COVID-19 vaccine research service: privacy notice

This privacy notice relates to the website (https://www.nhs.uk/sign-up-to-be-contacted-for-research/) and service described in this privacy notice, which was provided by NHS England to enable members of the public to give permission to be contacted by researchers about taking part in approved coronavirus (Covid-19) vaccine studies in the UK. This service is referred to in this document as the 'Service'.

In this privacy notice, 'we' or 'us' means NHS England. 'You' or 'your' means you, a member of the public who has used the Service.

The Service has now been replaced and therefore this privacy notice will contain information about how and why any data that you provided to the Service will be retained.

If you signed up to the Service, you may have provided all or just some of the following data:

• Whether you are aged over 18
• Whether you lived in England, Scotland, Wales or Northern Ireland
• Your e-mail address
• Your name
• Your date of birth
• Your postcode
• Your phone number but this was (optional)
• The sex you were registered as at birth
• Your gender
• Your ethnicity
• Whether you are a face-to-face worker or volunteer
• Whether you are a health and social care worker
• Any relevant coronavirus test and result
• Relevant health condition questions
• Whether you gave permission for researchers to contact you directly

NHS England is the controller for the personal information collected and processed about you as part of this Service under the UK General Data Protection Regulation (UKGDPR) and Data Protection Act 2018 (DPA18).

Where you gave permission to be contacted about future developments in the Service, including to provide opportunities for you to take part in other types of health research, NHS England was Directed by the Secretary of State to provide a communication system for the purposes of contacting you. It was a system delivery function and the NHS COVID-19 Vaccine Research Registry Communications System Directions 2023 were made under Regulation 32 of National Institute for Health and Care Excellence (Constitution and Functions) and Health and Social Care Information Centre (Functions) Regulations 2013/259. A direction is a legally binding document.

The Service was developed to support the Secretary of State's response to the COVID-19 outbreak, by providing members of the public with the opportunity to volunteer to participate in vital studies into coronavirus vaccines. It supported the Secretary of State's duty to promote research relevant to the health service.

As the Service has been replaced, we will ask the Secretary of State to revoke the Vaccine Research Registry Communications System Directions 2023 as we are no longer collecting, analysing or sharing this information.

Health bodies in Scotland, Wales and Northern Ireland requested that NHS England also provided this Service to their residents. Those health bodies made a legally binding request for the Service to be provided under section 255 of the 2012 Act. For residents in Scotland, Wales and Northern Ireland, NHS England is therefore a controller jointly:

• in Scotland with National Services Scotland under the COVID-19 National Services Scotland Non-Mandatory Request 2020
• in Wales with Public Health Wales under the COVID-19 Public Health Wales Non-Mandatory Request
• in Northern Ireland, with the Department of Health – Northern Ireland under the Department of Health and Public Health Agency (Northern Ireland) Non Mandatory Request 2020

Where you have signed up to receive information about future developments in the Service, including to provide opportunities for you to take part in other types of health research, NHS England provided that service on behalf of Scotland, Wales and Northern Ireland, under section 270 of the 2012 Act.

As the Service has been replaced, we have informed the Health bodies in Scotland, Wales and Northern Ireland that we are no longer collecting, analysing or sharing this information and therefore can no longer comply with the non-mandatory requests made under section 255 of the Health and Social Care Act 2012 Act nor can we provide the Services requested under section 270 of the same Act.

NHS England was the only organisation to process your personal information provided through the Service and none of the organisations above had access to your personal information. This means that NHS England is responsible for securely storing your information and complying with any rights you have when you exercise them, for retaining your data in an archive and for securely destroying your information when it is no longer needed. These rights, how to exercise them and how we will use your information are explained in more detail below.

Our legal basis for retaining your personal information under the UKGDPR is:

• Article 6 (1) (e) – processing is necessary for the performance of a task carried out in the public interest.

