Privacy impact assessment
Organisation: Northgate Health Ltd
Project or system: Patient reminder app
Owner: Head of Digital
Assessed by: Priya Nair, Data Protection Officer
Date: 9 April 2027
1. What the project does
Sends appointment reminders by text and lets patients change their booking online.
2. Why personal data is needed
To remind people of appointments and cut missed visits.
3. The data
Personal data used
Name
Mobile number
Appointment time and clinic
No medical notes
Whose data it is
Patients over 16, about 12,000 people
Who else receives it
The text message provider, as our processor, under contract
How long it is kept
Reminders deleted 30 days after the appointment
4. Risks to people
A wrong number could reveal an appointment to a stranger
A breach could expose names and numbers
5. Safeguards
Confirm the number at booking
No clinic details in the text
Encrypted storage and staff access limits
6. Risk that remains
Level after safeguards: Risk that remains after the safeguards
7. Decision and next steps
Go ahead after the number check is built. Review again in 12 months.
Signed off by: ______________________ Date: ______________
This assessment is a record of the organisation's own review. It is not legal advice.