Published NHS data powers the benchmark dashboards, Funding & equity, Find a GP and AI Insights. It is public, aggregate data. QOF results, GP Patient Survey, workforce and payments publications, CQC ratings and so on, with no patient-identifiable information. This is why the benchmark dashboards can be free for all NHS staff. The Benchmarks → Data sources page lists every dataset and when it was last refreshed.
Your organisation's clinical data powers the Performance and Actions dashboards (QOF: live, Multi-KPI patients, Data quality, CQC performance, CQC actions, Childhood immunisations) and the monitoring and recall features. It is ingested from your own clinical system, held in UK-based infrastructure, protected by row-level security so it is visible only to your organisation's approved users, and access-audited.
AI Insights queries only the published data warehouse: your questions are never answered from patient records.
Friends & Family Test responses are collected anonymously: the response is not linked back to the patient or their medical record, and patient contact details used for sending invitations are handled separately from responses. The contact opt-out list is always honoured.
Nexus deletes on a schedule rather than on request. A job runs every night and records what it removed, so the periods below are enforced by the product, not by someone remembering.
Three things deliberately do not expire on this schedule:
Your practice's own message templates, sign-offs and settings are configuration, not patient data, and are never removed by this schedule.
Nexus uses a small number of suppliers: hosting, email and message delivery, error reporting and billing. We publish the full list, with what each one handles and where it processes, as our sub-processor register: /legal/sub-processors (also linked from the footer of Nexus's public pages). It is generated from the same record we maintain internally, so it is always the current list.
We keep a register of personal data breaches. If one affects data we process for your practice, your practice's Nexus administrators are told within 24 hours of our becoming aware of it, with what happened, the kinds of data involved and what we are doing, so that you, as data controller, can decide whether to report it to the Information Commissioner's Office. The contact for incidents is shown at the foot of the sub-processor register.
An erasure request against the GP record itself goes to your practice and your clinical system supplier. That record is yours, not ours.
Where a patient asks us to erase what Nexus holds, your practice raises the request with our Data Protection Officer at support@primarycareit.co.uk. The DPO checks it is in scope, confirms there is no overriding reason to keep the data (an open clinical-safety investigation, for example), and tells your practice before anything is removed: because monitoring and recall for that patient stops, and your own EHR recall stays your responsibility.
Once the DPO validates the request, the deletion is automatic and happens within seven days: usually the same night. It removes the patient's NHS number and other identifiers, their name and date of birth, and their clinical content from our copy, and it adds them to a permanent exclusion list so the nightly extract from your clinical system cannot bring them back. A de-identified operational record is kept for clinical-safety assurance: it records what happened and when, but it can no longer be connected to a person. That retention is required of us as a clinical-safety measure and is explained in the data protection pack your DPO can request.
The exclusion list is re-applied if we ever have to restore from backup, so a restore cannot quietly undo an erasure.
A practice administrator can raise a subject access export for one patient themselves, from Practice → Governance and data protection. See Subject access requests in Nexus.
For other data protection queries, deletion requests, or a copy of governance documentation for your DPO, contact support@primarycareit.co.uk.