Our legal basis for retaining the information you provided us about your health and ethnicity is:

• Article 9 (2) (j) - processing is necessary for archiving purposes, scientific or historical research purposes or statistical purposes,

The independent public inquiry set up to examine the UK’s response to and impact of the COVID-19 pandemic established under the Inquiries Act (2005) requires data obtained during the pandemic to be retained and available should it be called for as evidence for the inquiry. Once the inquiry requirements have ended, it has been determined that the records are part of a research dataset and will be retained in accordance with the NHS Records Management Code of Practice.

The personal information you have provided to us through the Service is no longer used by us to identify whether you may be suitable for a particular coronavirus vaccine study.

We no longer use the information you have provided to help researchers of the coronavirus vaccine studies to plan their studies.

We do not share the data we hold with any other party. Researchers from approved UK coronavirus vaccine studies are no longer able to apply to NHS England's Data Access Request Service (DARS) to obtain your details, including your email address, to contact you.  There are no active agreements in place that include the use of your data. We publish details about all information that has been shared through DARS in our data release register.

We no longer prepare anonymous statistical data.

We have processed your contact details to enable us to update you about the service.  We will no longer process your data once the final communication informing you of the closure of the service has been sent.  You will no longer be able to unsubscribe from receiving communications as the unsubscribe functionality will be withdrawn as your data will not be processed for this purpose.

Retention period

NHSE will retain the data obtained through the operations of the VRR for a period of 8 years from the 31 July 2025, this is to ensure that NHS England has a record of the processing and dissemination of personal information in relation to the establishment, exercise of any rights or the defence of any potential legal claims. The data will be held in an archive environment and the only processing that will be undertaken will be the storing of that information for the agreed retention period.

If you have previously agreed to participate in a coronavirus vaccine study, the researcher for the study will have informed you how long they need to use your information for when you agreed to take part in their study. This will also be in their privacy notice.

If you withdrew your permission to be contacted through the Service before 31 March 2024, the personal information you provided will be retained by NHS England for legal purposes for 8 years from the date you withdrew your permission.

Storage

We store your personal information for this Service in the United Kingdom.

NHS England uses Amazon Web Services (AWS) to provide our Data Platform Service; this is a cloud service which we use to process and store data. This is hosted in the UK. AWS is a data processor for all data stored on DPS and NHS England has a legally binding contract to ensure your data remains safe and secure.

Your rights

You have the following rights in relation to your personal information obtained through the Service:

• the right to be informed about how your personal information is being used; we do this through our privacy notice (be informed)
• the right to access the personal information (get access)
• the right to request the correction of inaccurate personal information although as no longer processed, this will not be possible (rectify or change)
• the right to request the erasure of your personal information in certain limited circumstances although as no longer processed, this will not be possible (erase or remove)
• the right to restrict processing of your personal information where certain requirements are met although we are no longer processing your data (restrict or stop processing)
• the right to object to the processing of your personal information in certain circumstances; you were able to exercise this by withdrawing from the registry (object to processing or use)
• the right to request that elements of your data are transferred either to you or another service provider in certain circumstances; as the data will be held in archive the opportunity to do this will be limited (move, copy or transfer)
• the right to object to certain automated decision-making processes using your personal information; this is not carried out when data is in an archive (know if a decision was made by a computer rather than a person)
• the right to raise a concern with NHS England and the Information Commissioner's Office at any time (raise a concern)

More information about your legal rights can be found on the Information Commissioner's website.

If you have any queries in relation to the use of your personal information in connection with the Service, or if you want to exercise any of your rights above, please see How to access your personal information or make a request in relation to other rights.

Our Data Protection Officer's duties include monitoring internal compliance and advising the organisation on its data protection obligations. You can contact them at [email protected].

If we are unable to resolve any queries or concerns in relation to the use of your personal information in connection with the Service, you can raise your concern with the Information Commissioner. You can contact the Information Commissioner’s Office:

• using the online Contact Us service
• by calling 0303 123 1113
• by writing to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF