COVID-19 vaccine research service: privacy policy - Version 5

About this policy

This privacy policy relates to the website (https://www.nhs.uk/sign-up-to-be-contacted-for-research/) and service described in this privacy policy, which is provided by NHS England to enable members of the public to give permission to be contacted by researchers about taking part in approved coronavirus (Covid-19) vaccine studies in the UK. This service is referred to in this document as the 'Service'.

In this privacy policy, 'we' or 'us' means NHS England. 'You' or 'your' means you, a member of the public who is using the Service.

This privacy policy tells you what information NHS England collects and how it is used to provide the Service, including your rights and how to contact us.

Learn more about coronavirus (COVID-19).

The Service and who we are

The Service allows you to:

1. give your permission for NHS England to share the details you have provided through the Service with researchers of approved UK coronavirus vaccine studies for the purposes of researchers contacting you about taking part in those vaccine studies. Researchers may ask NHS England to contact you on their behalf.
2. give your permission to be contacted by NHS England about
   • the progress and outcomes of the coronavirus vaccine studies; and
   • future developments in the Service, including to provide opportunities for you to take part in other types of health research.
3. withdraw your permissions to be contacted.

Using the information you provide to NHS England through the Service, we will identify whether you may be suitable for particular approved UK coronavirus vaccine studies. Your details will then be shared with researchers of relevant studies so they can contact you to ask you to take part in their studies. In some cases researchers may ask NHS England to contact you on their behalf.

You are not providing permission to take part in these vaccine studies through the Service – the researchers will ask for your permission to take part once they have contacted you. There is no obligation for you to take part and you can change your mind at any time.

In the UK, the research partner of the NHS is the National Institute of Health Research (NIHR). If you sign up to be contacted about vaccine studies through this Service, only researchers on studies supported by NIHR will be able to contact you. By volunteering in this way, you will be helping researchers to carry out their studies more efficiently.

Researchers involved in running vaccines studies may include university researchers, hospital researchers, pharmaceutical companies who have developed a new vaccine or clinical research organisations (private companies that help to run clinical trials).

The Health and Social Care Information Centre, known as NHS England, was set up under the Health and Social Care Act 2012 (2012 Act) and is part of the NHS in England. We securely collect, analyse and share information to improve health and social care services. Find out more about NHS England.

This includes working with the NIHR and researchers to collect and share data to support health research into coronavirus and other health conditions. Find out more about NIHR and research at the Be Part of Research website.

As we move on from the pandemic, the NHS COVID-19 Vaccine Research Registry (VRR) continues to support vaccine studies looking at new booster options and to understand any new variants. Under new Directions in January 2023, the service will also be used to support wider research by communicating opportunities to participate in other non-covid research. As part of these changes, the service will no longer be open for new registrations, but you can still withdraw your permission to be contacted. It is expected to continue in operation until March 2024.

Our legal basis for collecting, analysing, and sharing personal information

NHS England is the controller for the personal information collected and processed about you as part of this Service under the General Data Protection Regulation (GDPR) and Data Protection Act 2018 (DPA18).

Personal information about residents in England

NHS England is a controller jointly with the Secretary of State for Health and Social Care, who has legally directed NHS England to operate IT systems and to collect, analyse and share information to support the response to the coronavirus outbreak in England. This includes operating the Service. The COVID-19 Public Health Directions 2020 (COVID-19 Directions) are made under the 2012 Act.

Where you have given permission to be contacted about future developments in the Service, including to provide opportunities for you to take part in other types of health research, NHS England is also Directed by Secretary of State to provide a communication system for the purposes of contacting you. It is a system delivery function and the NHS Covid-19 Vaccine Research Registry Communications System Directions 2023 are made under Regulation 32 of National Institute for Health and Care Excellence (Constitution and Functions) and Health and Social Care Information Centre (Functions) Regulations 2013/259. A direction is a legally binding document.

The Service has been developed to support the Secretary of State's response to the outbreak, by providing members of the public with the opportunity to volunteer to participate in vital studies into coronavirus vaccines. It also supports the Secretary of State's duty to promote research relevant to the health service.

Personal information about residents in Scotland, Wales and Northern Ireland

Health bodies in Scotland, Wales and Northern Ireland have requested that NHS England also provide this Service to their residents. Those health bodies have made a legally binding request for the Service to be provided under section 255 of the 2012 Act. For residents in Scotland, Wales and Northern Ireland, NHS England is therefore a controller jointly:

• in Scotland with National Services Scotland under the Covid-19 National Services Scotland Non-Mandatory Request 2020;
• in Wales with Public Health Wales under the Covid-19 Public Health Wales Non-Mandatory Request; and
• in Northern Ireland, with the Department of Health – Northern Ireland under the Department of Health and Public Health Agency (Northern Ireland) Non Mandatory Request 2020.

