS
What personal information we collect
We collect and hold a range of personal information about you in order to provide safe and effective care. This includes:
Identity and contact details
Your name, date of birth, NHS number, address, telephone number and email address.
Medical records
Your medical history, diagnoses, medications, allergies, test results, referrals, clinical notes and correspondence from other healthcare providers.
Appointment information
Records of appointments you have requested or attended, including the reason for your visit and any outcomes.
Special category data
Health data is classified as special category data under UK GDPR. We may also hold information about your ethnicity, religion or sexual orientation where this is relevant to your care.
Communications
Records of messages, emails or online contact form submissions you send to us.
How we use your information
We use your personal information for the following purposes:
Providing your care
To provide you with medical treatment, manage your appointments, issue prescriptions and refer you to other services.
NHS obligations
To meet our obligations as an NHS GP practice, including reporting to NHS England, submitting data for payment purposes and complying with national clinical audit requirements.
Safeguarding
To protect children and vulnerable adults from harm. We may share information with safeguarding teams, social services or the police where there is a legal duty or overriding public interest to do so.
Public health
To support public health activities such as vaccination programmes, disease surveillance and health screening.
Research and planning
Anonymised or pseudonymised data may be used to support NHS research, service planning and quality improvement. You have the right to opt out of your data being used for research and planning purposes.
Legal and regulatory compliance
To comply with our legal obligations, including responding to court orders, coroner inquiries and regulatory investigations.
Legal basis for processing
We process your personal information on the following legal bases under UK GDPR:
Processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority (providing NHS primary care).
Processing of special category health data is necessary for the purposes of preventive or occupational medicine, medical diagnosis, the provision of health or social care or treatment.
Processing is necessary to comply with a legal obligation, such as safeguarding duties or statutory reporting requirements.
Processing is necessary to protect the vital interests of the data subject or another person, for example in a medical emergency.
Sharing your information
We may share your information with the following organisations where it is necessary for your care or required by law:
- Other NHS organisations involved in your care, including hospitals, community services, mental health services and ambulance services.
- NHS England, NHS Greater Manchester Integrated Care Board and other commissioning bodies for payment, performance monitoring and planning purposes.
- Social services and safeguarding teams where there is a legal duty or overriding public interest.
- Public Health England and the UK Health Security Agency for infectious disease reporting and vaccination programmes.
- NHS Digital and NHS England for national data collections, including the General Practice Data for Planning and Research (GPDPR) programme. You can opt out of this at any time.
- Third-party clinical system suppliers (such as EMIS Health) who process data on our behalf under data processing agreements. These suppliers are contractually required to keep your data secure and use it only as instructed.
- We do not sell your personal information to any third party.
How long we keep your information
We retain your medical records in line with the NHS Records Management Code of Practice. Adult patient records are generally retained for a minimum of 10 years after the date of last contact, or 10 years after death. Children's records are retained until the patient's 25th birthday, or 26th if they were 17 at the time of their last contact, or 8 years after death. Some records may be kept for longer where required by law or for ongoing care purposes. When records are no longer required, they are securely destroyed.
Your rights
Under UK GDPR you have the following rights in relation to your personal information:
Right of access
You have the right to request a copy of the personal information we hold about you (a Subject Access Request). We will respond within one month.
Right to rectification
You have the right to ask us to correct inaccurate or incomplete information. If you believe something in your record is wrong, please contact us.
Right to erasure
In some circumstances you may ask us to delete your personal information. This right is limited in a healthcare context — we are generally required to retain medical records for the periods set out above.
Right to restrict processing
You have the right to ask us to restrict how we use your information in certain circumstances, for example while a dispute about accuracy is resolved.
Right to object
You have the right to object to your information being used for purposes other than your direct care, such as research or planning. You can exercise your national data opt-out at any time via the NHS website.
Right to data portability
Where processing is based on consent or contract, you have the right to receive your data in a structured, commonly used format.
National data opt-out
You can choose to opt out of your confidential patient information being used for research and planning. This is known as the national data opt-out. You can set or change your opt-out preference at any time.
Set your national data opt-out on the NHS websiteData Protection Officer
Our Data Protection Officer (DPO) is provided through NHS Greater Manchester Integrated Care Board. If you have any concerns about how we handle your personal information, or wish to exercise your rights, please contact us in the first instance. You can also contact the ICO if you remain dissatisfied.
Contact us about data protection
You have the right to lodge a complaint with the ICO at any time.
Information Commissioner's Office (ICO)How we keep your information secure
We take the security of your personal information seriously. We use a range of technical and organisational measures to protect your data, including secure clinical IT systems, staff training, access controls and regular security reviews. All staff are bound by a duty of confidentiality. Our clinical systems are accredited to NHS standards.
Changes to this notice
We may update this privacy notice from time to time. The latest version will always be available on this website. If we make significant changes, we will let you know.
Page last reviewed: 2 October 2026. Next review due: October 2027.