NHS Test & Trace – Digital Training Platform Privacy Information

Introduction

This document provides an overview of how Personal Data about you is collected, used, shared, stored, and disposed of when you undertake training to join the NHS Test & Trace  Lateral Flow Testing programme (also referred to here as “LFT,” “the programme,” “we” or “us”).  It also explains your rights and how they can be exercised. 

Background

NHS Test & Trace has three components:

Testing aims to identify who currently has the virus, and who has had the virus. You are joining us as an important part of that effort.

Tracing aims to identify people who may have been exposed to the virus through close contact with people who have subsequently tested positive, to advise them to self-isolate and for self-isolation support and enforcement.

Contain works with local authorities to identify clusters and outbreaks of the virus, to take coordinated action to contain outbreaks, and to support local communities in preventing future outbreaks.

Data Controller

The Department of Health and Social Care (‘DHSC’) has commissioned NHS Test & Trace on behalf of the UK Government and will be the Data Controller for the purposes of Data Protection legislation. DHSC decides what information is required and how it needs to be used. 

What Personal Data we collect and how it is used

When you register on the platform you are asked to provide the following information:

Information Why we need it
Your first name and last name To identify you
Your email address To enable us to contact you
The NHS region where you live e.g. East of England, East Midlands, North East etc. To identify which regions are participating and being supported
The sector in which you work e.g. retail, manufacturing, etc. To identify which sectors are participating and being supported
Confirmation that you have completed the online course. So that we can check that you are trained and ready to participate in the programme

Will my information be shared with anyone else?

Yes, your information will be processed by Knowledgepool (part of Capita plc) who operate the digital training platform on behalf of NHS Test & Trace. On completion of the training your information is passed to us.

Legal Basis for processing Personal Data

DHSC’s lawful basis for the processing of your data is:

  • GDPR Article 6(1)(e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the Data Controller to meet the statutory obligations; and
  • underpinned by the data Protection Act 2018 Schedule 1, part 1, section 2 ‘Health and social care purposes’.

How long do we keep your Personal Data?

For the Personal Data processed by the DHSC, your information will be stored in line with the Records Management Code of Practice for Health and Social Care 2016.  

This means your Personal Data may be retained for up to 8 years before being securely disposed of. Knowledgepool will securely delete your data from their systems upon passing it us.

Will my information be transferred outside the UK?

No, your data will remain in the UK.

Your rights as a data subject 

By law, you have rights as a data subject. Your rights under the EU General Data Protection Regulation (2016/679) and the UK Data Protection Act 2018 applies. 

Your right to get copies of your information – you have the right to ask for a copy of any information about you that is used. 

Your right to get your information corrected – you have the right to ask for any information held about you that you think is inaccurate, to be corrected 

Your right to limit how your information is used – you have the right to ask for any of the information held about you to be restricted, for example, if you think inaccurate information is being used. 

Your right to object to your information being used – you can ask for any information held about you to not be used. However, this is not an absolute right, and we may need to continue using your information, and we will tell you if this is the case. 

Your right to get information deleted – this is not an absolute right and, subject to “How long do we keep your Personal data?” above, we may need to continue to use your information, and we will tell you if this is the case. 

If you’re unhappy or wish to complain about how your Personal Data is used by NHS Test & Trace you should contact DHSC in the first instance to resolve your issue.  If you’re still not satisfied, you can complain to the Information Commissioner’s Office.

You can get in touch with us by contacting the Data Protection Officer for DHSC, Lee Cramp, who can be contacted by sending an email to data.protection@dhsc.gov.uk

Once we receive your request, members of our Data Protection Team will endeavour to get back to you as soon as possible to confirm receipt.

Security

We use appropriate technical, organisational and administrative security measures to protect any information we hold in our records from loss, misuse, and unauthorised access, disclosure, alteration and destruction. We have written procedures and policies which are regularly audited, and the audits are reviewed at senior level.

Changes to our policy

We keep our privacy notice under regular review, and we will make new versions available on our privacy notice page on the DHSC website. This privacy notice was last updated on 26 October 2020.