GDPR/Privacy Notices

Please read about how your information is being used for COVID-19 research.

Your Information, Your Rights

Being transparent and providing accessible information to patients about how we will use your personal information is a key element of the Data Protection Act 1998 and the EU General Data Protection Regulations (GDPR). The following notice reminds you of your rights in respect of the above legislation and how your GP Practice will use your information for lawful purposes in order to deliver your care and the effective management of the local NHS system.

This notice reflects how we use information for:

  • The management of patient records.
  • Communication concerning your clinical, social and supported care.
  • Ensuring the quality of your care and the best clinical outcomes are achieved through clinical audit and retrospective review.
  • Participation in health and social care research.
  • The management and clinical planning of services to ensure that appropriate care is in place for the people of Great Yarmouth and Waveney today and in the future.

Data Controller

As your registered GP practice, we are the data controller for any personal data that we hold about you. (Information Commissioner’s Office registration reference Z4717117)

Consent and other lawful bases for processing

We will seek explicit consent from you for procedures such as minor surgery when we ask you to fill in and sign a consent form, or when giving you a vaccination or immunisation when we will ask for your verbal consent (or verbal parental/guardian consent in the case of child patients). For explicit consent to be valid that consent must be:

  • Freely given
  • Specific
  • Informed
  • An unambiguous indication of the data subject’s agreement

However other processing of information will be done by implied consent such as when you agree to a referral from a doctor to another healthcare professional e.g.  a hospital consultant. The lawful basis for processing what is called “special category” (sensitive data) healthcare data for direct care is that processing is “necessary . . . in the exercise of official authority vested in the controller” Article 6(10) (e) of the NHS Act 2006 and “processing is necessary for compliance with a legal obligation to which the controller is subject” Article 6(1)(c) of the NHS Act 2006. The “special category condition” for processing direct care is that processing is “necessary for the purposes of preventative or occupational medicine for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services …” Article 9(2)(h) of the NHS Act 2006.

What information do we collect and use?

All personal data must be processed fairly and lawfully, whether is it received directly from you or from a third party in relation to your care.

We will collect the following types of information from you or about you from a third party (provider organisation) engaged in the delivery of your care:

  • ‘Personal data’ meaning any information relating to an identifiable person who can be directly or indirectly identified from the data. This includes, but is not limited to name, date of birth, full postcode, address, next of kin and NHS Number; and
  • ‘Special category / sensitive data’ such as medical history including details of appointments and contact with you, medication, emergency appointments and admissions, clinical notes, treatments, results of investigations, supportive care arrangements, social care status, race, ethnic origin, genetics and sexual orientation.

Your healthcare records contain information about your health and any treatment or care you have received previously (e.g. from an acute hospital, GP surgery, community care provider, mental health care provider, walk-in centre, social services). These records may be electronic, a paper record or a mixture of both. We use a combination of technologies and working practices to ensure that we keep your information secure and confidential.

Why do we collect this information?

The NHS Act 2006 and the Health and Social Care Act 2012 invests statutory functions on GP Practices to promote and provide the health service in England, improve quality of services, reduce inequalities, conduct research, review performance of services and deliver education and training. To do this we will need to process your information in accordance with current data protection legislation to:

  • Protect your vital interests
  • Pursue our legitimate interests as a provider of medical care, particularly where the individual is a child or a vulnerable adult
  • Perform tasks in the public’s interest
  • Deliver preventative medicine, medical diagnosis, medical research
  • Manage the health and social care system and services.

How do we use this information?

To ensure that you receive the best possible care, your records will be used to facilitate the care you receive. Information held about you may be used to protect the health of the public and to help us manage the NHS. Information may also be used for clinical audit to monitor the quality of the service provided. In addition, your information will be used to identify whether you are at risk of a future unplanned hospital admission and/or require support to effectively manage a long term condition.

How is the information collected?

Your information will be collected either electronically using secure NHS Mail or a secure electronic transferred over an NHS encrypted network connection. In addition physical information will be sent to your practice by specialist courier organised by NHS England. This information will be retained within your GP’s electronic patient record or within your physical medical records. 

Who will we share your information with?

In order to deliver and coordinate your health and social care, we may share information with the following organisations:

  • GP practices in Lowestoft in order to provide improved access appointment booking to our patients e.g. evening and week-end appointments at other local surgeries.
  • East Coast Community Healthcare CIC (ECCH) who provides various community services including district nursing, specialist palliative nursing, occupational therapy and physiotherapy.
  • James Paget University Hospital (JPUH)
  • Norfolk and Norwich University NHS Foundation Trust (NNUH)
  • Queen Elizabeth Hospital Kings Lynn (QEH KL)
  • Norfolk and Suffolk Foundation Trust (NSFT)
  • IC24 Ltd who provides the GP Out of Hours Service locally. From early 2020 the GP Out of Hours service will be able to view patient medical records (for patient safety and continuity purposes) and also be able to directly book appointments online with a GP, nurse practitioner or nurse at the surgery (up to 2 appointments per day).
  • East of England Ambulance Trust (EEAST)
  • Suffolk County Council (Adult Social Services and Community Care)
  • Voluntary Support Organisations commissioned to provide services by NHS Great Yarmouth & Waveney CCG (Clinical Commissioning Group) with the consent of the patient e.g. the Solutions social prescribing service which aims to help people with aspects of their lives that can detrimentally affect their physical and mental health e.g. housing and financial problems.

The legal basis for the above sharing is from the National Health Services Act 2006 – Part 1; the Health and Social Care Act 2012-Sections 1 to 8 and the Health and Social Care (Safety and Quality) Act 2015 S251B.

Disclosures which are required by law or clinical audit requirements

In order to comply with its legal obligations this practice may send data to NHS Digital when directed by the Secretary of State for Health under the Health and Social Care Act 2012. This practice contributes to national clinical audits and will send the data which are required by NHS Digital when the law allows. This may include demographic data, such as date of birth, and information about your health which is recorded in coded form, for example, the clinical code for diabetes or high blood pressure. If you do not wish your data to be sent to NHS Digital and/or from NHS Digital to other parties please ask Reception for an NHS Digital Opt Out form as we can code your electronic medical records accordingly.

Disclosures for medical research or health management purposes

This practice contributes to medical research and may send relevant information to medical research databases such as the Clinical Research Databank and QResearch or others- when the law allows.

All NHS organisations are expected to participate and support health and care research. Conducting high-quality clinical research helps us to keep improving NHS care by finding out which treatments work best.  If you are asked about taking part in research, usually someone in the care team looking after you will contact you. People in your care team may look at your health records to check whether you are suitable to take part in a research study, before asking you whether you are interested or sending you a letter on behalf of the researcher. For more information about how your information may be used in research and your rights please visit the HRA website. 

Who do we receive information from?

Whilst we might share your information with the above organisations, we may also receive information from them to ensure that your medical records are kept up to date and so that your GP can provide the appropriate care.

In addition we receive data from NHS Digital (as directed by the Department of Health) such as the uptake of flu vaccinations and disease prevalence in order to assist us to improve “out of hospital care”.

How do we maintain the confidentiality of your records?

We are committed to protecting your privacy and will only use information collected lawfully in accordance with:

  • Data Protection Act 1998(and the provisions of the new Data Protection Act 2018, effective from 25 May 2018)
  • Human Rights Act 1998
  • Common Law Duty of Confidentiality
  • Health and Social Care Act 2012
  • NHS Codes of Confidentiality, Information Security and Records Management
  • Information: To Share or Not to Share Review

Every member of staff who works for an NHS organisation has a legal obligation to keep information about you confidential.

We will only ever use or pass on information about you if others involved in your care have a genuine need for it. We will not disclose your information to any third party without your permission unless there are exceptional circumstances (i.e. life or death situations), where the law requires information to be passed on and / or in accordance with the new information sharing principle following Dame Fiona Caldicott’s information sharing review (Information to share or not to share) where “The duty to share information can be as important as the duty to protect patient confidentiality.” This means that health and social care professionals should have the confidence to share information in the best interests of their patients within the framework set out by the Caldicott principles. They should be supported by the policies of their employers, regulators and professional bodies.

Consent and Objections

Do I need to give my consent?

The GDPR sets a high standard for consent. Consent means offering people genuine choice and control over how their data is used. When consent is used properly, it helps you build trust and enhance your reputation. However consent is only one potential lawful basis for processing information. Therefore your GP practice may not need to seek your explicit consent for every instance of processing and sharing your information, on the condition that the processing is carried out in accordance with this notice. Your GP Practice will contact you if they are required to share your information for any other purpose which is not mentioned within this notice. Your consent will be documented within your electronic patient record.

What will happen if I withhold my consent or raise an objection?

You have the right to write to withdraw your consent at any time for any particular instance of processing, provided consent is the legal basis for the processing. Please contact the surgery for further information and to raise your objection.

Medicines Management Reviews

The Practice may conduct Medicines Management Reviews of medications prescribed to its patients. This service performs a review of prescribed medications to ensure patients receive the most appropriate, up to date and cost effective treatments.

Health Risk Screening / Risk Stratification

Health Risk Screening or Risk Stratification is a process that helps your GP to determine whether you are at risk of an unplanned admission or deterioration in health. By using selected information such as age, gender, NHS number, diagnosis, existing long term condition(s), medication history, patterns of hospital attendances, admissions and periods of access to community care your GP will be able to judge if you are likely to need more support and care from time to time, or if the right services are in place to support the local population’s needs.

A form of this risk screening by an NHS tool called “Eclipse” is used as a safety check looking at a patient’s conditions, current medications and test results. Eclipse draws data from the practice’s clinical database which is encrypted, analysed and an anonymised list sent back to the practice which only the practice can unencrypt to find the patients who are linked to alerts on Eclipse and then take The practice accesses the NHS Eclipse portal by password and a time lapsed code sent by NHS email to view anonymised patient alerts, the practice can tell the identity of the patients by unencrypting the patient code list sent earlier by Eclipse.

Another form of risk screening is an NHS England accredited closed secure information transfer from the practice’s clinical system of Diabetic patients over the age of 12 (who do not have an opt-out current in their medical notes) to Health Intelligence Ltd who are commissioned by NHS England to deliver the Diabetic Eye Screening Programme (NHS East Anglia Diabetic Eye Screening Programme www.eadesp.co.uk

To summarise Risk Stratification is used in the NHS to:

  • Help decide if a patient is at a greater risk of suffering from a particular condition
  • Prevent an emergency admission to hospital
  • Identify if a patient needs medical help to prevent a health condition from getting worse; and/or
  • Review and amend provision of current health and social care services

Your GP will use computer based algorithms or calculations to identify their registered patients who are at most risk, with support from the local Commissioning Support Unit (CSU) and/or a third party accredited Risk Stratification provider.

The risk stratification contracts are arranged by NHS Great Yarmouth & Waveney Clinical Commissioning Group (the CCG) in accordance with the current section 251 of the National Health Service Act 2006. Neither the CSU nor the CCG will at any time have access to your personal or confidential data. They will only act on behalf of your GP to organise the risk stratification service with appropriate contractual technical and security measures in place.

Your GP will routinely conduct the risk stratification process outside of your GP appointment. This process is conducted electronically and without human intervention.

The resulting report is then reviewed by a multidisciplinary team of staff within the Practice. This may result in contact being made with you if alterations to the provision of your care are identified.

A Section 251 Agreement is where the Secretary of State for Health and Social Care has granted permission for personal data to be used for the purposes of risk stratification, in acknowledgement that it would overburden the NHS to conduct manual reviews of all patient registers held by individual providers.

As mentioned above, you have the right to object to your information being used in this way. However you should be aware that your objection may have a negative impact on the timely and proactive provision of your direct care. Please contact the Practice Manager to discuss how disclosure of your personal data can be limited.

Sharing of Electronic Patient Records within the NHS

Electronic patient records are kept in most places where you receive healthcare. Our local electronic system (SystmOne from TPP) enables your record to be shared with organisations involved in your direct care, such as:

  • GP practices
  • Community services such as district nurses, rehabilitation services and out of hospital services.
  • Child health services that undertake routine treatment or health screening
  • Urgent care organisations, minor injury units or out of hours services
  • Community hospitals
  • Palliative care hospitals
  • Care Homes
  • Mental Health Trusts
  • Hospitals
  • Social Care organisations
  • Pharmacies

Your information will only be shared if it is appropriate for the provision of your care or required to satisfy our statutory function and legal obligations. Your information will not be transferred outside of the European Union.

In addition, NHS England have implemented the Summary Care Record which contains information about medication you are taking, allergies you suffer from and any bad reactions to medication that you have had in the past. You may consent to have an Enhanced Summary Care Record which contains more details about your health record such as any current medical problems.

Your electronic health record contains lots of information about you. In most cases, particularly for patients with complex conditions and care arrangements, the shared record plays a vital role in delivering the best care and a coordinated response, taking into account all aspects of a person’s physical and mental health. Many patients are understandably not able to provide a full account of their care, or may not be in a position to do so. The shared record means patients do not have to repeat their medical history at every care setting.

Your record will be automatically setup to be shared with the organisations listed above, however you have the right to ask your GP to disable this function or restrict access to specific elements of your record. This will mean that the information recorded by your GP will not be visible at any other care setting.

You can also reinstate your consent at any time by giving your permission to override your previous dissent. If you would like to check or change your Summary Care Record status, please write to the Practice Manager at: Andaman Surgery, 303 Long Road, Lowestoft, Suffolk, NR33 9DF

Child Health Immunisation History

The practice allows Apollo Medical Software Solutions Ltd* through agreement, to extract the following data from the practice clinical system for each registered patient under the age of six years of age and send this information (the data is encrypted whilst in transmission) to Provide Child Health Information Services who produce immunisation reminders for the parents/guardians of children:

NHS number, full name, date of birth, address, vaccination date, vaccination name, dose, batch number and site of vaccination; new-born infant physical examination results including examination date and outcome.

Sharing data in this way improves the quality and timeliness of data and reduces administration errors within Child Health Information Services when deciphering vaccination history returned to them in hard copy by the practice, and saves the practice time and prevents errors by not having to fill out hard copy data sheets to send to Child Health. (The Apollo software solution is needed because the practice’s clinical system and the Child Health information system do not talk to each other).

The legal basis for this data sharing is:

General Data Protection Regulation 2016 article 6 (d) processing is necessary in order to protect the vital interests of the data subject or of another natural person and Article 9 2 (i) (i) processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health or ensuring high standards of quality and safety of health care and of medicinal products or medical devices, on the basis of Union or Member State law which provides for suitable and specific measures to safeguard the rights and freedoms of the data subject, in particular professional secrecy.

  • Children’s Act 2004, Section 10 & 11 – Cooperation to improve well-being
  • National Health Service Act 1977, Section 22
  • Children’s Act 1989, part III: section 17 (1) (provision of service) and Section 27
  • Section 47 Children’s Act 1989
  • Health & Social Care Act 2012

Invoice Validation

If you have received treatment within the NHS, the local Commissioning Support Unit (CSU) may require access to your personal information to determine which Clinical Commissioning Group is responsible for payment for the treatment or procedures you have received. Information such as your name, address, date of treatment and associated treatment code may be passed onto the CSU to enable them to process the bill. These details are held in a secure environment and kept confidential. This information is only used to validate invoices in accordance with the current Section 251 Agreement, and will not be shared for any further commissioning purposes.

Cookies

Andaman Surgery website is supported by “cookies” which are intended to improve the user experience of visiting and re-visiting the site. The surgery website is produced and hosted by Wiggly-Amps who provide a comprehensive summary of the cookies utilised at this location: http://www.andamansurgery.nhs.uk/index.php?disclaimer=1

Your Right of Access to Your Records

The Data Protection Act 1998 and General Data Protection Regulations allows you to find out what information is held about you including information held within your medical records, either in electronic or physical format. This is known as the “right of subject access”. If you would like to have access to all or part of your records, you can make a request in writing to the organisation that you believe holds your information. This can be your GP, or a provider that is or has delivered your treatment and care. You should however be aware that some details within your health records may be exempt from disclosure, however this will in the interests of your wellbeing or to protect the identity of a third party.

If you would like access to your GP record electronically (some parts of your medical record is available for on line viewing) please ask Reception for the relevant form, you will also be asked to show Reception a form of photographic ID before your request may be considered. If you would like to come into the practice to view your medical record (paper notes, electronic or both) or have a printed copy of your medical record, please submit your request in writing to: The Medical Secretary, Andaman Surgery, 303 Long Road, Lowestoft, Suffolk, NR33 9DF.

Change of Details

It is important that you tell the practice if any of your details such as your name or address have changed or if any of your details such as date of birth is incorrect in order for this to be amended. You have a responsibility to inform us of any changes so our records are accurate and up to date for you.

Complaints

In the event that your feel your GP Practice has not complied with the current data protection legislation, either in responding to your request or in our general processing of your personal information, you should raise your concerns in the first instance in writing to the practice manager at:

Andaman Surgery
303 Long Road
Lowestoft
Suffolk
NR33 9DF

If you remain dissatisfied with our response you can contact the Information Commissioner’s Office at:

Wycliffe House
Water Lane
Wimslow
Cheshire
SK9 5AF

Enquiry Line: 01625 545700

Website: www.ico.gov.uk

Your information and responding to coronavirus (COVID-19)

The health and social care system is facing significant pressures due to the coronavirus outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak. In the current emergency, it has become even more important to share health and care information across relevant organisations.

This notice describes how GPs and other health and social care organisations may use your information within the health and social care system to protect you and others during the Coranavirus (COVID-19) outbreak with regard to your Summary Care Record.

Summary Care Records

All patients registered with a GP have a Summary Care Record, unless they have chosen not to have one. The information held in your Summary Care Record gives registered and regulated healthcare professionals, away from your usual GP practice, access to information to provide you with safer care, reduce the risk of prescribing errors and improve your patient experience.

Your Summary Care Record contains basic (Core) information about allergies and medications and any reactions that you have had to medication in the past.

Some patients, including many with long term health conditions, previously have agreed to have additional information shared as part of their Summary Care Record. This Additional Information includes information about significant medical history (past and present), reasons for medications, care plan information and immunisations.

Change to information held in your Summary Care Record

In light of the current emergency, the Department of Health and Social Care has removed the requirement for a patient’s prior explicit consent to share Additional Information as part of the Summary Care Record.

This is because the Secretary of State for Health and Social Care has issued a legal notice to healthcare bodies, requiring them to share confidential patient information with other healthcare bodies where this is required to diagnose, control and prevent the spread of the virus and manage the pandemic. This includes sharing Additional Information through Summary Care Records, unless a patient objects to this.

If you have already expressed a preference to only have core information shared in your Summary Care Record, or to opt-out completely of having a Summary Care Record, these preferences will continue to be respected and this change will not apply to you. For everyone else, the Summary Care Record will be updated to include the Additional Information. This change of requirement will be reviewed after the current coronavirus (COVID-19) pandemic.

Why we have made this change

In order to look after your health and care needs, health and social care bodies may share your confidential patient information contained in your Summary Care Record with clinical and non-clinical staff in other health and care organisations, for example hospitals, NHS 111 and out of hours organisations. These changes will improve the healthcare that you receive away from your usual GP practice.

Your rights in relation to your Summary Care Record

Regardless of your past decisions about your Summary Care Record preferences, you will still have the same options that you currently have in place to opt out of having a Summary Care Record, including the opportunity to opt-back in to having a Summary Care Record or opt back in to allow sharing of Additional Information.

You can exercise these rights by doing the following:

  • Choose to have a Summary Care Record with all information shared. This means that any authorised, registered and regulated health and care professionals will be able to see a detailed Summary Care Record, including Core and Additional Information, if they need to provide you with direct care.
  • Choose to have a Summary Care Record with Core information only. This means that any authorised, registered and regulated health and care professionals will be able to see limited information about allergies and medications in your Summary Care Record if they need to provide you with direct care.
  • Choose to opt-out of having a Summary Care Record altogether. This means that you do not want any information shared with other authorised, registered and regulated health and care professionals involved in your direct care. You will not be able to change this preference at the time if you require direct care away from your GP practice. This means that no authorised, registered and regulated health and care professionals will be able to see information held in your GP records if they need to provide you with direct care, including in an emergency.

To make these changes, you should inform your GP practice or complete this form and return it to your GP practice.

More information

For more information about these changes see the following resources:

This privacy notice supplements your GP practice’s main privacy notice.

Changes to this privacy notice

This notice may be amended at any time, so please review it frequently. The date at the top of this page will be amended each time this notice is updated.

This practice is supporting vital coronavirus (COVID-19) planning and research by sharing your data with NHS Digital. This transparency notice supplements our main practice privacy notice.

The health and social care system is facing significant pressures due to the coronavirus (COVID-19) outbreak. Health and care information is essential to deliver care to individuals, to support health, social care and other public services and to protect public health.

Information will also be vital in researching, monitoring, tracking and managing the coronavirus outbreak. In the current emergency it has become even more important to share health and care information across relevant organisations. This practice is supporting vital coronavirus planning and research by sharing your data with NHS Digital, the national safe haven for health and social care data in England.

Our legal basis for sharing data with NHS Digital

NHS Digital has been legally directed to collect and analyse patient data from all GP practices in England to support the coronavirus response for the duration of the outbreak. NHS Digital will become the controller under the General Data Protection Regulation 2016 (GDPR) of the personal data collected and analysed jointly with the Secretary of State for Health and Social Care, who has directed NHS Digital to collect and analyse this data under the COVID-19 Public Health Directions 2020 (COVID-19 Direction).

All GP practices in England are legally required to share data with NHS Digital for this purpose under the Health and Social Care Act 2012 (2012 Act). More information about this requirement is contained in the data provision notice issued by NHS Digital to GP practices.

Under GDPR our legal basis for sharing this personal data with NHS Digital is Article 6(1)(c) – legal obligation. Our legal basis for sharing personal data relating to health, is Article 9(2)(g) – substantial public interest, for the purposes of NHS Digital exercising its statutory functions under the COVID-19 Direction.

The type of personal data we are sharing with NHS Digital

The data being shared with NHS Digital will include information about patients who are currently registered with a GP practice or who have a date of death on or after 1 November 2019 whose record contains coded information relevant to coronavirus planning and research. The data contains NHS Number, postcode, address, surname, forename, sex, ethnicity, date of birth and date of death for those patients. It will also include coded health data which is held in your GP record such as details of:

  • Diagnoses and findings
  • Medications and other prescribed items
  • Investigations, tests and results
  • Treatments and outcomes
  • Vaccinations and immunisations

We will not share details for any patient who has registered a Type 1 objection with the practice.  Where a Type 1 objection has been registered, we will not share your personal identifiable confidential information outside of the GP practice, except when it is being used for the purposes of your care and treatment or where there is a legal requirement to do so.

Although there is a legal requirement to do so here, NHS Digital has agreed with the National Data Guardian, the British Medical Association and the Royal College of General Practitioners to respect Type 1 objections.

How NHS Digital will use and share your data

NHS Digital will analyse the data they collect and securely and lawfully share data with other appropriate organisations, including health and care organisations, bodies engaged in disease surveillance and research organisations for coronavirus response purposes only.

These purposes include protecting public health, planning and providing health, social care and public services, identifying coronavirus trends and risks to public health, monitoring and managing the outbreak and carrying out of vital coronavirus research and clinical trials.

The British Medical Association, the Royal College of General Practitioners and the National Data Guardian are all supportive of this initiative.

NHS Digital has various legal powers to share data for purposes relating to the coronavirus response.

It is also required to share data in certain circumstances set out in the COVID-19 Direction and to share confidential patient information to support the response under a legal notice issued to it by the Secretary of State under the Health Service (Control of Patient Information) Regulations 2002 (COPI Regulations).

Legal notices under the COPI Regulations have also been issued to other health and social care organisations requiring those organisations to process and share confidential patient information to respond to the coronavirus outbreak.

Any information used or shared during the outbreak under these legal notices or the COPI Regulations will be limited to the period of the outbreak unless there is another legal basis for organisations to continue to use the information.

Data which is shared by NHS Digital will be subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of data necessary to achieve the coronavirus purpose will be shared.

Organisations using your data will also need to have a clear legal basis to do so and will enter into a data sharing agreement with NHS Digital. Information about the data that NHS Digital shares, including who with and for what purpose will be published in the NHS Digital data release register.

For more information about how NHS Digital will use your data please see the NHS Digital Transparency Notice for GP Data for Pandemic Planning and Research (COVID-19).

National Data Opt-Out

The application of the National Data Opt-Out to information shared by NHS Digital will be considered on a case by case basis and may or may not apply depending on the specific purposes for which the data is to be used. This is because during this period of emergency, the National Data Opt-Out will not generally apply where data is used to support the coronavirus outbreak, due to the public interest and legal requirements to share information.

Your rights over your personal data

To read more about the health and care information NHS Digital collects, its legal basis for collecting this information and what choices and rights you have in relation to the processing by NHS Digital of your personal data, see: