Skip to main content
Patient survey privacy statement - NHS e-Referral Service

This privacy statement is for patients taking part in research for the NHS e-Referral Service.


This privacy statement relates to services provided by NHS Digital.

This is a privacy statement for the NHS e-Referral Service user survey for use by patients and patient representatives that have used the Manage Your Referral website for booking, cancelling or rearranging their health and social care appointments.

This privacy statement is also for patients and patient representatives that choose to take part in the NHS e-Referral Service patient-user research panel. As a research panel member, you will have the opportunity to take part in online surveys, one-to-one interviews, web usability tests and discussion groups. We may follow up with you to ask about how your referral experience was including attending your appointment.

The NHS e-Referral service user research team understands your needs as an individual to ensure that your data is being used and held in a responsible way and we aim to reassure you that every reasonable step is being taken to secure your personal information.

Please ensure that you read this statement carefully and contact the NHS e-Referral Service programme team at if you have any questions or concerns relating to this privacy statement.

This privacy statement explains the following:

  • who we are
  • what information we collect
  • how we use your information
  • what legal basis we have for processing your personal data
  • when we share your personal data
  • where we store and process personal data
  • how we secure personal data
  • how long we keep personal data for
  • your rights in relation to personal data
  • how to contact us

Who we are

The NHS e-Referral Service is a programme service of NHS Digital. NHS Digital is the controller for the NHS e-Referral Service.

The Data Protection Officer for NHS Digital can be contacted at

The information we collect

When you complete the Manage Your Referral patient survey, we collect:

  • the address of the website you visited from,
  • your "Booking Reference Number" (if present)
  • the type of device you have used
  • operating system
  • web browser type and version
  • IP/Address
  • screen resolution
  • flash version

As part of the survey, we may also ask you questions about:

  • your age
  • your gender
  • the area of the country you live in
  • disabilities or long-term impairments
  • assistive equipment you use with your device

If you choose to participate in our patient user research panel, we will collect further information, including:

  • your name
  • your email address
  • a contact telephone number

How we use your information

We use your information so that the NHS e-Referral Service can be improved.

We use the data we collect to:

  • inform developments to our products
  • understand how different groups of patient experience being referred
  • gain knowledge of how referrals are managed by NHS organisation types in different locations (for example, hospitals, GP surgeries, Clinical Commissioning Groups)
  • help improve the user experience of the services we provide

When we share your personal data

For members of the patient-user research panel, we may request to share your details with other research teams within NHS Digital, if we feel that you would be a suitable candidate for their user research. Details would only be shared with authorised members of the NHS Digital research team, but only with your permission.

We will not:

  • share your information with any other organisations for marketing, research or commercial purposes - we will not pass on your information to any organisation outside of NHS Digital
  • identify you personally in any findings or reports

The results of the surveys may be published by NHS Digital in partnership with NHS England and Improvement to support NHS services to improve how referrals are managed. Published results will remain anonymous - nobody will be able to identify you in any results.

Where we store and process personal data

We store your data on servers in the UK. Currently there are no plans for this to change.

How we secure personal data

We take the security of your personal information seriously. We have set up security measures, policies, and procedures, such as:

  • all our survey data is stored securely in line with the General Data Protection Regulations
  • only allowing access to survey data to specific NHS Digital staff
  • compulsory information governance training completed every year for all NHS Digital staff members and contractors.

While in transit, the information you share with us by completing a survey is done so using a secure, encrypted HTTPS connection. We have procedures in place to keep your information secure once we have it. 

However, no software or application can be completely secure, and we are unable to guarantee the security of your information while it is in transit. If you have any concerns that your information could have been compromised, please contact

How long we keep personal data for

We store personal data from our surveys for a maximum of three years, after this time it will be deleted.

If you wish to have your data omitted, restricted, erased, rectified or if you wish to have a copy of your responses from the results of this survey contact

Your rights in relation to personal data

We respect your rights to access and control the personal data that we hold about you, as required by Data Protection Legislation.

This includes the right to:

  • be informed
  • get access to it
  • rectify or change it
  • restrict or stop processing it

You can exercise these rights at any time by emailing the NHS e-Referral Service programme team on Any requests for information will be acknowledged within one working day.

If you no longer want to take part in the patient-user panel, you can withdraw your information by contacting us on You do not have to provide a reason to withdraw.

If you wish to make a complaint about how we have managed your data, contact details for the Regulator are provided below:

Information Commissioner’s Office

Wycliffe House

Water Lane



Their website address is

How to contact us

If you have any questions or concerns about this privacy statement or the way in which we process your data, please contact us on

To know how your data will be collected, processed, and stored, and for what purposes, you can contact our Data Protection Office:

By email on

By post at:

Information Governance Compliance Team
NHS Digital
7 and 8 Wellington Place
West Yorkshire

We ask that you try to resolve any issues with us first, although you have a right to lodge a complaint with the Information Commissioner's Office (ICO) at any time about our processing of your personal information.

The ICO is the UK regulator for data protection and upholds information rights.

Contact the ICO

Last edited: 8 April 2021 3:58 pm