Skip to main content

Digital

Demographics Notify a Patient service

Summary

Why and how we process your data in the Demographics Notify a Patient service and your rights.

Controller NHS England
How we use the information (processing activities)

NHS England are responsible for the Personal Demographics Service (PDS) which is the national electronic database of NHS patient details, containing information such as your name, address, date of birth, NHS number, contact information and name of your GP practice. Your information may change in the PDS when you move to a new General Practice or when you provide a new telephone number or email address to your healthcare provider, as this information is sent by your healthcare provider’s IT system to the PDS.

The Demographics Notify a Patient service’s purpose is to provide timely notifications to you when information in your PDS record changes.  This is to ensure you are aware of any important updates to your record and so that you can correct any errors if needed.

The notifications you receive in the first development of the Demographics Notify a Patient service will be to inform you when you have transferred GP and the name of your GP practice on your PDS record changes. This notification will let you know the name of your new GP practice, confirm that your registration has been successful and that you can now access healthcare services at this practice. The notification will also direct you to how you can correct any errors if needed.
Does this contain sensitive (special category) data such as health information? No
Who are recipients of this data?

Our service interacts with other services that NHS England are responsible for, such as National Event Management Service (NEMS) and the Communications Manager service to monitor when any changes have been made to your PDS record and to send you a communication about this. These notifications will be sent to you either through the NHS App (if you use it) or by email, SMS text message or letter, using the contact details we have for you on your PDS record.

We also carry out user research to improve the service.  If you agree to take part, we ask your permission to share recordings with other people working in relevant areas, so that they can learn from our research too. This might include other people working on a specific project or other people in NHS England who are working to improve NHS services.

Depending on the type of user research, our data processors may need to process some of your data in order for you to take part in the research. Often this can include:

  • Qualtrics surveys which we use for collecting consent/information preferences and demographic information.  View their privacy statement
  • Microsoft Teams video meeting software (for online research sessions only). View the Microsoft privacy statement notice

Which data processors are involved will be described in the research information sheet.
Is data transferred outside the UK? This data is not transferred out of the UK
How long the data is kept Demographic data: 9 months for auditing purposes and to use for investigation in case of any service incidents raised. Audit logs: 7 years for record keeping and security purposes. Operational data: 9 months to support the core functionality of the service, to provide operational support and debugging/troubleshooting errors with the service. Analytics data (anonymous): 2 years to monitor and improve the service for example what percentage of notifications were sent by NHS App messaging, by text message, by email or by post. We conduct regular reviews of our retention periods in accordance with the NHS Records Management Code of Practice and our Records Management Policy
Our lawful basis for holding this data Legal obligation
Your rights
  • Tick Be informed
  • Tick Get access to it
  • Tick Rectify or change it
  • Cross Erase or remove it
  • Tick Restrict or stop processing it
  • Cross Move, copy or transfer it
  • Cross Object to it being processed or used
  • Cross Know if a decision was made by a computer rather than a person
How can you withdraw your consent?

You can withdraw your consent to taking part in user research by contacting the email address provided in your Research Information Sheet.
Is the data subject to decisions made solely by computers? (automated decision making) No
Where does this data come from? NHS England are responsible for the Personal Demographics Service (PDS) which is the national electronic database of NHS patient details, containing information such as your name, address, date of birth, NHS number, contact information and name of your GP practice. The PDS is populated by health and care organisations when you attend an appointment, receive care, etc.
The legal basis for collecting this data

Consent -Article 6(1)(a) of UK GDPR if you agree to take part in user research

Legal obligation -Article 6(1)(c) of UK GDPR.  This is because NHS England has a legal duty under Schedule 3, Part 2, paragraph 18(6)(b) of the National Health Service (General Medical Services Contracts) Regulations 2015 to write to patients to inform them when they have been accepted as a patient on to a GP practice’s list of patients.  The Secretary of State for Health and Social Care has also issued NHS England with a legal Direction to provide the Personal Demographics Service. This Direction is called the Spine Services (No.2) 2014 Direction.

Public task - Article 6(1)(e) of UK GDPR and Article 9(2)(h) - management of health care systems or services, supplemented by DPA 2018, Schedule 1, Part 1, paragraph 2 – Health or social care purposes and/or Article 9(2)(j) - research supplemented by DPA 2018 Schedule 1 Part 1, paragraph 4 – Research. To invite you to take part in user research.