Clinical Safety ToolkitStaffordshire Training Hub

Type at least two letters.

    Home / Information governance

    Telling patients

    Patients have a right to know how their information is used. When you bring in a new tool, update what you tell them before it goes live.

    Your privacy notice

    Update it before a new tool goes live, in plain language.1 The law sets out what it must cover, including why you use the information, who you share it with, how long you keep it and how patients can use their rights.4 Here’s how Oakfield’s section on its online consultation tool could read.

    Oakfield Surgery · Privacy notice

    Online consultations

    What the tool is
    We use an online consultation tool, Kestrel Consult, so you can contact us through our website or the NHS App, at any time of day.
    What information
    Your name, date of birth, NHS number and contact details, and what you tell us about your health, including any photos you send.
    Why we can use it
    We use your information to provide your care. The law allows this as part of our public task of providing NHS care (UK GDPR Articles 6(1)(e) and 9(2)(h)).
    Who else handles it
    Kestrel Health Ltd runs the tool for us, and Heron Link connects it to our clinical system. They can only use your information to provide this service for us. They do not use it to train or improve their products.
    Where and how long
    Your information is stored securely in the UK. Requests are deleted from the tool 90 days after they’re closed. Anything important is saved in your GP record.
    Your choices
    You can still contact us by phone or in person. To ask about your information or object to how we use it, contact our Data Protection Officer at dpo@oakfield.example. You can also complain to the Information Commissioner’s Office.
    An example section for a fictional practice. The labels on the left show what each part covers; your DPO can check your wording.

    Other ways to tell people

    Alongside the privacy notice:

    • Your website: a plain-English page about the tool
    • Posters in the waiting room and at reception
    • On the tool itself: a short message on the form or app
    • At the point of use, for tools in the consultation such as AI scribes

    For consultation tools such as AI scribes, tell the patient at the start, respect a no, and record their answer. If a patient objects to any tool, offer another way, and involve your DPO if it’s a formal objection.1

    The national data opt-out

    Patients can choose to stop their confidential information being used for research and planning. They set it themselves, through the NHS App or the NHS website, and it’s held against their NHS number.2

    Doesn’t apply

    When information is used for the patient’s own care, which covers most practice tools. It also doesn’t apply to anonymised data, or when the patient has agreed to a specific project.2

    May apply

    If a tool or supplier wants to use identifiable data for anything beyond care, such as research or planning. The records of patients who have opted out must then be removed first.2 Ask your DPO.

    For a new tool, ask the supplier whether any identifiable data is used for anything other than care. If not, the opt-out doesn’t affect it.

    Tools that make decisions

    Some tools decide things without a person, for example a triage tool that books, redirects or declines a request automatically. Data protection law has extra rules for decisions made entirely by a computer that have a significant effect on someone. Since February 2026, a decision like this that uses health data is only allowed in narrow cases, such as with the patient’s explicit consent.5

    • Keep a person involvedSomeone who reviews the decision and can change it. Then it isn’t a fully automated decision.
    • Tell patientsSay in your privacy notice if a tool makes decisions automatically.4
    • Let them ask for a personA patient should be able to challenge the decision and have someone look at it again.
    • Check firstAsk your DPO before switching on a fully automated feature. The ICO consulted on updated guidance in 2026.3

    References

    1. Consent and confidential patient information. NHS England
    2. Understanding the national data opt-out. NHS England
    3. ICO consultation on draft guidance about automated decision-making, including profiling. Information Commissioner’s Office, March 2026
    4. Right to be informed. Information Commissioner’s Office
    5. Data (Use and Access) Act 2025, section 80: automated decision-making. legislation.gov.uk

    Sources on this page last checked 3 November 2026.