National Digital Channels User Insights privacy notice
This privacy notice explains how NHS England uses information about people who use national NHS digital services, such as the NHS App and NHS login, to understand how those services are used and how they can be improved.
We use this information to help reduce health inequalities, improve health outcomes, and design digital services that better meet people’s needs.
This notice explains:
- who is responsible for your information
- how we use your information
- what information we use
- where the information comes from
- our legal basis for using your information
- where we store your information
- who we share information with
- how long we keep your information
- whether we use automated decision making or profiling
- your data protection rights
- how to contact us or make a complaint
About National Digital Channels User Insights
National Digital Channels are national NHS digital services. These include:
- NHS App
- NHS login
- NHS Website (NHS.uk)
- NHS Notify
- National Proxy Service
- NHS Wayfinder
Other digital services also work with National Digital Channels, including:
- Messaging
- Vaccinations
- Screening
- Digital Health Checks
- 111 Online
- Digital Urgent and Emergency Care
At the moment, National Digital Channels User Insights brings together information from the NHS App and NHS login into one secure place. This helps NHS England understand how digital services are being used and how well they are working.
Who is responsible for your information
A data controller is an organisation that decides how and why personal information is used.
NHS England is the data controller for personal information used by the National Digital Channels Data and Insight team under:
- NHS App Directions 2023, for NHS App data
- NHS login Directions 2021, for NHS login data
The Department of Health and Social Care is also a joint data controller for NHS App data because it issued the NHS App Directions to NHS England. You can exercise your data protection rights with either NHS England or the Department of Health and Social Care. Contact details are provided at the end of this notice.
How we use your information
We use your information to understand how people access and use NHS digital services, where services are working well, and where improvements may be needed.
Understanding how digital services are used
Look at how people access and use NHS digital services.
Produce reports, dashboards and other information to help NHS England teams understand how services are performing.
Reducing health inequalities
Understand whether different groups of people access and use digital services in different ways.
Identify where changes may be needed to make services easier and fairer to use.
Improving services and health outcomes
Understand what different groups of users need from NHS digital services.
Help improve digital products and services so they better support people’s health and care.
Improving how NHS England manages digital services
Bring information together into one reporting source.
Reduce duplication in reporting and analysis.
Help NHS England prioritise requests for data and insight.
Supporting NHS England teams
Give NHS England teams reliable information to support planning and decision making.
Support improvements that focus on outcomes for patients and people who use NHS services.
What information we use
To produce insights about digital products and services, NHS England uses personal information and some information that may be health information. Health information is given extra protection under data protection law.
The table below explains the types of information we use, where it comes from and why we use it.
| Where the data comes from | Type of information | What this information includes | Whether this is personal or sensitive information | Why we use this information |
|---|---|---|---|---|
| NHS App | Personal and transactional* | Information about actions taken by users in the NHS App, together with related details about those actions |
Personal Data: NHS login ID Device information GP ODS Carer/proxy |
Information about what people do in the NHS App helps us understand how the app is used and which features are most useful. Personal information helps us link information safely with other data sets so we can understand whether there are differences in how people use services, whether outcomes can be improved, and how services should be designed. |
| NHS login | Personal and transactional* | Records of login activity to the NHS App and any associated contextual data |
Personal data: NHS Number NHS login ID Age |
Information about login activity helps us understand how people engage with the NHS App. Personal information helps us link information safely with other data sets so we can understand whether there are differences in how people use services, whether outcomes can be improved, and how services should be designed. |
* Transactional information means information about what a person does when using a digital service, such as signing in, opening a message or using a feature.
How we keep your information secure
We process this information in the secure NHS Federated Data Platform. The information is stored in the UK only.
Where we use information that could identify someone, we pseudonymise it. This means we replace details that directly identify a person with a code or other reference. The information needed to link that code back to a person is kept separately and protected.
NHS England's legal basis for using your information
NHS England is a public body. We can use personal information where the law allows us to do so and where it is necessary for us to carry out our legal responsibilities.
The Department of Health and Social Care has given NHS England formal legal instructions, called Directions, to set up and run:
- the NHS App, under the NHS App Directions 2023
- NHS login, under the NHS login Directions 2021
National Digital Channels User Insights uses information from these services to understand how they are used and how they can be improved.
When we use personal information, we must follow data protection law. This means we must use your information fairly, lawfully and openly. We must only use the information we need, keep it accurate, keep it only for as long as necessary, and protect it securely.
Our lawful basis under UK GDPR Article 6
For personal information, NHS England relies on Article 6(1)(c) of the UK GDPR. This means we use the information because it is necessary for us to meet a legal obligation.
This legal obligation comes from the Directions that require NHS England to set up and run these digital services.
Our condition for using health information under UK GDPR Article 9
Some of the information we use may be health information. Health information has extra protection under data protection law, so we must also meet an additional condition under Article 9 of the UK GDPR.
Where we use health information, we rely on Article 9(2)(h). This means the use is necessary for managing health and care systems and services.
We also rely on the Data Protection Act 2018, Schedule 1, Part 1, paragraph 2(2)(f), which covers the management of health care systems or services.
This applies because the analysis helps NHS England understand and improve digital services that support health and care.
Where we get your information from
We get information from NHS England digital services, including:
- NHS App
- NHS login
Where we store your information
We store and process this information in the NHS Federated Data Platform. The information is stored in the UK only.
How long we keep your information
We keep information only for as long as we need it. Information used for National Digital Channels User Insights will be kept for 8 years.
Automated decision making and profiling
We do not use this information to make automated decisions about you. We also do not use it for profiling.
Children's information and proxy access
The NHS App is available to people aged 13 and over. If someone has proxy access to manage another person’s care, information about that use may also be included in National Digital Channels User Insights where this is needed for the purposes described in this notice.
Your data protection rights
Be told how and why your personal information is being used.
Ask for a copy of your personal information.
Ask us to correct information that is wrong or incomplete.
Ask us to restrict how we use your personal information in some circumstances.
Ask us to delete your personal information in some circumstances.
How to contact us
You can contact our Data Protection Office at NHS England to exercise any of the above rights by emailing [email protected] or writing to:
Jon Moore
Data Protection Officer
NHS England
7 and 8 Wellington Place
Leeds
West Yorkshire LS1 4AP
You can also contact the Data Protection Officer if you wish to submit a complaint about any aspect of NHS England’s processing of your personal data.
Last edited: 30 September 2026 2:46 pm