Privacy Notice
1. Introduction
This Privacy Notice is issued by the operator of Custom EMIS Searches (“we”, “us”, “our”) and applies to personal data processed in connection with https://www.customemissearches.co.uk (the “Website”) and our free custom EMIS Web search design service (the “Service”).
We are committed to processing personal data lawfully, fairly and transparently, and only to the extent reasonably necessary to provide the Service. This Notice should be read together with our Terms of Use.
2. Data controller
For the purposes of the United Kingdom General Data Protection Regulation (the “UK GDPR”) and the Data Protection Act 2018, the data controller is the operator of Custom EMIS Searches. You may contact the controller at enquiries@customemissearches.co.uk.
We are not an NHS organisation, NHS body, or processor acting under a contract with NHS England. We are an independent service. We are not affiliated with EMIS Health, Optum, or any EMIS group company.
3. Scope and whose data we process
This Notice concerns personal data relating to individuals who contact us on behalf of a GP practice or other organisation (for example a practice manager, GP, pharmacist, or administrator). It does not describe processing of patient records in a practice’s clinical system. We do not provide clinical care and we are not a healthcare provider.
The Service is directed at professional users in the United Kingdom. We do not knowingly offer the Service to children.
4. Personal data we collect
Where you email us or speak with us (including by Microsoft Teams where arranged), we may process: your name; professional role; practice or organisation name; NHS or practice email address and other contact details; the content of your enquiry, including search inclusion and exclusion criteria; correspondence needed to clarify a brief, deliver a search, or handle revisions; and any technical data automatically made available by your email or video provider.
We do not operate user accounts, online forms, or a customer database in the current version of the Website. Personal data is received because you choose to send it to us.
5. Data we do not collect and must not be sent
You must not send us patient-identifiable data or other special category data relating to patients. That includes, without limitation, NHS numbers, patient names, dates of birth, addresses, clinical notes, screenshots of identifiable records, list exports, or any other information from which a living individual patient can be identified, whether on its own or in combination with other data.
We do not require access to your practice’s EMIS Web system. Search criteria must be described in non-identifiable terms. If patient-identifiable or special category data is sent to us in error, you must notify us immediately. We will delete that material so far as reasonably practicable and will not use it to provide the Service.
6. How we collect personal data
We collect personal data when you email enquiries@customemissearches.co.uk, when we reply, when we arrange or hold a call, and when you otherwise correspond with us about a search. We do not purchase lists or obtain enquiry data from data brokers.
7. Purposes of processing
We process personal data to: understand and clarify your brief; design, test, and deliver a custom EMIS Web Population Reporting search and any accompanying description of logic; handle revisions; communicate with you about the Service; protect our legal rights; and improve how we operate the Service at a general level (without using patient data).
We do not sell personal data. We do not use enquiry correspondence for unrelated marketing.
8. Lawful bases
Our lawful bases under Article 6 UK GDPR are: (a) legitimate interests (Article 6(1)(f)), namely operating a free professional search-design service, responding to enquiries, and keeping records for a short period so that we can deliver and revise work; and (b) where applicable, steps taken at your request prior to entering a contract, or performance of a contract (Article 6(1)(b)), in respect of delivering a search you have asked us to build.
We do not seek to process special category data concerning health of patients. You must not supply it. We do not rely on Article 9 UK GDPR to process patient health data, because such processing is outside the intended scope of the Service.
9. Recipients and processors
Personal data in emails and calls is processed using third-party communications and productivity providers (for example an email host or Microsoft Teams). Those providers act as independent controllers or as processors, according to their terms. We do not share enquiry data with EMIS Health, Optum, NHS England, or other practices, except where you ask us to copy a named colleague or where we are required by law.
We may disclose personal data if required by a court, regulator, or other competent authority, or where necessary to establish, exercise, or defend legal claims.
10. International transfers
Our communications providers may process data outside the United Kingdom. Where a restricted transfer occurs, we rely on the provider’s appropriate safeguards (such as the UK International Data Transfer Agreement, Addendum, or other mechanism recognised under UK law) together with their published terms. If you do not wish data to be transferred in that way, you should not use the Service.
11. Retention
Enquiry emails and related correspondence are retained only for as long as needed to fulfil the request and handle revisions, and in any event are deleted within 30 days of receipt or of completion of the work, whichever is later, save that we may retain material for longer where we are required to do so by law or where it is necessary in connection with a dispute, complaint, or security incident.
The Website itself does not store an enquiry archive. Deletion from our mailbox does not of itself delete copies held by you or by your email provider.
12. Security
We take reasonable technical and organisational measures appropriate to the nature of email-based correspondence, including limiting access to enquiry mailboxes to persons who need it to provide the Service. No method of electronic transmission or storage is completely secure. You should use a professional NHS or practice mailbox and must not include patient-identifiable data.
13. Cookies and similar technologies
The Website does not use advertising cookies, analytics cookies, or tracking pixels. Any cookies that are strictly necessary for the site to function (if set by the hosting environment) are used only for that purpose. This Notice will be updated if that position changes.
14. Your rights
Subject to the UK GDPR and the Data Protection Act 2018, you have the right of access (including to make a subject access request), the right to rectification, the right to erasure, the right to restrict processing, the right to object to processing based on legitimate interests, and the right to data portability where applicable. You also have the right to withdraw consent if we ever rely on consent (we do not currently rely on consent for enquiry processing).
To exercise these rights, email enquiries@customemissearches.co.uk with sufficient information for us to identify the relevant correspondence. We may need to verify your identity. We will respond within the statutory period unless the request is manifestly unfounded or excessive.
15. Complaints and the Information Commissioner
We ask that you contact us first at enquiries@customemissearches.co.uk so that we can try to resolve your concern. You have the right to lodge a complaint with the UK Information Commissioner’s Office (the “ICO”), the supervisory authority for data protection in the United Kingdom. The ICO may be contacted via https://www.ico.org.uk or by telephone on 0303 123 1113.
16. Changes to this Notice
We may update this Privacy Notice from time to time. The current version will be published at https://www.customemissearches.co.uk/privacy. Continued use of the Website or Service after a change constitutes notice of the updated terms to the extent permitted by law.
17. Contact
Questions about this Privacy Notice or our processing of personal data should be sent to enquiries@customemissearches.co.uk. Please do not include patient-identifiable data in any privacy request.