GDPR Policy



Here at Carraig Mervue Family Practice, we take your privacy seriously.  This page sets out information in relation to data protection and how this practice operates.  It should be read in conjunction with our Practice Privacy and Confidentiality Policy which is available on request.  

What information do we collect about you? 

When you attend or register with us as a patient, we collect the personal details specified in the patient registration formWith your prior knowledge and consent, we may take up copies of your medical records from a previous GP etc.  Your GP is also likely to receive updates from other health professionals, hospitals etc involved in your treatment and care.  

Why do we collect this information?  

We collect this information to provide appropriate treatment and services to you and to ensure your continuity of care and patient safety. We also collect information as required by law.  

On what basis do we process this information?  

Your personal information is mostly collected directly from you and processed by us with your knowledge and express consent.  You may withdraw your consent to the processing of your personal information at any time.  Sometimes, we need to process your personal information to fulfil a legal contract. For example, we will process your laser / credit card details in order to take payment etc.  

Sometimes, your personal information may be processed in accordance with Carraig Mervue Family Practice’s legal obligations, e.g. mandatory reporting obligations in relation to infectious diseases etc. Where possible, your personal information will be anonymised beforehand.   

Your personal information may need to be shared within the healthcare team and support staff in order to provide safe and effective care to you. Your personal information is only accessible by staff as necessary for the fulfilment of their legitimate employment and professional duties.  

Who may we share your information with?  

We may share your information with other healthcare professionals and third party service providers e.g. laboratories when it is necessary and appropriate for your treatment and care.  We share such information strictly on the basis that it will be kept confidential. 

How long do we keep hold of your information?  

We retain records in accordance with the National Hospitals Office (NHO) Code of Practice for Healthcare Records Management which can be viewed at  


Carraig Mervue Family Practice’s registered Data Protection Officer is Michelle Kelly.  Any queries, concerns or requests to exercise Data Protection rights may be addressed to Michelle Kelly at 

Under Data Protection legislation, you may: 

  • Withdraw consent to the processing of your personal information.  

[Note: If you withdraw consent, we may not be able to continue to provide treatment and services to you.  We will talk to you about the possible consequences of withdrawing consent, if and when you let us know that you are thinking of this. The withdrawal of consent will not undermine the lawfulness of processing carried out prior to the withdrawal.] 

  • Request to access the information we hold about you  
  • Request the correction of inaccuracies in / erasure of information held about you 
  • Request the restriction of processing of the information we hold about you 
  • Exercise your entitlement to data portability  
  • Make a complaint to the Office of the Data Protection Commissioner of Ireland

Carraig Mervue Family Practice reserves the right to amend this policy at any time, at it’s discretion. You are encouraged to review this policy from time to time.  We will notify you of changes to this policy where we are required to do so.