1. Why are we providing this privacy notice?

We are required to provide you with this Privacy Notice by Law. It explains how we use the information we collect, store and hold about you. If you are unclear about how we process or use your information, or you have any questions about this Privacy Notice or any other issue regarding your information, then please contact our LMC Compliance Lead (see below).

The Law says:

We must let you know why we collect information about you.

We must let you know how we use any information we hold on you.

We need to inform you in respect of what we do with it.

We need to tell you about who we share it with or pass it on to and why.

We need to let you know how long we keep it for.

Topics covered:

• About Us
• How we use the data we collect
• Change of purpose
• Sharing your information
• Storing your information
• How we keep your information secure
• Your rights
• Changes to this policy
• How to contact us / complaints

 

2. About Us

We are Worcestershire Local Medical Committee Ltd, (‘the LMC’) our registered office is Worcestershire Local Medical Committees Ltd, Azets, Epsilon House, The Square, Gloucester Business Park, Brockworth GL3 4AD, company number 06236780.

Worcestershire Local Medical Committee is the statutory representative body for GPs and their Practices, operating across the county of Worcestershire. We exist solely to represent, advise, and support GPs and their Practices.

We are the Data Controller of your information.

There may be times where we also process your information.

This means we use it for a particular purpose and, therefore, on those occasions we may also be Data Processors.

The purposes for which we use your information are set out in this Privacy Notice.

3. How we use the data we collect

a) We collect personal data in order to advise, and support Represented Practitioners and their practices. The information we collect depends on the context and nature of your interactions with us. It also depends on the choices that individuals make. For example, where data processing is based upon consent or dependent upon the provision of certain information and consent is withdrawn or information not provided, then we may be unable to undertake We will only use personal data where we have a valid lawful basis to do so. We summarise below what information we collect, how we use it and what our legal basis is for using it.

b) We have a duty to process personal data fairly, lawfully and in a manner that you would expect given the nature of our relationship with you. Where we have a legal basis to use your personal data without consent (as set out below), this policy fulfils that duty by giving you appropriate notice and explanation of the way in which your personal data will be used.

c) If you are a Represented Practitioner:

Interacting with you and representing your views;

We collect and use personal data about you in order to:

• administer your membership (if applicable);
• provide you with advice, support and
• seek and represent your
• keep you informed about the LMC’s activities and other information which we consider may be of interest or use to you.
• provide pastoral care; and
• administer the LMC’s.

 

We collect and use the following personal data about you, where relevant:

• contact
• job title, employment status and practice
• professional
• age and date of birth
• bank/payment
• medical information; in relation to occupational health assessments and reports, and fitness to practice investigations and complaints.
• BMA membership and GMC registration
• user account, log-in and website use records (please see the website for its separate privacy policy).
• voting
• training records; and
• information that you provide to us in correspondence and records of our contacts and correspondence with you.

 

We obtain the above personal data directly from you and/or your practice, from public domain sources and from third parties (such as other NHS bodies).

Our lawful basis for processing the above personal data is that its processing is necessary in connection with the legitimate interests of the LMC as a body that advises, supports and represents practitioners and their practice staff. We undertake some processing that is necessary for the performance of a task carried out in the public interest (including assisting the Integrated Care Board with their consultations) or in order for the LMC to carry out its legal obligations (including the determination and apportionment of administrative expenses and the provision of reports to NHS England).

We retain personal data relating to your membership whilst you are on the Performers List (or in training within the LMC area) and for five years after thereafter unless there is a legitimate reason to retain some or all of it longer, such as in connection with a fitness to practice investigation or complaint or for archiving purposes.

We generally retain:

• Minutes of LMC meetings for 12 year
• records of elections for a period of ten years following the
• records of financial transactions for a period of six years following the transaction (or, if later, the end of the contract to which the    transaction relates).

 

Supporting you in relation to fitness to practice investigations

• In addition to the categories of data and details of processing described above, we may hold and process medical information and testimonials about you and allegations against you in relation to fitness to practice
• Our lawful basis for processing the above personal data is that its processing is necessary in connection with the legitimate interests of the LMC as a body that advises, supports and represents practitioners.
• We retain records relating to fitness to practice investigations for a period of ten years from the end of the investigation or (as applicable) date of the last

 

Supporting you in relation to complaints

• The same categories of data and details of processing apply to supporting you in relation to complaints as apply to fitness to practice investigations.
• Our lawful basis for processing the above personal data is that its processing is necessary in connection with the legitimate interests of the LMC as a body that advises, supports and represents practitioners.
• We retain records relating to complaints for a period of Ten years from the end of the conclusion of the complaints process (including the exhaustion of all possible legal proceedings).

 

Special category personal data

• Where the personal data described above includes the special category personal data of Represented Practitioners such as BMA membership number:
• We may hold and process such special category data in connection with our legitimate activities provided that the special category personal data is not disclosed outside the LMC without your
• We may hold and process such special category data to the extent necessary for the establishment, exercise or defence of legal claims or in order to comply with legal obligations.
• in some cases, such as where the LMC is sent unsolicited information or in other unforeseen circumstances, there may be public interest grounds to hold and process special category personal data.

 

Processing requiring consent

• We will obtain your consent for any data processing that requires consent, such as for marketing purposes or to disclose your personal data outside the LMC in cases where such disclosure does not fall within a lawful basis for processing and (as applicable) condition for processing special category personal data outlined above.
• Even if consent to sharing personal data is not required, we would ask you to inform us of any instances where would prefer that any of your personal data is not shared.

d) If you are a not a Constituent

 

Anonymised information

Where practicable, we encourage the provision of anonymised information. Anonymised information does not engage any rights under data protection and privacy laws, hence falls outside the scope of this policy.

