Last updated: June 2026
1. Who We Are
This website is owned and operated by Brunswick Surgery Ltd, a GP practice registered in England and Wales.
Registered address: Surbiton Health Centre, Ewell Road, Surbiton, Surrey, KT6 6EZ
Company number: 15871645
ICO registration number: [To be added — find on your ICO registration certificate or at ico.org.uk/ESDWebPages/search]
Data Controller: Brunswick Surgery Ltd
Data Protection Lead: [Insert name and title — e.g. Leana Burrage, Practice Manager, or the named DPO if one has been appointed]
For all data protection queries, please contact us at:
Email: swlicb.brunswick.surgery@nhs.net
Post: Data Protection Lead, Brunswick Surgery, Surbiton Health Centre,
Ewell Road, Surbiton, Surrey, KT6 6EZ
2. What This Policy Covers
This Privacy Policy explains how Brunswick Surgery collects, uses, stores and protects your personal data when you use this website (www.brunswicksurgery.co.uk).
It covers:
- Data collected automatically when you visit the site (server logs)
- Data you submit through any of our online forms
- Links to third-party services used on this site
This policy does not cover how Brunswick Surgery handles your medical records and clinical data. That is governed by a separate Practice Data Protection Policy and NHS Data Security and Protection requirements. For information about your medical records, please contact the practice directly.
3. What Is Personal Data?
Personal data is any information that can identify you, directly or indirectly. This includes obvious information such as your name and contact details, as well as less obvious information such as IP addresses and online identifiers.
This website is governed by the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
4. What Personal Data We Collect and Why
The table below sets out exactly what data we collect through this website, how it is collected, and the legal basis for collecting it.
| How collected | Data collected | Purpose | Legal basis (UK GDPR) |
|---|---|---|---|
| Visiting the site (automatic) | IP address, browser type, operating system, pages visited, time and date of visit | Server security, diagnosing technical faults, understanding how the site is used | Article 6(1)(f) — Legitimate interests |
| Temporary Patient Registration form | Full name, date of birth, gender, title, temporary address, contact number, permanent GP practice details | Processing your temporary registration with the practice | Article 6(1)(c) — Legal obligation; Article 9(2)(h) — Medical purposes |
| Update Your Details form | Full name, date of birth, new address, contact numbers, email address | Updating your patient record at the practice | Article 6(1)(c) — Legal obligation; Article 9(2)(h) — Medical purposes |
| Patient Participation Group sign-up form | Name, email address, contact number, postcode, date of birth, gender, age band, ethnicity, surgery usage frequency | Adding you to the Patient Participation Group mailing list and membership | Article 6(1)(a) — Consent |
| Friends & Family Test form | Rating and optional free-text comment. No name is required. | Measuring patient satisfaction and improving services | Article 6(1)(f) — Legitimate interests |
| Suggestion form | Optional name, optional email address, subject and message | Receiving and responding to patient feedback and suggestions | Article 6(1)(f) — Legitimate interests; Article 6(1)(a) — Consent (if email provided) |
We do not collect any special category data (such as health information) through this website other than as part of the registration and update processes described above, which are necessary for your NHS care.
5. Cookies and Analytics
This website uses only essential technical cookies necessary for the site to function. We do not use marketing or tracking cookies.
The Google Translate feature on this site uses a Google service. If you use the Translate function, Google's own privacy policy applies to any data processed by that service. You can review Google's privacy policy at policies.google.com/privacy.
