Privacy Notice: Under 16-Year-Olds

1. Introduction

This Privacy Policy explains how Matlock and Ashover Practice collects, uses, and protects personal data relating to patients under the age of 16, in accordance with:

• UK General Data Protection Regulation (UK GDPR)
• Data Protection Act 2018
• NHS Confidentiality Code of Practice

We are committed to protecting the privacy and rights of children and young people and ensuring that information is handled lawfully, fairly, and transparently.

2. Information we collect

We may collect and process the following information about patients under 16:

• Personal details (name, date of birth, address, NHS number)
• Contact information for parents/guardians
• Medical history and clinical records
• Appointment and treatment records
• Safeguarding information where necessary
• Correspondence with parents, carers, schools, and other healthcare professionals

3. Lawful basis for processing

We process children’s data under the following legal bases:

• Provision of healthcare 
• Legal obligations (e.g. safeguarding duties)
• Vital interests where life or health is at risk

Where consent is required, it will be obtained from:

• A parent/guardian or
• The child themselves, if they are deemed Gillick competent

4. Gillick competence and children’s rights

A child under 16 may consent to their own medical treatment and data processing if they are assessed as having sufficient understanding and intelligence to make that decision (Gillick competence).

Where a child is Gillick competent:

• Their confidentiality will be respected.
• Information will not be shared with parents without the child’s consent, unless there is a serious risk of harm or legal requirement.

5. Sharing information

We may share information with:

• Other NHS services and healthcare professionals
• Local safeguarding authorities
• Schools or social services where appropriate and lawful
• Laboratories, pharmacies, and specialist services

Information is shared only when necessary, securely, and in accordance with the law.

6. Safeguarding

We have a legal and professional duty to share information if there are concerns about a child’s safety or wellbeing. This may occur without consent if required to protect the child or others from harm.

7. Data security

We protect children’s personal data through:

• Secure clinical systems
• Restricted staff access
• Encryption and password protection
• Regular staff training on confidentiality and data protection

8. How long we keep records

Children’s medical records are retained in line with NHS Records Management Code of Practice, typically until the patient is 25 years old, or longer if clinically necessary.

9. Rights of the child and parents

Children and parents/guardians may have the right to:

• Access personal data
• Request correction of inaccurate data
• Request restriction of processing
• Object to certain uses of data

These rights depend on the child’s age, understanding, and circumstances.

10. Complaints and contact

If you have concerns about how your data is used, please contact:

Data Protection Officer: Paul Couldrey via email

If you remain dissatisfied, you may contact the Information Commissioner’s Office (ICO)

11. Policy review

This policy is reviewed regularly to ensure compliance with legal and professional standards.