Your privacy matters

Gateshead Healthcare

Gateshead Healthcare is the umbrella name for Practices run by Reimagining General Practice GPMS Services Ltd company no. 11060700.

The current Practices and services include the following:

  • Main site: Crawcrook Medical Centre, Pattinson Drive, Crawcrook, Ryton, Tyne & Wear, NE40 4US, Tel: 0191 413 5473
  • Branch site: Rowlands Gill Medical Practice, The Grove, Rowlands Gill, Tyne and Wear, NE39 1PW, Tel: 01207 542 136
  • Branch site: Blaydon GP Practice, Shibdon Road, Blaydon, Tyne and Wear, NE21 5NW, Tel: 0191 283 4600
  • Branch site: Grange Road Medical Practice, Grange Road, Ryton, Tyne and Wear, NE40 3LT, Tel: 0191 413 1399

Collectively, for the purposes of this privacy policy, our sites will be referred to as 'the Practices' and our corporate structures shall collectively be called 'the organisation'.

At our Practices, we aim to deliver services that enable patients to live longer, healthier lives are full, active and meaningful. We do this in full consideration of privacy. We strive to comply with the General Data Protection Regulation (GDPR) and the Data Protection Act 2018 (DPA), and to be leaders in primary healthcare when it comes to healthcare and privacy.

Our NHS services are provided under an APMS contract.

Who is responsible for my information?

The organisation is the data controller for your information and is responsible for looking after your record while you are a registered patient. The person with the key responsibility for data protection and security is Mr Methven Forbes. Any queries or concerns should be raised with the practice first. North East and North Cumbria ICB also provides the practice with a Data Protection Officer, who can be contacted via email -

The organisation offers a range of services delivered at our physical locations and via our website and smartphone app.

This policy explains how we use your personal data. We want to help you understand how we work with your data, so that you can make informed choices and be in control of your information. We invite you to spend a few moments understanding this policy. We may update this policy from time to time and, if we make any material changes, we will notify you when we do so. We will provide you with the opportunity to review such changes. By continuing to use our products and services after the changes have been made and we have notified you of them, the way we use your personal data will be subject to the terms of the updated policy. This policy explains how we use your personal data for our NHS services. It also governs the use of your data through our App, or our websites, including the (and any reference to our App in this policy shall also include a reference to our website).

This policy covers:

  • Who we are
  • What personal data we hold and how we get it
  • What we use your personal data for
  • Sharing your personal data
  • Retention
  • Data security and transfers
  • Your rights

If you have any further questions about how we process your information, please don't hesitate to get in touch by contacting our Practice Manager at any one of the addresses above:

Who we are

Our healthcare services are delivered by the organisation as follows:

Gateshead Healthcare delivers an APMS services in Gateshead

Your relationship is with Gateshead Healthcare. The delivery of APMS services is conducted at the Practice sites listed above. For the avoidance of doubt and for the purposes of data processing, services for Gateshead may be carried out at any location deemed necessary by the company.

When this policy talks about 'the Practice', 'us' or 'we', it means all the services provided by Gateshead Healthcare.

What personal data we hold and how we obtain it

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

- The General Data Protection Regulations Legislation (GDPR)

- Human Rights Act 1998

- Common Law Duty of Confidentiality

- Health and Social Care Act 2022

- NHS Codes of Confidentiality and Information Security

Personal data must be processed fairly and lawfully, whether is it received directly from you or from a third party in relation to your care. ‘Personal data’ means any information relating to an identifiable person who can be directly or indirectly identified from the data.  This includes, but is not limited to name, date of birth, full postcode, address, next of kin and NHS Number; and ‘Special category / sensitive personal data’ includes such as medical history including details of appointments and contact with you, medication, emergency appointments and admissions, clinical notes, treatments, results of investigations, supportive care arrangements, social care status, race, ethnic origin, genetics and sexual orientation etc and any other relevant information to enable us to deliver effective medical care.