Where you have signed up to receive information about future developments in the Service, including to provide opportunities for you to take part in other types of health research, NHS England also provides a service to provide you with details about other types of research on behalf of Scotland, Wales and Northern Ireland as a service under section 270 of the 2012 Act where they ask us to do so.

NHS England is, however, the only organisation who will process your personal information provided through the Service. None of the organisations above have access to your personal information. This means that NHS England is responsible for securely storing your information, complying with any rights you have when you exercise them, and for sharing your information with researchers of approved UK coronavirus vaccine studies (or contacting you on their behalf) where you have provided us with permission.

We are also responsible for processing your withdrawal of permission to be contacted if you change your mind and for securely destroying your information when it is no longer needed. These rights, how to exercise them and how we use your information are explained in more detail below.

GDPR legal basis

Our legal basis for processing your personal information under the GDPR is:

• GDPR Article 6 (1) (e) – processing is necessary for the performance of a task carried out in the public interest, where we have been legally directed and requested to provide the Service and where we contact you about the vaccine studies and developments to the Service.

Our legal basis for processing the information you provide us about your health and ethnicity under GDPR is:

• GDPR Article 9 (2) (g) – processing is necessary for reasons of substantial public interest, where we have been legally directed and requested to provide the Service, plus Part 2 Schedule 1 of the DPA18, paragraph 6, statutory and governmental purpose;
• GDPR Article 9 (2) (j) - processing is necessary for scientific research and statistical purposes where we are analysing personal information we have obtained through the Service for these purposes, plus Part 2 Schedule 1 of the DPA18, paragraph 4, scientific research and statistical purposes.

We have in place an appropriate policy document for this Service, which is required under the DPA18 in order to process the information we collect about your health and ethnicity (or special category data). This provides information about our procedures for complying with the data protection principles under GDPR and explains how long we will retain your information for. This is also explained below under 'How long we keep your personal information for'.

How we use your personal information and why

To determine if you are suitable for a study and to share your details and permission to contact with researchers

The personal information you have provided to us through the Service will be used by us to identify whether you may be suitable for a particular coronavirus vaccine study. Different studies will focus on research into how different vaccines and similar preventative treatments will work on different people and with a range of health conditions. When researchers ask us for your details, we will first check, using the information you have provided through the Service, if their study is likely to be suitable for you. If a study is not likely to be suitable then we will not share your details. If a study is suitable, we will share the details you provided through the Service or we may contact you on their behalf. There is more about this below under 'Who we share your personal information with'.

To help researchers plan their studies and to monitor and improve the Service

We will use the information you have provided to help researchers of the coronavirus vaccine studies to plan their studies. For example, we will analyse:

• the number of people who have signed up to the Service;
• where in the UK they are located; and
• the different health conditions that people may have.

This analysis will also support us, NIHR and other relevant stakeholders to promote the coronavirus vaccine studies to under-represented groups.

Anonymous statistical data produced from this analysis will be shared with researchers of the coronavirus vaccine studies, the Department of Health and Social Care, NSS, Public Health Wales, the Department of Health – Northern Ireland, the Vaccine Task Force, NIHR and other relevant organisations. It may also be published. This statistical data will not identify you.

To contact you

If you give us permission, your personal information will be used by NHS England to keep you informed about the progress and outcomes of the coronavirus vaccine studies.

If you choose we will also keep you informed about developments in the Service to provide opportunities for you to take part in other types of health research. This would include, for example, letting you know and about any changes to the Service, including any significant changes to this Privacy Policy and when we have added other permission to contact services onto the NHS.UK website.

Where you have registered for NIHR Be Part of Research Volunteer Registry to learn about other types of research, the NIHR Be Part of Research Team will share your email address with NHS England. This is so that you can be removed from any duplicate communications sent from NHS England about other types of research. This will continue until such time as the Service is discontinued. A Data Sharing Agreement between NHS England and NIHR has been put in place to do this.

We will keep you informed by email. These emails will be general eg newsletters, and will not be targeted to you as a result of any of the information you have provided. You can unsubscribe at any time from receiving these emails by using the unsubscribe functionality in the email.

To withdraw your permission to be contacted

If you change your mind and would like to withdraw your permission to be contacted by researchers about approved coronavirus vaccine studies, you can withdraw your permission by following the link in the confirmation email we send you. You can also withdraw your permission on the Service website. This will withdraw your permission to be contacted by those researchers and by NHS England – it will not withdraw your permission to participate in any study you may already have agreed to participate in. In order to withdraw your permission from a study you have already agreed to participate in, you will need to contact the researcher associated with that study directly.

Where you withdraw your permission to be contacted by researchers about approved coronavirus vaccine studies, the information collected about you through this Service will no longer be shared by NHS England with researchers. However, it may take up to 28 days for the withdrawal of your permission to take effect where your information has already been shared with a researcher. You may therefore still be contacted by researchers during this time. You will not be contacted by NHS England.

When you have withdrawn your permission to be contacted, the information you provided through the Service, including the withdrawal of your permission to be contacted, will be retained by NHS England for legal reasons for 8 years (as described below).

Updating your details

If you need to update any of the information you have provided through the Service, you will need to withdraw your permission to be contacted by researchers and re-register for the Service. You can do this by following the link in the confirmation email we send you or withdrawing your permission on the Service website.

The types of personal information we use

We will collect various types of information about you through the Service, including information about your health. As you go through the Service you will be asked various questions, including about your health. We will tell you for each question why we need this information. We have also summarised this here.

Who we share your personal information with

The personal information you provide will only be shared with researchers working on UK coronavirus vaccine studies approved by the NIHR, so that they can contact you about their study if it may be suitable for you. They will only be passed your details once they have completed the application process detailed below. Researchers are required to go through the application process even if they have asked NHS England to contact you on their behalf.

A list of the coronavirus vaccine studies, where they are being run and the researchers providing them is on the Be Part of Research Covid 19 Vaccine Studies webpages. This includes a list of studies that are currently using the service to recruit people for their trial.

The researchers will only use your information to contact you by email to invite you to take part in their study. They will contact you using the official email address for the study which is published here or you may be contacted by NHS England (ccsm@nhsdigital.nhs.uk) when we are asked to do this on behalf of the researcher. You should carefully check the email address from any email which looks to come from a researcher of a study to make sure it is genuine. You can find further information on how to spot the obvious signs of a scam/phishing attempt by visiting the National Cyber Security Website, or Action Fraud.

If you receive an email which is not from the official email address or you have concerns that the email may not be genuine, you should contact the lead researcher for the study using the details provided about the study here.

Researchers will want to agree a time to discuss the study with you in more detail. If you decide to participate in their study, the researcher will ask you to give further permission to take part in that study. You will also be asked to provide identification to the researcher so that they can verify who you are. For more information on what is involved in taking part in the study please see the Frequently Asked Questions.

We will not share your information with researchers of vaccine studies more than 8 -12 times in a 12-month period. This is because there are a number of vaccine studies anticipated to run at similar times in different locations, and it may be that some of these studies are not suitable for you, but others are suitable. When you have successfully enrolled or started to take part in a vaccine study, the researcher of that study will need to tell us this. We will then update your information and will no longer share your information with other vaccine studies, as you would not be able to take part in more than one study at the same time.

All information which is shared by NHS England is subject to robust rules relating to privacy, security and confidentiality and only the minimum amount of information necessary will be shared. We will only, therefore, share relevant information with researchers where you appear to meet the criteria for their specific vaccine study. This will include your name, email address and other information such as your ethnicity and the answers you provided about your health conditions, but only where this is necessary for their study.

Researchers from approved UK coronavirus vaccine studies will be required to apply to NHS England's Data Access Request Service (DARS) to obtain your details, including your email address, to contact you. This service makes sure that the researchers have a legal basis under the GDPR and DPA18 to use your information and that it will be used safely, securely and appropriately for their study. Their applications will also be subject to independent scrutiny and oversight by the Independent Group Advising on the Release of Data (IGARD). Researchers approved to receive your details through this process will be required to enter into a data sharing agreement with NHS England regulating the use of your information. This approval is still needed even if researcher asks NHS England to contact you on their behalf.

It should be noted that this data access process is for the permission to contact data only researchers are responsible for seeking further permissions – as needed - around access to a participants medical record. Where this permission is given, the Researcher will then be required to apply to access those records via the usual data access arrangements in place within each of the regions, or to apply to DARS if they need data from NHS England.

We publish details about all information shared through DARS in our data release register.

How patient data is used to improve health and care

Permission is not always required for patient data to be used for health research in England and Wales.

For example, in England and Wales the law permits this to happen where it is approved by the Secretary of State or the Health Research Authority so that approved medical research can take place. You may therefore still be invited to participate in coronavirus vaccine studies without your permission where the law allows this, but this does not mean that you have to participate.

