Skip to main content

PANORAMIC: Terms of release

This page describes NHS Digital's legal basis for sharing patient data with GP practices as part of the PANORAMIC Trial.


NHS Digital has been requested by NHS England and Improvement (the Requestor) to share certain confidential patient information with General Practices and their associated GP hubs (GPs) regarding patients who may be eligible to join the PANORAMIC Clinical Trial. This is explained in more detail below in 'Agreed purposes'.

The information to be shared is identified in this letter below as the Disclosed Data.

COVID-19 Therapeutics Programme

The National Institute for Health Research (NIHR) has awarded funding to the University of Oxford - working with several UK universities - to carry out a first-of-its-kind clinical trial, testing novel antiviral coronavirus (COVID-19) treatments for use early in the illness, by people in the community with COVID-19 who are at higher risk of complications.

The PANORAMIC Trial is a national priority trial. They are recruiting volunteers, whether they have been vaccinated or not. It is open to everyone with ongoing symptoms of COVID-19 and a positive polymerase chain reaction (PCR) test or Lateral Flow Test (LFT).

NHS England and the Department of Health and Social Care have commissioned NHS Digital to provide a solution to find people who would be eligible for the trial. A secure web viewer will be available to a person’s GP practice and GP Hubs (GPs) for this. It will run as a new service to enable GPs to access lists of their registered patients, who are eligible for trial participation based on the defined inclusion criteria. The GP will make contact with the patient with the intention of the GP recruiting them for the trial. 

GPs (the Recipients) are Controllers (as defined in UK GDPR) for the above purposes.

Confidential nature of the information requested

NHS Digital is the Controller for the data which is to be shared with the Recipients.

The data is identifiable patient information and is comprised of information that has been obtained by the NHS and NHS Digital, in confidence. It also provides information about the health of the patients. The data is, therefore, confidential information and subject to a duty of confidence under the common law (Duty of Confidence).

Agreed Purposes for sharing the requested data

The purposes for sharing the requested data are set out below.

NHS Digital has agreed to share the data below (the Disclosed Data) about patients’ with their GP:

  • NHS number
  • name
  • date of birth
  • postcode
  • date and time of positive polymerase chain reaction (PCR) test or lateral flow test (LFT)
  • contact information, mobile number and email address, provided by the patient or their representative/guardian at the point of booking their PCR test or registering their LFT
  • contact information mobile number and email address from the patients’ medical record
  • the clinical condition group

The Recipients will only receive the Disclosed Data for their patients registered with the GP.

Recipients will use the Disclosed Data for the purpose of contacting patients to discuss participation in the Panoramic Trial.  Recipients have been provided with consent materials by the Panoramic Trial and will only forward information about the patient when the patient has given consent.

The Recipients will access the Disclosed Data via a secure web viewer on the NHS Digital Population Health Platform – GP Web Viewer (NHS Digital Web Viewer).

Terms of release

  1. Each Recipient will ensure that it complies with the GDPR, the DPA, all applicable law concerning privacy or the processing of personal data and the Duty of Confidence when processing the Disclosed Data.
  2. Recipients may process the Disclosed Data for the Agreed Purposes only.
  3. NHS Digital will share the Disclosed Data securely with the Recipients daily via the NHS Digital Web Viewer.
  4. The Recipients are only permitted to store and process the Disclosed Data securely within the UK and the EEA or any country outside the EEA where there is a compliant legal transfer under the UK GDPR.
  5. The Recipients will on completion of the processing activity for purpose of contacting patients to discuss participation in the Panoramic Trial in accordance with the Agreed Purposes securely destroy the Disclosed Data (including any copies it was necessary for it take for the Agreed Purposes) and on the request of NHS Digital shall provide a data destruction certificate signed by the Recipient’s and Processor’s Data Protection Officers.
  6. The Recipients may only process the Disclosed Data for as long as is necessary to identify their patients to contact for clinical assessment in accordance with the Agreed Purpose. Recipients may process the Disclosed Data about their patients on the NHS Digital Web Viewer for as long as it is necessary to do so for the purposes of the individual care and treatment of those patients.
  7. Each Recipient will notify NHS Digital as soon as reasonably practicable after it becomes aware of any Personal Data Breach (as defined in GDPR) by the Recipient concerning the Disclosed Data.
  8. The Disclosed Data is confidential patient information and is provided by NHS Digital in confidence to the Recipients. The Disclosed Data must be maintained by the Recipients and their Processors as confidential in accordance with the Duty of Confidence. In particular, the Recipients must comply with their legal responsibilities under COPI when processing the Disclosed Data, including the restrictions laid down in Regulation 7 of COPI. This requires the Recipients when processing the Disclosed Data under COPI:
    1. not to process the Disclosed Data more than is necessary to achieve the purposes for which the Recipients are permitted to process that information under Regulation 3(1) of COPI and the Agreed Purposes;
    2. so far as it is practical to do so, to remove from the Disclosed Data any particulars which identify the person to whom it relates which are not required for the purposes for which it is, or is to be, processed;
    3. not allow any person access to that information other than a person who, by virtue of their contract of employment or otherwise, is involved in processing the information for one or more of those purposes and is aware of the purpose or purposes for which the information may be processed;
    4. not allow any person to process the Disclosed Data unless that person is a health professional or a person who in the circumstances owes a duty of confidentiality which is equivalent to that which would arise if that person were a health professional; and
    5. to ensure that appropriate technical and organisational measures are taken to prevent unauthorised processing of the Disclosed Data.
  9. The Recipients must ensure that their Privacy Notices are updated as required to reflect that they are processing the Disclosed Data for the Agreed Purposes.
  10. NHS Digital (and any auditors of or other advisers to NHS Digital) will be entitled to audit the Recipients’ compliance with these terms of release and the Recipients will provide all co-operation and assistance to NHS Digital in relation to any such audit, including providing access to personnel, premises and where necessary, equipment. NHS Digital will provide reasonable notice of its intention to carry out an audit and shall comply with all visitor rules and regulations applicable when attending at the Recipients’ premises for this purpose.
  11. If a Recipient materially or persistently breach the terms of release, NHS Digital shall be entitled to terminate the data sharing arrangement by providing written notice to the Recipient, which will include the date of termination, which will be considered the End Date above.
  12. Any dispute in respect of these terms or their subject matter will be escalated to appropriately senior officers of the Recipient and NHS Digital for resolution.
  13. The contact details for the parties respective Data Protection Officers are:

Last edited: 14 April 2022 11:51 am