We will collect the following types of information from you or about you from a third party (provider organisation) engaged in the delivery of your care:

- Details about you, such as your address, legal representative, emergency contact details

- Any contact the surgery has had with you, such as appointments, clinic visits, emergency appointments, etc.

- Notes and reports about your health

- Details about your treatment and care

- Results of investigations such as laboratory tests, x-rays etc

- Relevant information from other health professionals, relatives or those who care for you

- Your records will be retained in accordance with the NHS Code of Practice for Records Management

- Your healthcare records contain information about your health and any treatment or care you have received previously (e.g. from an acute hospital, GP surgery, community care provider, mental health care provider, walk-in centre, social services). These records maybe electronic, a paper record or a mixture of both.  We use a combination of technologies and working practices to ensure that we keep your information secure and confidential.

We use the following categories of personal data

Personal details

When you register with us, you complete forms and provide us with basic information about yourself, such as your name, date of birth, physical address and email address. You will also provide us with a copy of identification documentation for ID checks to be carried out by one of our commercial partners (for example, we use software called EmisWeb for Gateshead). We use our own support services company “Reimagining General Practice Health Support Services Ltd”, which is wholly owned by the two individuals acting as directors for Reimagining General Practice GPMS Services Ltd. Support services are the employing vehicle for some GP surgery  staff who themselves work under the policies, protocols and procedures of the Practice.  Patient information is only held by the Practice.

Health and medical information

The main type of information we hold about you is health and medical information (information about your health, symptoms, treatments, consultations and sessions, medications and procedures). This includes details of your consultations with our doctors and other clinicians, interactions with our digital services, and interaction with our non-clinical staff. We get some of this information directly from you, when you register with us and when you use our healthcare services. If you use our NHS services, we will receive your medical history from your previous GP. If you use our other services (for example, if you register as a temporary patient), and if you have given consent for us to do so, we will send the consultation notes that we take during your use of the private service to your NHS GP (for minors, we will share such notes, in line with medical guidelines, without such consent). Any correspondence we receive from you is uploaded electronically to your medical record held by Emis Web as relevant.

Where we provide video consultations, we retain recordings of our consultations with you, in order to provide you with an easy way to re-watch your consultations where you wish to, so that we can ensure high quality care is provided to you, and, with your consent, to allow us to learn from them to improve our services. These recordings are held securely in accordance with our retention policy. Once this service is live, you can access recordings of your consultations at any time through the App. We may also hold information about you and your health from other apps, devices and services where you have given your consent to that data being shared with us (for example where you use the NHS App or where you decide to share information collected from a smart watch or similar device with our App).

Financial information

If you make any payments on the App or our website (for example, where you are requesting private work including medical examinations for HGV licence), your credit/debit card details are processed directly by a third party processor that will store all payment information and transaction details. We will only retain details of transactions on secure servers and we will not retain your credit or debit card information. Technical information and analytics.

When you use our App or website, we may automatically collect the following information where this is permitted by your device settings:(a) technical information, including the address used to connect your mobile phone or other device to the Internet, your login information, system and operating system type and version, browser or app version, time zone setting, operating system and platform, and your location (based on IP address); and(b) information about your visit, including services you viewed or used, App response times, interaction information (such as button presses) and any phone number used to call our customer service number. We work with partners who provide us with analytics and advertising services (for our services only and not for third party advertising). This includes helping us understand how users interact with our services, providing our advertisements on the internet, and measuring performance of our services and our adverts. Cookies and similar technologies may be used to collect this information, such as your interactions with our services. We also use cookies to record changes made to this website.

What we use your personal data for

In summary, the NHS Act 2006 and the Health and Social Care Act 2012 invests statutory functions on GP Practices to promote and provide the health service in England, improve quality of services, reduce inequalities, conduct research, review performance of services and deliver education and training. To do this we will need to process your information in accordance with current data protection legislation to:

- Protect your vital interests;

- Pursue our legitimate interests as a provider of medical care, particularly where the individual is a child or a vulnerable adult;

- Perform tasks in the public’s interest;

- Deliver preventative medicine, medical diagnosis, medical research; and

- Manage the health and social care system and services

The purposes for which we use your personal data and the legal grounds on which we do so are as follows: We obtain and use your personal details and financial details in order to establish and deliver our contract with you. We obtain and use your medical information because this is necessary for medical purposes, including medical diagnosis and the provision of healthcare or treatment. This includes the information collected through our consultations with you (such as notes and recordings), our digital services, and medical history from your previous NHS GP if you use our GP service (in the same way that any GP practice would receive your medical history if they become your NHS GP). It may also include sharing information with other healthcare professionals as necessary for the provision of care to you, such as your GP, specialist referral services, therapists, pharmacists, hospitals, accident and emergency services, pathology service providers, and diagnosis centres chosen by you for the purpose of imaging request forms. Where you have provided your explicit consent, we will use your medical information (always having removed personal identifiers, such as your name, address and contact details) to improve our healthcare products and services so that we can deliver better healthcare to you and other patients.

This medical information (de-identified in the way described above) may include your medical record (both records received and created by us), transcripts and recordings of your consultations, and your interactions with any of our services, such as our online consultations. This does not involve making any decisions about you - it is only about improving our services and software so that we can deliver a better experience to you and other patients, and help achieve our aim of enabling patients to live longer and healthier lives that are full, active and meaningful. Strict confidentiality and data security provisions apply at all times. We may obtain and use data about your precise location where you give your consent (through providing us access to your location), for example, to help direct you to the nearest pharmacy. We may also derive your approximate location from your IP address. We use your email address and/or phone number to contact you with occasional updates and marketing messages where you have not opted out, based on our legitimate interest in marketing our services to you and subject to your right to opt out at any time. Based on our legitimate interest in managing and planning our business, we may analyse data about your use of our services to, for example, troubleshoot bugs within the App or website, forecast demand of service and to understand other trends in use, including which features users use the most and find most helpful, and what features users require from us. This does not involve making any decisions about you - it is only about improving our App or website so that we can deliver better services to you. Strict confidentiality and data security provisions will apply at all times.

Data sharing

Where necessary, we may need to share personal and financial details for the purposes of fraud prevention and detection. We also store your medical information, such as notes from consultations, recordings of our consultations with you and your interactions with our digital services, for safety, regulatory, and compliance purposes. For example, we may need to review your information and, where necessary, make disclosures in compliance with reasonable requests by regulatory bodies including the General Medical Council, MHRA, and Care Quality Commission, or as otherwise required by law or regulation. Where necessary for safety, regulatory and/or compliance purposes, we may audit consultations and your other interactions with our services. Strict confidentiality and data security provisions will apply at all times to any such audit and access. We may use non-personal data (data from which an individual cannot be identified) to improve our and services. Sharing your personal data with others.

We may share your personal data with our partners (such as Reimagining General Practice Health Support Services or other such services we have outsourced or subcontracted to). This is to help us deliver our services to you. We may share your personal data with companies we have hired to provide services on our behalf, including those who act as data processors on our behalf, acting strictly under contract in accordance with Article 28 GDPR. Those data processors are bound by strict confidentiality and data security provisions, and they can only use your data in the ways specified by us. We may share with our commercial partners aggregated data that does not personally identify you, but which shows general trends, for example, the number of users of our service. Where you access our services through another health provider (including your employer) we may share with such partner your name, date of birth, email address, location, and the fact you have registered/used the service (and any other similar information).

In order to deliver and coordinate your health and social care, we may share information with the following organisations:

- NHS Trusts / Foundation Trusts

- GP’s

- NHS Commissioning Support Units

- Independent Contractors such as dentists, opticians, pharmacists

- Private Sector Providers

- Voluntary Sector Providers

- Ambulance Trusts

- Integrated Care Boards

- Social Care Services

- NHS Digital

- Local Authorities

- Education Services

- Fire and Rescue Services

- Police & Judicial Services

- Other ‘data processors’ which you will be informed of

- Your information will only be shared if it is appropriate for the provision of your care or required to satisfy our statutory function and legal obligations.

