Privacy Notice: Use of GP Automate and Hero Health

Introduction

At Wateringbury Surgery, we are committed to providing safe, effective and high-quality care while protecting your privacy and confidentiality.

To support our clinicians and improve the efficiency of processing laboratory test results, we use GP Automate, a secure Robotic Process Automation (RPA) system that assists with the management of pathology and laboratory reports. In some workflows, GP Automate works alongside Hero Health, which enables secure patient communication regarding certain test results.

GP Automate is designed to automate administrative and clinical workflows that have been approved by the practice. The system supports, but does not replace, clinical decision-making. Clinicians remain responsible for reviewing and acting upon results where required.

Why We Use GP Automate

GP Automate helps clinicians and practice staff to:

• Process laboratory results more efficiently.
• Reduce administrative workload.
• Ensure routine results are managed consistently.
• Improve communication with patients.
• Support timely follow-up where further review is required.
• Reduce the risk of delays in routine clinical processes.

The system assists with workflow management and administration only and does not make independent clinical decisions.

What Information Is Processed?

GP Automate may proces:

• Laboratory and pathology test results.
• Relevant information from your medical record.
• Information relating to existing medical conditions.
• Demographic identifiers such as your name, date of birth and NHS number.
• Contact information required for sending patient communications where appropriate.

This may include special category personal data relating to your health.

How the System Works

GP Automate uses Robotic Process Automation technology to interact securely with the practice clinical system (EMIS).

Clinical oversight is required for every consultation summary before it can be saved. The system does not automatically make changes to your medical record.

The system can:

• Process normal test results that have been approved by the practice for automation.
• Identify specific results requiring patient communication.
• Generate tasks for practice staff where follow-up is required.
• Send approved patient communications through Hero Health where appropriate.
• Code information into the patient record where authorised workflows permit.

Examples of automated workflows may include:

• Prediabetes (Non-Diabetic Hyperglycaemia) results.
• Diabetes monitoring results.
• Vitamin D insufficiency results.
• Lipid and cholesterol monitoring results.

Where a result falls outside defined parameters or requires clinical judgement, GP Automate generates a task for the appropriate member of the practice team for review.

If an automated process fails, the result remains within the clinical system and is highlighted to staff for manual action. No patient information is deleted or removed from the clinical record by GP Automate.

How Your Information Is Protected

GP Automate processes information securely using UK-based Microsoft Azure cloud services.

Security measures include:

• Encryption of data in transit and at rest.
• Role-based access controls.
• Audit logging of automated processes.
• Secure access management.
• Daily monitoring of automated workflows.
• Retention of source records within the clinical system.

No patient data is lost if an automated process fails. Original records remain within the practice's clinical system and can be reviewed by authorised staff at any time.

Who Is Responsible for Your Information?

• Wateringbury Surgery is the Data Controller and decides how your information is used.
• GP Automate acts as a Data Processor and processes information only on behalf of the practice and under our instructions.
• Hero Health acts as a separate Data Processor when delivering patient communications on behalf of the practice.

Lawful Basis for Processing

The lawful basis for processing your information for direct care is:

• UK GDPR Article 6: Article 6(1)(e) Public Task
• UK GDPR Article 9: Article 9(2)(h) Provision of health or social care and treatment

This processing supports the delivery of direct patient care, management of laboratory results and maintenance of accurate medical records.

Is My Information Used to Train AI?

No.

GP Automate uses Robotic Process Automation technology to carry out predefined workflows and does not use patient information to train artificial intelligence models.

Patient information is processed solely for the purpose of supporting direct patient care and practice administration.

How Long Is Information Retained?

The approved consultation note becomes part of your medical record and is retained in accordance with the NHS Records Management Code of Practice.

For auditing purposes, GP Automate retains a unique identifier from processed laboratory reports. According to GP Automate's privacy documentation, these audit identifiers are automatically deleted after 30 days.

Your Rights

Under UK data protection law, you have the right to:

• Be informed about how your information is used.
• Access your records.
• Request correction of inaccurate information.
• Request restriction of processing where applicable.
• Object to processing where permitted by law.
• Raise concerns about how your information is used.
• Lodge a complaint with the Information Commissioner's Office (ICO).

If you would like more information about how your information is used, please contact:

Practice Manager
Suzanne Large

Wateringbury Surgery
14 Pelican Court
Wateringbury
Maidstone
Kent
ME18 5SS