For more information about how patient data is used to improve health and care:

In England and Wales

• How is Patient Data Used
• What You Need to Know
• Understanding Patient Data

In Scotland

Public Benefit and Privacy Panel for Health and Social Care

In Northern Ireland

Honest Broker Service for Health and Social Care

We will only provide the information we have obtained from you through this Service to researchers of approved UK coronavirus vaccine studies where you have provided permission for us to do so through the Service.

How long we keep your personal information for

We will share information with approved coronavirus vaccine studies so that they can contact you until 31 March 2024. We will retain your information for legal purposes for 8 years from this date. It will then be securely destroyed.

If you have agreed to participate in a coronavirus vaccine study, the study will need to keep your information for longer than this. The researcher for the study will tell you how long they need to use your information for when you agree to take part in their study. This will also be in their privacy notice.

If you withdraw your permission to be contacted through the Service before 31st March 2024, the personal information you provided will be retained by NHS England for legal purposes for 8 years from the date you withdrew your permission.

8 years is the time period recommended for keeping standard care records under the Records Management Code of Practice for Health and Social Care 2016.

Where we store your personal information

We store and process your personal information for this Service in the United Kingdom.

NHS England uses Amazon Web Services (AWS) to provide our Data Platform Service, this is a cloud service which we use to process and store data. This is hosted in the UK. AWS is a data processor for all data stored on DPS and NHS England has a legally binding contract to ensure you data remains safe and secure.

Your personal information will only be shared with researchers of coronavirus vaccine studies in the UK. They may store data outside of the UK but this will only be permitted where this complies with GDPR. NHS England will ensure this is allowed under GDPR when we are considering their application for access to your information through DARS. We will also restrict the use of your information to agreed locations and territories in the data sharing agreement the researchers sign.

Anonymous data, for example statistical data, which does not allow you to be identified, may be stored and processed outside of the UK by those with whom we have shared anonymous data and when it is published by us.

Your rights over your personal information

You have the following rights in relation to your personal information obtained through the Service:

• the right to be informed about how your personal information is being used (be informed);
• the right to access the personal information (get access);
• the right to request the correction of inaccurate personal information (rectify or change);
• the right to request the erasure of your personal information in certain limited circumstances (erase or remove);
• the right to restrict processing of your personal information where certain requirements are met (restrict or stop processing);
• the right to object to the processing of your personal information in certain circumstances (object to processing or use);
• the right to request that elements of your data are transferred either to you or another service provider in certain circumstances (move, copy or transfer);
• the right to object to certain automated decision-making processes using your personal information (know if a decision was made by a computer rather than a person); and
• the right to raise a concern with NHS England and the Information Commissioner's Office at any time (raise a concern).

More information about your legal rights can be found on the Information Commissioner's website.

Please note that some of these rights do not apply in relation to the processing of your personal information by us through this Service due to the specific requirements and exemptions which apply to them. The rights which do apply in relation to the personal information we process as part of this Service are set out in summary form below.

Summary of your rights

Summary of your rights over your personal information

Rights	Where we are relying on public task (Article 6(1)(e) of GDPR above)	Where we are processing for scientific research and statistical purposes in relation to anonymous statistics (Article 9(2)(j) of GDPR above)
Be informed	Yes	Yes
Get access	Yes	No
Rectify or change	Yes	No
Erase or remove	No	Yes
Restrict or stop processing	Yes	No
Move, copy or transfer	No	Yes
Object to processing or use	Yes	No
Know if a decision was made by a computer rather than a person	Yes	No
Raise a concern	Yes	Yes

If you decide to participate in a vaccine study, you will be provided with a privacy notice by the researcher before agreeing to participate in their study. This will explain how the researcher will use your personal information and your rights in relation to this. Your rights may be different from those above.

Contact us

If you have any queries in relation to the use of your personal information in connection with the Service, or if you want to exercise any of your rights above, please contact enquiries@nhsdigital.nhs.uk.

Our Data Protection Officer's duties include monitoring internal compliance and advising the organisation on its data protection obligations. You can contact them at enquiries@nhsdigital.nhs.uk.

Contact the Information Commissioner

If we are unable to resolve any queries or concerns in relation to the use of your personal information in connection with the Service, you can raise your concern with the Information Commissioner. You can contact the Information Commissioner’s Office:

• using the online Contact Us service
• by calling 0303 123 1113
• by writing to the Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF

Changes to this notice

The terms of our privacy policy may change from time to time. Any updates to the privacy policy will be published on the Service website. Where we make any significant changes we will also inform you about this by email.

Previous versions

Version 4

Annex