Has my protection under current data legislation been breached ?

[Rosielee]

I have verbally been told that my worst fear has happened and have been very stressed since so really sorry for spelling mistakes and if the wording of this post is not concise and misses any context that may be needed to advise properly.

Background. I had a medical assessment through a private medical provider who have an NHS contract to provide this particular assessment.

I was unhappy and wanted a second opinion but this couldn't or wouldn't be arranged however I don't think this is relevant.
What is relevant is that because I had concerns I requested to see the clinic letter to fact check it before it was sent to my GP.
This was agreed and I was sent a draft copy and asked to confirm if it was okay to send.
I responded with some factual amendments and a query about the wording of something.
I was sent a note confirming some factual amendments would be made but there was no mention of some others.
I assumed they would be done and waited to see the next draft.
and continued trying to get clarification about the query. An instruction about DVLA contradicts the guidance with no clinical reason being given, but that's a side issue.
The problem is that I have still not received an amended copy letter to check.
Mistakes in medical records can be difficult to change retrospectively hence why I was insistent that I check before giving permission to send.
There is something that is not factually correct and could be very detrimental to me both short and long term.
Because I was insistent that I needed to see it to check, I think this overrides any implied consent but want to please check if anyone knows this is the case ?
And if this is so, has this company improperly shared my personal data ?

Do I have the legal basis for a complaint about this ?

I've looked at the NHS website etc and I do think I am right to be as frustrated and distressed as I am about this. I have written to the company to ask them to please check and advise if this (incorrec) letter has been sent and of this has breached what I thought legislation protected me from. But have just had a perfunctory letter telling me they will let me know In due course. it does indicate that the letter has been sent but there is no apology.

[echat11]

Hi ROSIELEE

Have you contacted the ICO to get their thoughts / advice on the matter? If data protection principals has been broken then your complaint should be made to them.

https://ico.org.uk/

https://ico.org.uk/for-organisations...gulation-gdpr/

[Rosielee]

Yes I did call the ICO to enquire.
The man who answered sounded like he was driving, told me that I should write to the company to ask because he wasn't sure. I found this rather odd.

I have written to the company and said that I've been made aware that there has been a potential data breech and would they please look into it and advise me.
I received a perfunctory reply, no whiff of an apology and am now in this state of purgatory. I'm Autistic and any state of uncertainty is torturous.
As is the worry and anticipation of needing to subsequently try to get the incorrect facts on my medical record corrected.

I'm as mad as a wasp in a bottle and spitting metaphorical feathers about this.

My stance is that the instruction I gave to check the letter before sent was an objection to this info being shared without my permission . According to the NHS guidance on this issue, any objection overides the 'implied consent', which is usually assumed in these situations.
From what I can gather there needs to be a legal basis to override my objection but I don't have a legal mind hence why I hoped someone here might know.

[echat11]

Send the private medical provider a SAR, they have 30 days to provide you with all the information they hold on you. Also the clock is ticking if you want to complain to the ICO. You have 3 months from your last point of contact with the private medical provider. If you asked to see a draft, explicitly before it was sent, but they just sent it anyway, then that would breach 'data protection' principals.