Privacy, data protection & GDPR.
A general practice is a trusted community governed by an ethic of privacy and confidentiality. This statement explains what information we hold about you, why, who we share it with and your rights.
Practice privacy statement
In order to provide for your care, we need to collect and keep information about you and your health in your personal medical record. Our policies are consistent with Medical Council guidelines and the principles of data protection law (the GDPR and the Data Protection Act 2018). This practice has adopted the requirements of the ICGP guideline Processing of Patient Personal Data: A Guideline for General Practitioners.
Data controller: Bedford Medical Centre, Convent Road, Athlumney, Navan, Co. Meath, C15 PD0V. Tel (046) 902 1369.
Lead for data protection: Dr Niall Maguire. You can contact him through reception or in writing at the address above.
What we hold and why
Your medical record.
Your record includes your contact details, PPS number and medical card details, and information about your health: consultations, diagnoses, prescriptions, test results, referrals, letters from hospitals and other clinicians, and immunisations. We use it to:
- provide you with safe, continuous medical care and treatment
- communicate with you about appointments, results and recalls
- refer you to and receive information from hospitals, consultants, labs and other health professionals involved in your care
- claim payments due under the GMS and other State schemes, and issue invoices for private care
- meet our legal and professional obligations, including notifiable diseases, safeguarding, and court orders
- run screening, immunisation and chronic-disease programmes you are enrolled in
Our legal bases are the provision of healthcare (GDPR Article 6(1)(c) and (e), and Article 9(2)(h)), our legal obligations, and, for some optional services, your consent. Within the practice, information is accessed only by staff who need it for your care or its administration, all of whom are bound by confidentiality.
Who we share it with
Only where it is needed for your care or required by law.
- Other health professionals treating you — hospitals, consultants, NEDOC out-of-hours service, public health nurses, pharmacies, physiotherapists and laboratories
- The HSE / PCRS for medical card, GP visit card and scheme claims, and national programmes such as CervicalCheck, BreastCheck, BowelScreen and immunisation registers
- Your previous or new GP when you join or leave the practice, at your request
- Secure systems we use to run the practice — our practice-management software, the myClinic365 Patient Portal, Healthmail secure email, and IT support providers, all under contracts that bind them to confidentiality and security
- Insurers, employers, solicitors or State bodies only with your written consent or where the law requires it
We never sell your data and we do not use it for marketing.
How long we keep it
We keep medical records in line with ICGP and Medical Council guidance. In general, an adult’s record is kept for at least 8 years after the last contact with the practice, a child’s record until their 25th birthday (or 26th if they were 17 at the time of treatment), and records of deceased patients for 8 years after death. Records may be kept for longer where there is a legal or clinical reason.
Your rights
You have the right to:
- access a copy of your medical record — ask at reception or write to the practice; we respond within one month and there is normally no charge
- rectification of factual errors in your record
- restrict or object to certain processing, where the law allows
- portability — to have your record sent to another GP, which we do routinely when you move practice
- withdraw consent at any time for anything based on consent
- complain — first to the practice, and if you remain unhappy to the Data Protection Commission, 21 Fitzwilliam Square South, Dublin 2, D02 RD28
Note that a GP may, in limited circumstances, withhold part of a record where release would be likely to cause serious harm to your physical or mental health, or would reveal information about another person.
This website and online forms
How the website itself handles information.
- The registration and medical records request forms send what you enter directly to our practice team by secure email, and a copy is held on the website server for a short period so it is not lost. It is used only to register you or to write to your previous GP, and is then filed to your medical record.
- Do not use website forms for anything urgent or to send us detailed medical information — use the Patient Portal, phone, or come in.
- The website sets no tracking or advertising cookies. See our Cookies page for the small amount it does store.
- The Patient Portal (myClinic365) is a separate secure system with its own privacy notice, which you agree to when you register for it.
Form submissions are automatically deleted from the website 30 days after they are received; by then they have been actioned and filed to your record.
Changes to this statement
We review this statement periodically and will publish any changes here. Last reviewed: September 2026.
Questions about your information?
Ask for the practice manager or the data protection lead.