6. How We Use Your Personal Data
We use the personal data collected through this website only for the purposes stated above. Specifically:
- Form submissions are sent securely by email directly to the practice inbox and are used only to fulfil the purpose for which you submitted them
- Automatic server log data is used only for technical and security purposes and is not used to identify individual users
- We do not use your data for marketing purposes
- We do not sell, rent or otherwise pass your personal data to any third party for commercial purposes
7. How We Store and Protect Your Data
All data submitted through this website is:
- Transmitted using SSL/TLS encryption (the padlock icon in your browser confirms this)
- Sent directly to the practice's secure NHS email inbox ([confirm the inbox address used to receive form submissions — e.g. swlicb.brunswick.surgery@nhs.net])
- Stored only for as long as is necessary to fulfil the purpose for which it was submitted
- Held only on servers located within the United Kingdom
The website is hosted by One.com, UK. The hosting provider processes technical data (server logs, IP addresses) as a data processor on our behalf and is bound by a data processing agreement.
We take appropriate technical and organisational measures to protect your personal data against unauthorised access, loss or destruction, including access controls, encrypted transmission and regular security reviews.
8. How Long We Keep Your Data
| Data type | Retention period |
|---|---|
| Server log data (IP address, browser, pages visited) | Up to 30 days, then automatically deleted by the hosting provider |
| Temporary patient registration submissions | Retained in the practice inbox until processed, then handled in accordance with NHS records management guidance |
| Update your details submissions | Retained until the patient record has been updated, then deleted from the inbox |
| PPG sign-up submissions | Retained while you remain an active PPG member. You may ask to be removed at any time. |
| Friends & Family Test responses | [Retention period to be confirmed — e.g. aggregated data retained indefinitely; individual responses deleted after 12 months] |
| Suggestion form submissions | Up to 12 months, or until the matter has been resolved |
9. Sharing Your Personal Data
We do not share your personal data with third parties except in the following circumstances:
- NHS systems: Data submitted for registration or record update purposes will be entered into NHS clinical systems (EMIS/SystmOne) as part of your patient record
- Legal requirement: We may be required to disclose personal data if required by law, court order, or instruction from a government or regulatory authority
- Hosting provider: Our website hosting provider processes technical data as a data processor on our behalf, under a data processing agreement, and does not have access to form submission content
We do not transfer any personal data outside the United Kingdom.
10. Third-Party Links and Services
This website contains links to third-party websites and services, including:
- NHS.uk — for health information and service finders
- Accurx (florey.accurx.com) — for online appointment requests. Accurx's own privacy policy applies when you use their service.
- Google Translate — for page translation. Google's privacy policy applies when you use this feature.
- YouTube — embedded health information videos. YouTube's privacy policy applies when you interact with embedded videos.
We are not responsible for the privacy practices of these third-party services. We encourage you to review their privacy policies before providing any personal data to them.
11. Your Rights
Under UK GDPR and the Data Protection Act 2018, you have the following rights in relation to your personal data:
- The right to be informed — to know how your data is being used (this policy fulfils that right)
- The right of access — to request a copy of the personal data we hold about you (a Subject Access Request)
- The right to rectification — to have inaccurate data corrected
- The right to erasure — to request deletion of your data in certain circumstances
- The right to restrict processing — to request that we limit how we use your data
- The right to object — to object to processing based on legitimate interests
- The right to data portability — to receive your data in a structured, machine-readable format where applicable
- Rights relating to automated decision-making — we do not carry out any automated decision-making or profiling using website data
To exercise any of these rights, please contact our Data Protection Lead using the details in Section 1. We will respond within one calendar month. In complex cases this may be extended to three months, and we will inform you if this is the case.
There is no charge for most requests. We may charge a reasonable administrative fee for requests that are manifestly unfounded or excessive.
12. Complaints
If you have concerns about how we have handled your personal data, please contact us in the first instance using the details in Section 1. We take all complaints seriously and will investigate promptly.
If you are not satisfied with our response, you have the right to lodge a complaint with the Information Commissioner's Office (ICO):
- Website: ico.org.uk/make-a-complaint
- Telephone: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
13. Changes to This Policy
We may update this Privacy Policy from time to time to reflect changes in law, technology or our practices. Any changes will be posted on this page with an updated date at the top. We recommend checking this page periodically.
Continued use of this website after any changes constitutes acceptance of the updated policy.