Electronic Prescription Service in Isle of Man: Transparency notice

This transparency notice explains for the Electronic Prescription Service in Isle of Man:

• why we collect information about you (we call this 'personal data')
• what we do with it, including who we share it with (we call this 'processing')
• how long we keep it for and where we store it
• our legal basis for using it
• what your data protection rights are

Read more about how NHS England processes personal data to improve health and care.

For more information on how we process personal data to provide the Electronic Prescription Service to NHS organisations and services in England and Wales, see the Electronic Prescription Service in England and the Electronic Prescription Service for Wales Transparency Notices. 

The Electronic Prescription Service (EPS) securely transmits prescription information between prescribing systems (such as GP systems) and dispensing systems (such as pharmacy systems) in the Isle of Man.

EPS makes the prescribing and dispensing process more efficient and convenient for patients and staff. It allows prescribers to send prescriptions electronically to a dispenser of the patient’s choice (a nominated pharmacy).

EPS is used across primary care (such as GP practices and pharmacies) and urgent care settings (such as walk-in centres and minor injury units).

Read more information about electronic prescriptions on the NHS.UK website.

Under data protection law, NHS England is a ‘joint controller’ with the Isle of Man Department of Health and Social Care in providing the EPS to NHS organisations and services in the Isle of Man. This means that we jointly make decisions about what personal data we need to collect and how we will process your data to provide the EPS to the Isle of Man.

When a prescription is issued, the prescribing system sends the following information to the NHS Spine.

This includes:

• the patient’s demographic data (such as NHS number, name, date of birth, address)
• the patient’s nominated pharmacy
• the GP practice the patient is registered at
• the medication or appliance prescribed
• instructions given to the patient and dispenser by the prescriber
• details of the prescriber issuing the prescription
• the system and user generating the prescription
• the advanced electronic signature attached to the prescription

The pharmacy who prepares the medicine / appliance order, downloads the electronic prescription data from the NHS Spine, which includes the patient’s NHS number, name, date of birth, address and details of the medication / appliance that has been prescribed. Pharmacy staff have a professional and legal duty to keep patient information confidential.

When a prescription is downloaded by the pharmacy, the dispensing system sends the following information to the NHS Spine.

This includes:

• the organisation code of the pharmacy dispensing the prescription
• the patient’s NHS number
• a prescription ID and prescription item ID
• prescription item status updates (such as ready to collect or collected)
• the time of the action that triggered the status update

In order to connect to NHS Spine, users of prescribing and dispensing systems need the appropriate NHS smartcard permissions.

Authorised staff at prescribing and dispensing sites, can also check the status and location of a prescription using the EPS Prescription Tracker.

When you are prescribed a medication or appliance, the prescribing system (for example, a GP practice or urgent care setting) sends your information to the NHS Spine. Subsequently, when the pharmacy downloads your prescription to dispense, it will send information about your prescription and its status back to the NHS Spine.

EPS processes your data to:

• securely transmit your prescription data between prescribing and dispensing systems so that you can be issued with your prescription
• enable authorised staff at prescribing and dispensing sites to check the status and location of your prescription
• keep a record of your nominated pharmacy in the Personal Demographic Service (PDS) so that your electronic prescriptions are sent to the pharmacy of your choice (you can change or cancel your choice of dispenser at any time by speaking to your GP or pharmacist before you order your next prescription)
• verify the digital signature attached to the prescription
• send reimbursement electronic claim messages to the NHS Business Services Authority (NHSBSA) so they can reimburse the dispenser
• answer enquiries from prescribers and dispensers and investigate issues with the service
• investigate complaints about nominated pharmacies from patients, prescribers and dispensers
• publish anonymous statistical reports and dashboards to monitor the service so that we can improve it

Data protection law requires NHS England to have a legal basis before we can process your personal data.

Our legal basis is:

Public task

Article 6(1)(e) of UK GDPR. This is because the Isle of Man Department of Health and Social Care has requested NHS England to provide the EPS to NHS organisations and services in the Isle of Man. This Request is called the Electronic Prescription Service for Isle of Man Request 2026.

We also need a separate condition for processing under Article 9 of the UK GDPR and a condition under Schedule 1 of the Data Protection Act 2018 (DPA 2018) to process data which is extra sensitive. This is known as ‘special categories of personal data’. Our conditions for processing are:

Health or social care

Article 9(2)(h) of UK GDPR, plus Schedule 1, Part 1, Paragraph 2 “Health or social care purposes” of DPA 2018.

We share electronic claim messages with the NHS Business Services Authority (NHSBSA) so that they can reimburse the dispenser. The NHSBSA is the Isle of Man Department of Health and Social Care’s data processor for this activity.

We keep EPS data in our live system for up to 12 months after a prescription has been dispensed, or after a prescription has been prescribed but not dispensed by the pharmacy. It is then archived for 6 years before secure deletion.

We keep your data in accordance with the Records Management Code of Practice 2021.

The EPS is part of the NHS Spine which stores data on secure cloud storage in UK regions.

The Isle of Man is a self-governing dependency of the British Crown and is not a part of the UK.  Therefore to provide the EPS to the Isle of Man, electronic prescriptions data relating to patients in the Isle of Man will flow between the Isle of Man and the UK.

Under data protection law, this is known as an ‘international transfer’ of personal data. This transfer can take place because the UK has been granted an adequacy decision by the European Commission. The Isle of Man is also covered by UK adequacy regulations made by the UK government. This means that both the UK and the Isle of Man have been assessed to provide adequate levels of data protection.

Under data protection law, you have the following rights over your data for this service:

To make a rights request to NHS England, email us at [email protected]. 

We take our responsibility to look after your data very seriously. If you have any questions or concerns about how NHS England processes your data, please contact our Data Protection Officer (DPO) at [email protected].

If you are not happy with our response, you have the right to make a complaint about how we are using your data to the Information Commissioner’s Office by calling 0303 123 1113 or through their website.  

You can also contact the DPO for the Isle of Man Department of Health and Social Care at [email protected]. More information is available in their privacy notice.

We may make changes to this notice. If we do, the 'last edited' date on this page will also change. Any changes to this notice will apply immediately from the date of any change.