We will not without your consent share any details relating to the content of your consultation with us or your health/medical records. With your consent, we may share the date of the appointment, details of your diagnosis, prescription, pharmacy location, whether or not you had a referral made and other similar information about your appointment with us. We will, where necessary for your treatment or care, share your information with your other health and social care providers. For example, your NHS GP and other NHS bodies, specialist referral services, therapists, pharmacists, hospitals, accident and emergency services, pathology service providers, diagnosis centres chosen by you for the purpose of imaging requests, and other health and care bodies. This may include sharing information with such services for safeguarding purposes in accordance with our legal obligations. If you use our NHS services, we will share your records with Share Care Records systems in Gateshead, which provides other members of the scheme (such as, amongst others, NHS Trusts, social services, community services and the ambulance services) with access to your data to promote integrated care for you, and for research and statistical purposes. You may contact us at any time to opt out of this data sharing by following the instructions on our website

We may preserve or disclose information about you to comply with a law, regulation, legal process, or governmental request; to assert legal rights or defend against legal claims; or to prevent, detect, or investigate illegal activity, fraud, abuse, violations of our terms, or threats to the security of our services or the physical safety of any person. Except as described above, we will never share your personal information with any other party without your consent. Risk in mobile or email communication.

Please note, GDPR sets a high standard for consent. Consent means offering people genuine choice and control over how their data is used. When consent is used properly, it helps you build trust and enhance your reputation. However, consent is only one potential lawful basis for processing information. Therefore, your GP practice may not need to seek your explicit consent for every instance of processing and sharing your information, on the condition that the processing is carried out in accordance with this notice.  Your GP Practice will contact you if they are required to share your information for any other purpose which is not mentioned within this notice.  Your consent will be documented within your electronic patient record.

You have the right to write to withdraw your consent at any time for any particular instance of processing, provided consent is the legal basis for the processing. Please contact your GP Practice for further information and to raise your objection.

Risk in mobile or email communication

If you consent to us contacting you by text message or by email following an econsultation or other consultation, you should be aware that there are risks. The following outlines some of the risks to your personal data:

Communication by e-mail or by text message has a number of risks which include, but are not limited to, the following:

E-mail and text messages can be circulated, forwarded and stored in paper and electronic files.

Backup copies of e-mail and text messages may exist even after the sender or the recipient has deleted his/her copy.

E-mail and text messages can be received by unintended recipients.

E-mail and text messages can be intercepted, altered, forwarded or used without authorization or detection.

E-mail and text messages can be used to introduce viruses into computer systems and phone systems.

You should not consent to receiving emails or text messages from us or send us emails or text messages wif any of the above risks concern you. If you do consent, you should ensure that the email address or mobile number you provide is your personal email address and mobile number.

Electronic patient records are kept in most places where you receive healthcare. Our local electronic systems EMIS enables your record to be shared with organisations involved in your direct care, such as:

GP practices

Community services such as district nurses, rehabilitation services, telehealth and out of hospital services.

Child health services that undertake routine treatment or health screening

Urgent care organisations, minor injury units or out of hours services

Community hospitals

Palliative care hospitals

Care Homes

Mental Health Trusts


Social Care organisations


Information obtained from third party services


We may receive information from them to ensure that your medical records are kept up to date and so that your GP can provide the appropriate care. In addition we received data from NHS Digital (as directed by the Department of Health) such as the uptake of flu vaccinations and disease prevalence in order to assist us to improve “out of hospital care”.

Retention periods

We retain your medical records in accordance with national best practice guidance - in particular, advice provided by the Department of Health (2006) Records management: NHS code of practice, and summary guidance issued by the British Medical Association. The below is a summary of our retention policy, but we may retain records for other periods as required by law or regulation.

