Privacy notice

Last updated: 23 June 2026

This notice explains how Penrose Health handles personal information collected through this website. How we handle your GP health records is explained separately in your own practice’s privacy notice, which you can find on its NHS website (see Find a Practice).

Who is responsible for your information

The data controller for personal information collected through this website is Penrose Health Partnership, registered with the Information Commissioner’s Office as a data controller under registration number Z9940772. Our Data Protection Officer is John Eni-Uwubame (gpdpo@selondonics.nhs.uk). Our Information Governance Lead is Karan Kalucha (karankalucha@nhs.net), and our Caldicott Guardian is Dr Catriona Brodie.

What we collect, and why

• When you contact us or submit a form: we collect the details you give us (such as your name, contact details and message) so we can respond to your enquiry and direct it to the right team. Website enquiries are sent to a monitored NHS mailbox.

• When you use the website: with your consent, we collect anonymous usage data through analytics (see the cookie policy below) to understand how the site is used and to improve it. If you do not consent, this data is not collected.

• Postcode searches: when you use the “find a practice” or “check our area” tools, your postcode is sent to a third-party lookup service to find its location. We do not store it.

Our lawful basis

• For responding to enquiries: our public task as an NHS organisation, and our legitimate interest in helping you reach the right care.

• For website analytics: your consent, which you can withdraw at any time through the cookie settings.

Who we share it with

We do not sell your information. We share enquiry information only within Penrose Health and the relevant practice so we can respond. We use trusted service providers to run the website and analytics, who act on our instructions. We may disclose information if required by law.

How long we keep it

We keep website enquiries only as long as needed to deal with them and for our records, then delete them. Analytics data is anonymised and retained in line with our analytics provider’s settings.

Your rights

You have the right to ask for a copy of the information we hold about you, to have it corrected or deleted, to object to or restrict its use, and to withdraw consent. To exercise these rights, contact our privacy team at privacy.penrosehealth@nhs.net.

To see your health records, you can make a Subject Access Request to your practice, or more quickly view them through the NHS App. We respond to Subject Access Requests within one month. These requests are generally free, though we may charge for requests that are repeated or excessive. We may ask for proof of identity, and for proof of authority if you are requesting someone else’s records.

If you are unhappy with how we have handled your information, you can complain to the Information Commissioner’s Office at ico.org.uk, or by calling 0303 123 1113.

Changes to this notice

We may update this notice from time to time. The latest version will always be on this page.