Data Protection and Patient Privacy Policy – Patient Information

Indigo Medical employs more than 40 staff and operates from three sites:

Indigo House, 2-8 Oxford Road, St Helier, Jersey JE1 4HB

Little Grove Clinic, La Rue de Haut, St Lawrence, Jersey JE3 1JZ

Leodis Surgery, La Route des Quennevais, St Brelade, Jersey JE3 8LL

Our Practice is registered with the Jersey Office of the Information Commissioner (JOIC) to process personal and special category information under the Data Protection (Jersey) Law 2018 and our registration number is 68565.

Indigo Medical LLP (known as "Indigo Medical") is the data controller responsible for your personal information. We are registered with the Jersey Office of the Information Commissioner under registration number 68565.

This privacy notice explains how we collect, use, and protect your personal data in accordance with the Data Protection (Jersey) Law 2018.

Download our privacy policy

We have appointed a Data Protection Manager to oversee our compliance with data protection law and to help ensure your rights are protected. You can contact our Data Protection Manager at:

• Email: indigomedical@indigo.gpnet.je
• Telephone: 01534 730541

As a primary care healthcare provider, Indigo Medical collects and processes personal information and health data about you in order to deliver safe, effective and coordinated care.

This includes your personal details, contact information, and detailed health and medical records.

We also collect special category data, which is sensitive personal information such as your medical history, diagnoses, test results, and other health-related information.

This information is essential to provide you with appropriate medical services and to manage your ongoing care.

We collect your personal information in a number of ways:

• Directly from you when you register as a patient, complete appointment booking forms, medical questionnaires, or consent forms.
• During consultations with our healthcare professionals, including information you provide verbally or in writing.
• From medical examinations, tests, and investigations we carry out.
• From other healthcare providers, hospitals, and specialists with whom you are receiving care, to ensure coordinated and safe treatment.
• From other organisations such as public health bodies, where we share information to support screening and immunisation programmes.
• Automatically from our website and systems through the use of cookies and similar technologies (see our cookies policy for more information).

We collect the following categories of personal information:

We process special category data (sensitive personal information) about you because it is necessary to provide you with healthcare. This includes:

• Your complete medical history and previous diagnoses
• Treatment plans and detailed clinical notes from consultations
• Test results, investigation reports, and clinical observation records
• Correspondence and communications relevant to your care (including emails, letters, and records of telephone calls with our staff)
• Information about your family, lifestyle, and social circumstances (such as employment, housing, or social support)
• Safeguarding information where relevant to your care or safety
• Information about your racial or ethnic origin, religious or similar beliefs, sexual life, or gender identity (where relevant to your care or where you have chosen to share this with us)

We process this sensitive information only for the purposes of providing you with healthcare, and we protect it with strict security measures and access controls.

We use your personal information and health data for the following purposes and on the following legal bases:

To provide you with healthcare (Legal Basis: Contract and Legal Obligation)

We use your information to register you as a patient, to provide you with medical consultations, examinations and treatments, to prescribe medication, to arrange referrals to specialists, and to

manage your ongoing care. This is necessary because we have a contractual relationship with you as your GP practice and because we have a legal obligation to provide safe and effective healthcare.

To ensure safe and coordinated care (Legal Basis: Legal Obligation and Vital Interests)

We share your medical information with hospitals, specialists, and other healthcare providers involved in your care to ensure they have access to your full medical history and can provide safe, coordinated treatment. We may also need to process your information urgently to protect your vital interests (for example, if you have a medical emergency).

To comply with legal and regulatory requirements (Legal Basis: Legal Obligation)

We process your information to comply with health and social care regulations, to maintain accurate medical records, to respond to regulatory enquiries, and to support public health activities such as screening and immunisation programmes. We may also be required by law to disclose information to authorities such as the police or child safeguarding services where there is a risk to you or others.

To manage our services effectively (Legal Basis: Legitimate Interests)

We use your information to send you appointment reminders, to manage our waiting lists, to conduct quality assurance and clinical audit, to improve our services, and to manage complaints or concerns you may raise. We consider that we have a legitimate interest in running an efficient primary care practice whilst protecting your rights and interests.

To obtain your consent for specific processing (Legal Basis: Consent)

Where we need your specific permission to use your information (for example, to contact you for research purposes or to share information beyond what is necessary for your direct care), we will ask for your consent. You are free to withdraw consent at any time.

To support public health (Legal Basis: Public Interest)

We may process your information to support public health activities, disease prevention, and health surveillance programmes commissioned by public health bodies. This helps to protect public health.

We will only use your personal information for the purposes described in this notice or for purposes which are compatible with those original purposes.

If we wish to use your information for a new purpose which is not compatible with the original purpose, or if we need to process your information on a different legal basis, we will provide you with a fresh privacy notice setting out the new purpose and legal basis and, where required, we will ask for your consent before proceeding.

We share your personal information and health data with various organisations to provide you with safe, effective healthcare and to comply with legal obligations. These organisations include:

• Other healthcare providers such as hospitals, specialists, and consultants involved in your care
• Public health bodies and local health authorities (for screening, immunisation and disease prevention purposes)
• Third-party service providers who help us run our practice (see the Processors section below)
• Emergency services, social services, and safeguarding authorities where we have a legal obligation or where it is necessary to protect you or others from harm

All organisations we share your data with are required to protect your information in accordance with data protection law and to use it only for the purposes we have specified.

We use various third-party organisations (known as "processors") to help us deliver our services and comply with legal obligations. These organisations process your personal data on our instructions and are bound by data protection obligations. Details of our main processors are set out below:

Your personal data may be transferred outside Jersey as part of our service delivery and data management activities. Where such transfers occur, Indigo Medical ensures that appropriate safeguards are in place to protect your information and to comply with data protection law.

Our website uses cookies and similar technologies to enhance your experience and to gather information about how our site is used. For detailed information about the cookies we use, how we use them, and your rights in relation to cookies, please refer to our cookies policy at

https://cdn.cookiescan.com/domains/85-531405/policy/cookiepolicy-en.html?locale=en&localeName=English.

We share your personal data with the following processors and third parties to support the delivery of healthcare services, ensure compliance with data protection law, and maintain the security and operation of our systems.

All processors are bound by data protection obligations and have appropriate safeguards in place.

International Data Transfers

Your personal data may be transferred outside Jersey to processors and third parties during healthcare delivery, regulatory compliance, and business operations. Where such transfers occur, Indigo Medical ensures that appropriate safeguards are in place to protect your data in accordance with the Data Protection (Jersey) Law 2018.

We take the security of your personal data seriously. Indigo Medical has implemented appropriate technical and organisational measures to protect your information against unauthorised access, alteration, disclosure, or destruction. These measures include encryption, access controls, secure communication protocols, staff training, and regular security reviews.

However, no system of data protection is completely secure. Whilst we work hard to protect your personal data, we cannot guarantee absolute security. If you have concerns about the security of your data, please contact our Data Protection Manager.

We retain your personal data for as long as necessary to fulfil the purposes for which it was collected. This includes the provision of healthcare, compliance with legal, regulatory, accounting, and reporting requirements, and satisfying any contractual obligations.

Indigo Medical follows the Information Governance Alliance Records Management Code of Practice for Health and Social Care as best practice guidance for retention periods applicable to health and social care records. This guidance sets out appropriate retention schedules for different types of health information.

Specific retention periods for different categories of data are available on request from our Data Protection Manager. When data is no longer needed, we will securely delete or anonymise it in accordance with applicable law.

Under the Data Protection (Jersey) Law 2018, you have several rights in relation to your personal data. These rights are set out below.

Right of Access

You have the right to request access to your personal data. This allows you to obtain a copy of the information we hold about you and to verify that we are processing it lawfully. You can exercise this right by submitting a request through our Data Rights Portal. Alternatively, you can email us or write to us at the contact details provided below.

Right of Rectification

You have the right to request that we correct or update any inaccurate or incomplete personal data that we hold about you. If you believe your information is incorrect, you can submit a correction request through our Data Rights Portal. You can also email us or write to us at the contact details provided below.

Right of Erasure

You have the right to request that we delete your personal data in certain circumstances. This right does not apply where we are required by law to retain your information (for example, for healthcare records retention), or where we need to keep the data for legitimate purposes such as defending legal claims. You can submit an erasure request through our Data Rights Portal, or alternatively by emailing or writing to us.

Right of Restriction

You have the right to request that we restrict our processing of your personal data in certain circumstances, for example if you dispute the accuracy of the data or the lawfulness of our processing. Where you exercise this right, we will continue to store your data but will not carry out any further processing except where we have your consent or where processing is necessary for legal claims. You can submit a restriction request through our Data Rights Portal. Alternatively, you can contact us by email or post.

Right to Data Portability

You have the right to request that we provide your personal data to you in a structured, commonly used, and machine-readable format, or that we transfer it directly to another controller at your request. This right applies where we are processing your data based on consent or contract. You can submit a portability request through our Data Rights Portal, or by contacting us by email or post.

Right to Object

You have the right to object to the processing of your personal data in certain circumstances, including where we are relying on legitimate interests as the lawful basis for processing. If you wish to object to our processing, you can submit your objection through our Data Rights Portal. You can also email or write to us at the contact details below.

To exercise any of the rights listed above, the preferred method is to submit your request through our Data Rights Portal.

Alternatively, you can email your request to indigomedical@indigo.gpnet.je, or write to us at:

Data Protection Manager

Indigo Medical No. 2,

8 Oxford Road

St Helier

Jersey JE1 4HB

Telephone: 01534 730541

Please include as much detail as possible in your request so that we can identify the information you are referring to and respond promptly.

We will aim to respond to your request within four weeks of receipt. If your request is complex or if you have submitted multiple requests, we may extend the response period by a further eight weeks. If we decide to extend the period, we will inform you of this within the original four-week deadline.

Where we are processing your personal data based on your consent, you have the right to withdraw that consent at any time. Withdrawal of consent will not affect the lawfulness of processing carried out before the withdrawal.