Comment rédiger un avis de confidentialité à l'intention des patients qui inspire confiance

Most general practices publish a privacy notice because they have to. It’s a requirement under UK GDPR and part of the DSPT. But too often, these notices are legalistic, hard to read, or buried at the bottom of a website - full of passive phrases and technical terms that patients skim past, or never find at all. But your privacy notice is more than a compliance box. It’s your chance to explain, in plain English, how and why you collect and use patient data - and to build trust through transparency. This guide shows you how to write a clear, meaningful privacy notice that informs patients, reassures them, and reflects your practice values. 

Ce que doit faire un avis de confidentialité 

At its core, your privacy notice should: 

• Tell patients what personal data you collect. 

• Explain why and how you use it. 

• Set out your legal basis for processing. 

• Describe how data is stored, shared and protected. 

• Explain patients’ rights. 

• Say who to contact if they have concerns. 

Mais au-delà de cela, un bon avis de confidentialité doit refléter votre pratique - humain, clair et accessible.

Le problème avec de nombreux avis de confidentialité

Too many notices: 

• Use overly formal or technical language. 

• Copy templates without adapting them. 

• Focus on compliance rather than patient understanding. 

• Hide key details in dense paragraphs. 

• Fail to explain how digital tools, like online consultations or apps, fit in. 

The result? Patients don’t read them. Or if they do, they feel confused or even suspicious. 

Comment rendre votre avis de confidentialité plus clair et plus convivial pour les patients 

1. Commencez par un résumé en anglais simple 

Open with a short paragraph that says: 

• Who you are. 

• Why you need to collect and use patient information. 

• What your promise is around confidentiality and respect. 

• Where patients can get more information. 

For example: “At Riverside Surgery, we collect and use information about you to provide safe, personalised care. We always keep your data secure and use it responsibly. This notice explains what information we collect, why we collect it, and your rights as a patient.” This sets a helpful tone and invites the patient to keep reading. 

2. Utilisez des titres et des questions qui reflètent ce que les patients demandent réellement

Structure your notice using questions like: 

• What information do we collect about you? 

• Why do we need your information? 

• Who can see your information? 

• How do we keep your records safe? 

• What are your rights? 

• How can you contact us about your data? 

Cette approche est plus engageante que des sous-titres formels comme « Catégories de données traitées ».”

 3. Expliquez simplement les aspects juridiques 

Au lieu d'énumérer les bases légales sans explication, essayez quelque chose comme : « La loi nous permet de collecter et d'utiliser vos informations pour votre prise en charge directe. Cela s'appelle notre « base légale pour le traitement ». La plupart du temps, nous n'avons pas besoin de votre consentement - par exemple, lorsque nous vous orientons vers un hôpital ou prescrivons un médicament. Mais si nous voulons utiliser vos données pour autre chose, nous vous demanderons votre permission. » Incluez des liens pour ceux qui souhaitent connaître la formulation légale complète - mais gardez le texte principal accessible.

4. Décrivez clairement le partage de données 

Be upfront about how and why you share data, especially with: 

• Hospitals and community services. 

• Local health networks (for example, your PCN). 

• NHS systems and suppliers. 

• Research or public health bodies, if applicable. 

Example: “Sometimes, we need to share your information with other healthcare professionals involved in your care - like a hospital consultant or district nurse. We’ll only share what’s necessary and relevant.” Include a list of key partners if possible, or a link to one. 

5. Gérer les services numériques

If you use tools like: 

• Online consultation platforms (for example, AccuRx, eConsult). 

• SMS or email reminders. 

• Patient apps. 

• Cloud-based clinical systems. 

Explain briefly how data flows through them and reassure patients that these tools meet NHS standards for security and confidentiality. Example: “We use AccuRx to send text messages and collect information before your appointment. This service is secure and approved for NHS use.” 

6. Facilitez la prise de contact 

Incluent : 

• A named role, such as the practice manager or data protection officer. 

• An email and phone number. 

• The address of your practice. 

• A link to the ICO for complaints or escalation. 

Reassure patients that questions are welcome - and that raising concerns won’t affect their care. 

Où et comment publier votre annonce 

• On your website - ideally with a link from the homepage. 

• As a paper copy available at reception. 

• On your waiting room screen or noticeboard. 

• In accessible formats if requested, such as large print or other languages. 

Maintenez-le à jour chaque année — ou chaque fois que vous changez de systèmes ou de fournisseurs.

Dernier mot : la transparence est la confiance

A privacy notice isn’t just a policy. It’s a conversation. Done well, it shows patients that you respect their information, understand your responsibilities and take data protection seriously. By using clear language, practical examples and a welcoming tone, you can turn your privacy notice from a legal hurdle into a trust-building tool - one that supports safer care and stronger relationships.