Last Updated: September 2026

St. Katharine Docks Practice is committed to protecting the privacy, confidentiality, and security of the personal information we hold about our employees, workers, contractors, locums, and volunteers.

This Privacy Notice explains how we collect, use, store, and protect your personal information in accordance with the UK General Data Protection Regulation (UK GDPR), the Data Protection Act 2018, and NHS information governance requirements. It has been developed in line with the Practice's existing employee privacy notice and governance documentation.

Who We Are

St.Katharine Docks Practice is the Data Controller for the personal information we process about our employees.

Practice Manager:
Fayzur Baksh

Practice Address:
[VERIFY ADDRESS]
12–14 Nightingale House
50 Thomas More Street
London E1W 1UA

Email:
fayzur.baksh@nhs.net

Data Protection Officer (DPO):
Sohifa Kadir

 

 

How We Collect Information

We collect personal information directly from you during recruitment and throughout your employment.

We may also receive information from:

  • Referees and previous employers
  • Occupational health providers
  • Professional regulators
  • Disclosure and Barring Service (DBS)
  • Training providers
  • Payroll and pension providers
  • NHS organisations
  • Government agencies and regulatory bodies where required by law

 

 

What Information We Collect

Personal Information

We may collect:

  • Name, address, telephone number and email address
  • Date of birth
  • Gender (where required)
  • National Insurance number
  • Bank account details
  • Emergency contact information
  • Qualifications and employment history
  • Professional registration details where applicable
  • Right to work documentation and identity verification records

Employment Information

We may process information relating to:

  • Job title and role
  • Employment contracts and terms of employment
  • Salary, pension and benefits information
  • Training, appraisal and development records
  • Annual leave and sickness records
  • Disciplinary, grievance and performance management records where applicable

Special Category Information

Where required by law or necessary for employment purposes, we may process:

  • Health information
  • Occupational health records
  • Disability information
  • Information relating to reasonable adjustments
  • Immunisation records where relevant
  • DBS and safeguarding information where required

Professional and Regulatory Compliance

As a healthcare provider, we may process information relating to:

  • Professional qualifications
  • Professional registrations
  • Mandatory training compliance
  • Appraisals and revalidation
  • Fitness to practise requirements
  • Clinical governance and regulatory compliance

 

 

Why We Use Your Information

We use employee information to:

  • Recruit and employ staff
  • Pay salaries and administer pensions and benefits
  • Maintain employment records
  • Meet legal and regulatory obligations
  • Contact you, including in emergencies
  • Manage sickness absence and occupational health matters
  • Support staff health and wellbeing
  • Deliver training and professional development
  • Make reasonable workplace adjustments
  • Ensure the safe and effective operation of the Practice

 

 

Legal Basis for Processing

We process personal information under the following lawful bases:

Article 6 UK GDPR

  • Article 6(1)(b) – Processing necessary for the performance of an employment contract.
  • Article 6(1)(c) – Processing necessary to comply with legal obligations.
  • Article 6(1)(f) – Processing necessary for the legitimate interests of operating and managing the Practice.

Article 9 UK GDPR (Special Category Data)

  • Article 9(2)(b) – Employment, social security and social protection obligations.
  • Article 9(2)(h) – Occupational health and healthcare management purposes where applicable.

 

 

Monitoring of Practice Systems

To protect patient information, maintain information security, investigate incidents, and ensure compliance with Practice policies and legal obligations, the Practice may monitor the use of its IT systems, email, internet services, telephony systems, and other electronic communications in accordance with applicable law and Practice policies.

Further details can be found in the Practice's IT, Information Governance, and Acceptable Use policies.

 

 

Who We Share Information With

We only share personal information where there is a lawful basis to do so.

This may include:

  • NHS England and other NHS organisations
  • Payroll and pension providers
  • HM Revenue & Customs (HMRC)
  • Occupational health providers
  • Professional regulators
  • Disclosure and Barring Service (DBS)
  • External auditors, legal advisers, and regulators where required by law
  • Government departments and enforcement agencies where legally required

We do not sell personal information and do not share it for marketing purposes.

 

 

International Transfers

We do not routinely transfer employee information outside the United Kingdom.

Where an international transfer is necessary, appropriate safeguards will be implemented in accordance with UK data protection legislation.

 

 

How Long We Keep Information

Employment records are retained in accordance with the NHS Records Management Code of Practice and other applicable legal and regulatory requirements.

Retention periods vary depending on the type of record and the legal obligations that apply. When information is no longer required, it will be securely deleted, anonymised, or destroyed.

 

 

How We Protect Your Information

We take appropriate technical and organisational measures to protect personal information, including:

  • Secure NHS and Practice IT systems
  • Role-based access controls
  • Password protection and encryption where appropriate
  • Information governance and confidentiality training
  • Secure storage of paper and electronic records
  • Secure destruction of records when no longer required

 

 

Your Rights

Under UK data protection law, you have the right to:

  • Request access to your personal information
  • Request correction of inaccurate information
  • Request erasure of information in certain circumstances
  • Request restriction of processing
  • Object to processing where applicable
  • Request data portability where applicable
  • Lodge a complaint about how your information is handled

To exercise any of these rights, please contact the Practice Manager or Data Protection Officer.

 

 

Complaints

If you have concerns about how your personal information is handled, we encourage you to contact the Practice Manager or Data Protection Officer in the first instance so that we can investigate and resolve the matter.

You also have the right to complain to the Information Commissioner's Office (ICO):

Website: Information Commissioner's Office

Telephone: 0303 123 1113

Postal Address:
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

 

 

Review of This Notice

This Privacy Notice will be reviewed periodically and updated when required to reflect changes in legislation, guidance, or Practice processes.

Document Owner: Practice Manager
Approved By: Dr Sarit Patel
Review Date: 01-07-2026