Personal data

• We may receive information relating to an identified or identifiable non-constituent in relation to our advising, support and representation of Represented Practitioners or their staff. This information may be provided to us by the individual data subject, by the Represented Practitioner or by a third
• Such Non-Member personal data is handled in confidence and is used only for the purpose of advising, supporting and representing Represented Practitioners or their staff.
• Our lawful basis for using such non-constituent personal data is that its processing is either necessary in connection with the legitimate interests of the LMC as a body that advises, supports and represents General Practitioners and their staff or necessary for the performance of a task carried out in the public interest.
• Such non-constituent personal data is retained for as long as necessary in connection with our advising, support and representation of the relevant Represented Practitioner(s) and then destroyed.

 

Special category personal data

• We will usually only receive special category personal data of non-constituents (e.g. data concerning health) in connection with fitness to practice investigations and complaints. In such cases, we may hold and process such data to the extent necessary for the establishment, exercise or defence of legal claims.
• In some cases, such as where the LMC is sent unsolicited information or in other unforeseen circumstances, there may be public interest grounds for us to hold and process the special category personal data of non-constituents.

 

4.  Change of purpose

We may only use your personal data for the purpose for which we collected it and any purposes that are compatible with that original purpose. Please note that we may process personal data without the data subject’s knowledge or consent where this is required or permitted by law.

5. Sharing your information

We may share your personal data (with your consent or under the lawful bases and special category conditions outlined above) as appropriate with the third parties involved in the activities set out above, for example: legal advisors, parties identified as being involved in issues with which we are assisting Represented Practitioners, regulators and other bodies with oversight of fitness to practice and complaints.

We may also need to share personal data with a regulator or otherwise to comply with the law.

We may share anonymised information with third parties. Such information does not engage any rights under data protection and privacy laws, hence falls outside the scope of this policy

We require all outside service providers to take appropriate and stringent security measures to protect your personal data in line with our policies. We do not allow our third party service providers to use that personal data for their own purposes and we only permit them to process personal data for specified purposes in accordance with our instructions.

We currently use the following service providers:

• Azets Accountancy, part of Azets Holdings Limited
• IceStar Media Limited, Website Design and Development

 

6. Storing your information

Where personal data that we control is transferred outside the EEA we will take all steps reasonably necessary to ensure that your personal data receives an adequate level of protection and is treated in a way consistent with EU and UK laws on data protection.

We will only retain personal data for as long as is necessary in order to fulfil the purposes for which it was collected it for, including for the purposes of satisfying any legal, accounting or reporting obligations. Any personal data linked to a possible legal claim may be retained for a period of 10 years.

 

7. How we keep your information secure

All information that you provide to us is stored on secure servers. We have put in place appropriate measures to protect the security of your information.

The transmission of information via the internet is not completely secure. Although we take appropriate measures to protect your personal data, we cannot guarantee the security of the information transmitted over the internet or to our website and any transmission is at the sender’s own risk.

You are responsible for keeping confidential any passwords that you have to access our services. Please do not share your password(s) with anyone else. If you lose control of your password, you may lose control over your personal data. If your password has been compromised for any reason, please let us know immediately by contacting us via the website.

 

8. Your rights

Subject to certain conditions, you have the right under data protection laws to:

• request access to your personal data (commonly known as a “data subject access request”). This enables you to receive a copy of the personal data we hold about you and to check that we are lawfully processing it. This right is subject to a number of exemptions which allow information to be withheld in certain circumstances. For example, subject access rights are excluded where compliance would involve disclosing: information relating to another individual; data which consists of information which is subject to legal professional privilege; negotiations or confidential references.
• request correction or erasure of your personal data (unless we have the legal right to retain it. You also have the right to ask us to delete or remove your personal data where you have exercised your right to object to processing (see below);
• object to processing your personal data where we are relying on a legitimate interest (or those of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your personal data for direct marketing purposes; and
• request the restriction of processing of your personal data. This enables you to ask us to suspend the processing of personal data about you, for example if you want us to establish its accuracy or the reason for processing it.

If you want to exercise any of the above rights, please contact us via our address, the website or emails published on the website.

You will not usually have to pay a fee to access your personal data (or to exercise any of the other rights). However, we may charge a reasonable fee if your request for access is manifestly unfounded or excessive. Alternatively, we may refuse to comply with the request in such circumstances.

We may need to request specific information from you to help us confirm your identity and ensure you have your right to access the information (or to exercise any of your other rights). This is another appropriate security measure to ensure that personal data is not disclosed to any person who has no right to receive it.

In the limited circumstances where we are relying on your consent as the legal basis to process your personal data for a particular purpose, you have the right to withdraw your consent for that specific processing at any time. To withdraw your consent, please contact us via our address, the website or emails published on the website. Once we know that you have withdrawn your consent, we will no longer process your information for the purpose or purposes you originally agreed to, unless we have another legitimate basis for doing so in law.

 

9. Changes to this policy

We keep our privacy policy under review and will post any updates on this webpage.

This privacy policy was last updated in January 2026.

 

10. How to contact us/ complaints.

The LMC is registered with the Information Commissioner’s Office under registration number Z9904887

If you have any questions about this privacy policy or how we handle your personal data please contact us via our address, the website or emails published on the website.

If for any reason you are not happy with the way that we have handled your personal data, please contact us directly. If you are still not happy, you have the right to make a make a complaint to the Information Commissioner’s Office see: https://ico.org.uk/global/contact-us/.