GP records Retention period: GP Records retained for 10 years after death or after the patient has permanently left the country unless the patient remains in the European Union. In the case of a child, if the illness or death could have potential relevance to adult conditions or have genetic implications for the family of the deceased, the advice of clinicians should be sought as to whether to retain the records for a longer period. Electronic patient records (EPRs) must not be destroyed, or deleted, for the foreseeable future.

Maternity records Retention period: 25 years after the birth of the last child

Records relating to persons receiving treatment for a mental disorder within the meaning of mental health legislation Retention period: 20 years after the date of the last contact; or 10 years after the patient's death if sooner

Data storage, security and transfers

Your information will be collected either electronically using secure NHS Mail or a secure electronic transferred over an NHS encrypted network connection. In addition physical information will be sent to your practice.  This information will be retained within your GP’s electronic patient record or within your physical medical records.

We do not store your personal health data on your mobile device. We store all your personal health data - including your primary care information, medication information and diagnostic information - on secure servers. Where you have chosen a password that enables you to access certain parts of our App or website, you are responsible for keeping this password confidential. We ask you not to share the password with anyone. We do not store any credit or debit card information. Payments are processed via a third-party payment provider that is fully compliant with Level 1 Payment Card Industry (PCI) data security standards. Any payment transactions are encrypted using SSL technology. We encrypt data transmitted to and from the App or website. Once we have received your information, we will use strict procedures and security features to try to prevent unauthorised access. We will take all steps reasonably necessary to ensure that your data is treated securely and in accordance with this privacy policy. Your data may be processed or stored via destinations outside of the UK and the European Economic Area, but always in accordance with data protection law, including mechanisms to lawfully transfer data across borders, and subject to strict safeguards. For example, we work with third parties who help deliver our services to you, whose servers may be located outside the UK or EEA.

For patients who utilise Emis Web online (also known as Patient Access or Patient Access Online), the company who owns Emis Web is responsible for data security and data protection. Emis Web is the clinical system we use for recording your health records and can be accessed by us during consultation and by you online if you have registered for this service. For more information on the data security requirements and data protection standards used by Emis Web, you can visit, write to Emis, Fulford Grange, Micklefield Lane, Rawdon, Leeds, LS19 6BA or call 0330 024 1269.

Your rights

As indicated above, whenever we rely on your consent to process your personal data, you have the right to withdraw your consent at any time by accessing the privacy settings in the App or website.

You also have specific rights under the GDPR and DPA;

Wherever we process data based on your consent, withdraw that consent at any time. You can do this via the privacy section of our App or website;

Understand and request a copy of information we hold about you.

Recordings of your appointments with us and other medical notes can be accessed via the App or website.

For other information

You can make a request by email; Ask us to rectify or erase information we hold about you, subject to limitations relating to our obligation to store medical records for prescribed periods of time; Ask us to restrict our processing of your personal data or object to our processing; and Ask for your data to be provided on a portable basis .You may also contact the Information Commissioners Office (the data protection regulator in the UK): Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF, telephone: 0303 123 1113 (local rate) .Contact us for any questions or concerns, you can contact us by sending an email to

ACR project for patients with diabetes (and/or other conditions)

The data is being processed for the purpose of delivery of a programme, sponsored by NHS Digital, to monitor urine for indications of chronic kidney disease (CKD) which is recommended to be undertaken annually for patients at risk of chronic kidney disease e.g., patients living with diabetes. The programme enables patients to test their kidney function from home. We will share your contact details with to enable them to contact you and send you a test kit. This will help identify patients at risk of kidney disease and help us agree any early interventions that can be put in place for the benefit of your care. will only use your data for the purposes of delivering their service to you. If you do not wish to receive a home test kit from we will continue to manage your care within the Practice. are required to hold data we send them in line with retention periods outlined in the Records Management code of Practice for Health and Social Care. Further information about this is available at: