Coronavirus (COVID-19) treatments - transparency notice
From 16 December 2021 to 26 June 2023, we processed users' personal data in order to provide the digital cohort of those individuals at higher clinical risk from coronavirus (COVID-19). This notice outlines what data was collected, how it was processed, and what we do with it now that the service has closed.
Our purposes
NHS England processed your data to to provide a COVID-19 Treatments Service. This was set up to provide treatment for people who have tested positive for coronavirus (COVID-19). The COVID-19 treatment services that ran from 16 December 2021 to 26 June 2023 were set up under interim arrangements as a response to the pandemic, using a common care pathway that applied nationally. These services were supported by funding from the Department of Health and Social Care.
Now that the National Institute for Health and Care Excellence (NICE) has given its final recommendations on some of the COVID-19 treatments that should be offered by the NHS, these treatments are funded and arranged as part of routine NHS services. There are different potential treatments, including an antibody treatment, known as Neutralizing Monoclonal Antibodies (nMAbs) which is given by an intravenous injection or an anti-viral treatment which is a tablet, these aim to relieve symptoms of COVID-19 quicker and can stop people from getting seriously ill.
The Chief Medical Officer for England (CMO), along with senior clinicians at NHS England, set out the clinical conditions (clinical criteria) to identify people who are more at risk at getting seriously ill with COVID-19 and who would be suitable for treatment.
NHS Digital provided information about potentially eligible people to treatment providers so that people could be contacted and clinically assessed for the service if they tested positive for COVID-19:
- people with a positive polymerase chain reaction (PCR) test or a positive rapid lateral flow test (LFT) within the previous 3 calendar days
- people who are 12 years minus 2 days or older
- people will have one or more qualifying conditions
Further information about the clinical criteria.
To deliver this service, NHS Digital provided NHS providers with contact information of people who were potentially suitable for treatment.
This information was used in the following ways:
- NHS England wrote to all people who met the clinical criteria to inform them that they may be suitable for Treatment and provide them with a pre-registered PCR or lateral flow test kit (LFT)
- Integrated Care System COVID-19 medication delivery units (ICS CMDUs), commissioned by your local Clinical Commissioning Group (CCG), contacted patients who met the clinical criteria to arrange a clinical assessment if they tested positive, to determine if they are suitable for treatment
- where a person provided their (or their representatives) mobile or email contact information when booking their COVID-19 test and they test positive, they were contacted by text/email to inform them they may be suitable for treatment
- where is a person is in prison, youth offending institution or immigration centre, the centre will use the information to refer the person to the CMDU for assessment
This notice should be read alongside our Coronavirus (COVID-19) response transparency notice.
COVID-19 public inquiry
In March 2022 the government announced that there will be a COVID-19 public inquiry. The COVID-19 Inquiry Terms of Reference includes COVID-19 treatments within its scope. This places a legal obligation on NHS England not to delete or amend records for the duration of the inquiry.
Your personal data will be held in identifiable form in archive for as long as it is considered necessary to meet the needs of the public inquiry. For example, NHS England may need to access your personal data to respond to queries from the public inquiry.
The controller of your personal data
Under the UK General Data Protection Regulation 2016 (GDPR), NHS Digital is the controller of your personal data where we are directed or requested to process personal data for COVID-19 purposes.
We are also a joint controller with the person who has directed or requested us to do this work. In this case this is NHS England who are directing NHS Digital to carry out processing for COVID-19 purposes.
Where we share data, NHS Digital is the sole controller for the sharing of your personal data.
How we obtained your personal data
Identifying patients for inclusion into the COVID-19 Medications Service was carried out by using data we already hold as the national safe haven for health and care data in England.
We are also collected information from ICS CMDUs about the outcomes from their assessment; including whether the patient was contacted successfully and the outcomes of the assessment, including:
- whether the patient declined treatment
- whether the patient was suitable for treatment
- if suitable, which treatment was identified as being most appropriate
We are also collected information from NHS England, about the treatment which was provided to patients, this included the patient’s NHS Number and the medication code for the treatment delivered.
Types of personal data we processed
Data used to identify whether you would be suitable for the treatment, and outcomes from the treatment, includes:
- NHS number
- name
- sex
- address
- postcode
- date and time of positive polymerase chain reaction (PCR) test or positive rapid lateral flow test (LFT)
- registered GP practice
- date of birth
- contact information provided by the patient or their representative/guardian at the point of booking their PCR or registering their LFT test
- health related data (in the form of condition codes held in central NHS records), where the data matches the clinical conditions and ruleset established by the CMO
- treatment planned the CMDU at the point of triage and treatment delivered by the CMDU
Legal basis of this data collection
The health and social care system is taking action to manage and mitigate the spread and impact of coronavirus (COVID-19).
Action to be taken requires the collection, analysis and sharing of information, including confidential patient information where necessary and lawful, amongst health organisations and other appropriate bodies. This is due to the urgent need to protect public health and respond to the COVID-19 outbreak.
To support the healthcare response to COVID-19, NHS Digital has been directed by NHS England under the COVID-19 Directions to:
- establish information systems to collect and analyse data in connection with COVID-19; and
- develop and operate IT systems to deliver services in connection with COVID-19
Where we are directed to process personal data for COVID-19 purposes, this is a legal obligation and we are allowed to do this under Article 6 (1)(c) of UK GPDR.
NHS England is directing NHS Digital to process personal data as part of their statutory functions this is part of their public task and are allowed to do this under Article 6(1)(e) of UK GDPR.
Where we need to process health data and other special categories of personal data, we will only do this where it is necessary as part of our statutory functions. Under UK GPDR we are allowed to do this where it is necessary for substantial public interest reasons (Article 9(2)(g)), where it is necessary for healthcare purposes (Article 9(2)(h)).
We are also allowed to share your personal data under GDPR where it is necessary for us to do so for one of the purposes explained above.
More information can be found in the Who we shared your personal data with section.
How long we keep your personal data for
We will retain your personal data for as long as is necessary for the purpose outlined above in accordance with the Records Management Code of Practice 2021 and NHS Digital’s Records Management Policy.
Other organisations with whom we share your personal data have obligations to keep it for no longer than is necessary for the purposes for which we have shared your personal data. Information about this will be provided in their transparency or privacy notices which are published on their websites.
Where we store the data
NHS Digital only stores and processes your personal data for this service within the United Kingdom.
Fully anonymous data, for example statistical data (which does not allow you to be identified), may be stored and processed outside of the UK.
Your rights over your personal data
To read more about the health and care information NHS Digital collects, our legal basis for collecting this information and what choices and rights you have, see how we look after your health and care information, our general transparency notice and our Coronavirus (COVID-19) response transparency notice.
You can read more about how NHS England processes your data for COVID-19 purposes here NHS England and NHS Improvement transparency notice.
We may make changes to this transparency notice. If we do, the ‘last updated’ date at the top of the notice will also change. Any changes to this notice will apply immediately from the date of any change.
Last edited: 28 June 2023 9:03 am