Covid-19 and your information - supplementary privacy note on Covid-19 for Patients
This notice outlines how we may use your information to protect you and others during the Covid-19 outbreak. UCLH is involved in local, national and international responses working with the rest of the NHS and other organisations. This notice supplements our main Privacy Notice.
We may amend this privacy notice at any time so please review it frequently. The date at the top of this page will be amended each time this notice is updated. We have drafted this notice in close collaboration with our patient representatives.
The health and social care system is facing significant pressures due to the Covid-19 outbreak. Health and care information is essential to deliver care to individuals, to support health and social care services and to protect public health. Information will also be vital in researching, monitoring, tracking and managing the outbreak.
In the current emergency it has become even more important to share health and care information across relevant organisations. These organisations include other NHS Trusts and institutions, Public Health England and research institutions like UCL and sometimes with health and research partners overseas. We will continue to use services from companies like Microsoft, AIMES and Atos as we do currently under contracts.
Existing law which allows confidential patient information to be used and shared appropriately and lawfully in a public health emergency is being used during this outbreak. All healthcare bodies must legally now provide this confidential patient information to respond to the Covid-19 outbreak. Any information used or shared during the Covid-19 outbreak will be limited to the period of the outbreak unless there is another legal basis to use the data. Further information is available on gov.uk here and some FAQs on this law are available here.
During this period of emergency, opt-outs will not generally apply to the data used to support the Covid-19 outbreak, due to the public interest in sharing information. This includes National Data Opt-outs. However in relation to the Summary Care Record, existing choices will be respected. Where data is used and shared under these laws your right to have personal data erased will also not apply. It may also take us longer to respond to Subject Access requests, Freedom of Information requests and new opt-out requests whilst we focus our efforts on responding to the outbreak.
How will my information be used?
In line with the materials we refer to the kinds of work your information will be used to:
- to support include understanding Covid-19 and risks to public health as well as individual patients and how to treat them;
- understand how patients are accessing health services and the needs of our patients, including vulnerable groups and health and social care workers as direct or indirect results of Covid-19;
- conduct research and planning, where we have provided a list of research projects in Appendix 1.
Information Uses - Individual Care
In order to look after your health and care needs we may share your confidential patient information including health and care records with clinical and non clinical staff in other health and care providers, for example neighbouring GP practices, hospitals and NHS 111. We may also use the details we have to send public health messages to you, either by phone, text or email.
Across North Central London a single list of people with Covid 19 will be created by the local hospitals that local authority social cae teams need to be aware of. Information needed for the transfer of care will be uploaded into the HealtheIntent platform. Details about HealtheIntent can be found here
During this period of emergency we may offer you a consultation via telephone or video-conferencing. By accepting the invitation and entering the consultation you are consenting to the use of telephone or video-conferencing for your consultation. Your personal/confidential patient information will be safeguarded in the same way it would with any other consultation.
When you tell us you’re experiencing Covid-19 symptoms we may need to collect specific health data about you. Where we need to do so, we will not collect more information than we require and we will ensure that any information collected is treated with the appropriate safeguards.
Information Uses: Public Health, National and International Response
We will also be required to share personal/confidential patient information with health and care organisations and other bodies engaged in disease surveillance for the purposes of
protecting public health, providing healthcare services to the public and monitoring and
managing the outbreak. Further information about how health and care data is being used and shared by other NHS and social care organisations in a variety of ways to support the Covid-19 response is here.
NHS England and Improvement and NHSX (see here) have developed a single, secure store to gather data from across the health and care system to inform the Covid-19 response. This includes data already collected by NHS England, NHS Improvement, Public Health England and NHS Digital. New data will include 999 call data, data about hospital occupancy and A&E capacity data as well as data provided by patients themselves. All the data held in the platform is subject to strict controls that meet the requirements of data protection legislation.
Research (national and international)
To help inform the Covid-19 response UCLH will share data with other organisations as well for research purposes. The sharing will have been approved and will be subject to the same strict controls as above that meet the requirements of the data protection legislation. We provide a list of these examples under Appendix 1(see Appendix 1). For Covid-19 responses we cannot implement any opt out requests currently. This is due for review by 30th September 2020.
UCLH will be sharing data from its electronic health record (EPIC) with the University Hospitals Birmingham on patients at risk, or with a confirmed or suspected diagnosis of COVID-19 with the aims of understanding the disease and improving the way the NHS provides care.
The data will be stored securely on a Health Data Research UK affiliated research database held by University Hospitals Birmingham.
It will include electronic health records for patients from University Hospitals Birmingham and University College London Hospitals. In the future, DECOVID may be expanded to include patient data from other hospitals.
We are working together with data scientists from University College London, the University of Birmingham and The Turing Institute to curate and analyse your data to tell us how to provide the most effective healthcare for patients with this poorly understood viral illness.
We are using Microsoft as a supplier who have provided a UK cloud based system for us to manage and process this data. At no point will any of your identifiable data be accessible to anyone outside of the NHS, specifically initially University Hospitals Birmingham and University College London Hospitals NHS Foundation Trusts.
DECOVID has been approved by the Health Research Authority’s London - City & East Research Ethics Committee (reference: 20/HRA/1689). This committee is an independent group which ensures that all our research is ethical.
Additional information on the nature of the research project and specifics of what research it may have been used in will be available from www.decovid.org by 31st May 2020.
UCLH is acting as the UK co-ordinator of an international collaboration run by Utrecht Medical Centre.
UCLH will be collecting information on patients who have presented to UCLH and are highly suspected of or have a confirmed case of Covid-19 with the aims of understanding the role of cardiovascular disease in the pandemic. The data will be collected from our Epic system, the data we collect for ISARIC (see below) and an additional reporting form.
The information will be identified by a study number linked to your health record identifier. This link and your health record identifier will not be shared with anyone outside UCLH.
The data will be collected and stored on a secure service managed by AIMES (https://
CAPACITY-COVID has been approved by the Health Research Authority’s London - Surrey Borders Research Ethics Committee (reference: 20/HRA/1876). This committee is an independent group which ensures that all our research is ethical.
CAPACITY COVID has also received approval for its COVID-19 application to the Public Benefits and Privacy Panel for Health and Social Care in Scotland. The Northern Ireland Privacy Advisory Panel has also advised the arrangements for CAPACITY-COVID are satisfactory.
Additional information can be found at https://
International Severe Acute Respiratory and emerging Infection Consortium (ISARIC) COVID-19 Clinical Research Services
UCLH will be collecting information on patients who have presented to UCLH and are highly suspected of or have a confirmed case of Covid-19 with the aims of understanding the pandemic. We will be sharing data with Oxford University who are acting as the UK Co-ordinator and Sponsor for ISARIC.
The data will be shared with ISARIC’s central database stored described here for more details
The data will be collected from our Epic system, the data we collect for ISARIC (see below) and an additional reporting form.
The information will be identified by a study number linked to your health record identifier. Your NHS Number, Date of Birth and Postcode will be sent as part of the upload to ISARIC.
ISARIC has been approved by the Health Research Authority’s South Central - Oxford C Research Ethics Committee (reference: 13/SC/0149). This committee is an independent group which ensures that all our research is ethical
This policy sets out how, in our day to day activities, The University College London Hospitals NHS Foundation Trust (UCLH) processes and stores personal information relating to our patients and users of our websites.
To fulfil obligations to deliver diagnosis, treatment, research, education and our community services we collect and process personal information. In so doing UCLH adheres to the requirements of all applicable legislation including the General Data Protection Regulation (GDPR) and applies those requirements to any personal information we hold that relates to you.
We aim to be clear about when and how we collect your information and will not to do anything with it you would not reasonably expect or which we have not made you aware. Please read this policy carefully to understand how we collect, use and store your information.
UCLH is a data controller in respect of your personal information. If you have any questions about this policy or the ways in which we may process your personal information, please contact the Data Protection Officer at:
Data Protection Officer
Tottenham Court Road
Health and social care professionals working with you – such as doctors, nurses, support workers, psychologists, occupational therapists, social workers and other staff involved in your care – keep records about you, your health and any care and treatment you are offered or receive. This may include:
- Name, address, date of birth, phone number, and email address (where you have provided it to enable us to communicate with you)
- Your next of kin and contact details
- Notes and reports about your physical or mental health and any treatment, care or support you need and receive
- Results of your tests and diagnosis, including medical imaging
- Relevant information from other professionals, relatives or those who care for you or know you well
- Any contacts you have with us such as home visits or outpatient appointments
- Information on medicines, side effects and allergies
- Patient experience feedback and treatment outcome information you provide.
Most of your records are electronic and are held on a computer system and secure IT network. New models of service delivery are being implemented, with closer working with GPs and other healthcare and social care providers. To assist this, other electronic patient record systems to share your information will be used. At the relevant point you will be given the opportunity to say no and to opt-out of having your information held on these systems. Should you choose to opt-in, please note that at any point afterwards you can change your mind and opt-out by informing your GP and / or relevant health professional involved in your care.
When you visit our website, you may provide us with personal information such as:
- Your name
- Your contact details
- Your date of birth
- Your gender
- Your credit/debit card details
- Your job title
- Your employment history
- Information on your usage of our website
Here are some examples of when you can provide us with personal information on this website:
- When contacting us with an enquiry either via webform or email link
- When signing up to a newsletter
- When purchasing an event ticket
- When giving feedback
- When filling out a form
- When you apply for a job with us. Our human resources department will update you on progress of your application. Please note that UCLH retains evidence of a staff member’s right to work, security documentation and a successful candidate’s application form for six years after the staff member leaves or on their 75th birthday, whichever is sooner. However there is no legislation which prescribes how long to retain information relating to unsuccessful candidates. The UCLH approach is therefore to retain this information for 400 days after the interview date for unsuccessful candidates.
Data protection law recognises the difference between personal data and that of a more sensitive nature such as racial or ethnic origin, political opinions, religious beliefs, trade union activities, physical or mental health, sexual life, or details of criminal offences.
GDPR adds a special data category of genetic data and biometric data that is processed to uniquely identify an individual.
As a healthcare organisation, UCLH will therefore collect sensitive data as defined above. For example:
- When submitting a referral request
- When submitting your story to be considered as case study
However we do not solely collect healthcare information. Other information will include religious information, for example to make us aware of dietary requirements or limits to treatment, or philosophical beliefs, for example for patients who are vegan and therefore have requirements regarding particular medicines.
Every day we are working to ensure that our staff provide inclusive services to all patients, which meet their needs and are delivered with kindness, dignity and respect, irrespective of any equality characteristic such as gender, race, religion or disability status. We also want to ensure that all our staff are treated similarly with kindness, dignity and respect. Staff and patient surveys are a key mechanism in helping us achieve this as we carefully consider their experiences and feedback to help shape our policies and culture. An equality monitoring form is also sent with all complaint acknowledgements to advise the Trust on this important area. As such, we gather, analyse, report and monitor our workforce and patients equality data by protected characteristics.
UCLH works with GP practices, other hospitals and social services across North London to make your information available to them. A record of care is held on each partner’s secure clinical system (a local record). HIE integrates data from each partner’s electronic health and care systems to provide a real-time and read-only summary of that data to a care professional when required for the purpose of your direct care.
The care professional can see relevant parts of your clinical record; this excludes certain sensitive data items as detailed below.
The categories of personal information we share
Personal information (or Personal Data) means any information about an individual from which that person can be identified. It does not include information where the identity has been removed (anonymous data). The Personal Data that is shared includes:
- Identifying Data: forename, surname, address, date of birth, gender, age, postal address, postcode, telephone number, NHS number and hospital ID
- Special categories of Personal Data: physical/mental health or condition. For example, blood test results, allergies, information about scans such as MRI, CT and X-ray results, and appointments etc.
However, not every element of your information is part of the joint record. Examples of the sensitive information that will be left out include fertility treatment, termination pregnancy, gender change and female genital mutilation records.
How can I “opt-out” of data sharing via HIE?
We ask you to think carefully before making this decision as sharing your health and social care information will make it easier for services to provide the best treatment and care for you.
If you chose to opt-out, we may still need to share data for your care, but it will be using less immediate methods. For example, your GP may refer you to a hospital consultant by email. During your hospital appointment, the consultant will be able to see some of the information your GP holds about you by referring to HIE. If you opt-out the consultant may only see the information the GP put in the email or may need to phone or fax your GP in advance of your appointment.
If you would like to speak to someone about your choice, you can call the enquiry line on 020 3688 1900.
You can opt-out of having your Personal Data shared via HIE by completing the form on our website.
If you choose to opt-out:
You may have to answer questions repeatedly because your full history may not be available to the care professional assessing you.
Decisions about your care may take longer, even in emergency situations, as history needs to be confirmed.
Some medical tests may get repeated unnecessarily e.g. if you had a blood test with your hospital consultant, your GP may not be able to see this.
For further information on HIE you can go to the North London Partners website: https://
We will process your personal information fairly and lawfully by only using it if we have a lawful reason to do so. Making you aware of your rights and how your information is used is important to us and therefore we have summarised this below.
However, please note that we do not rely on consent as a legal basis for processing information that concerns your direct care. This is because we are obliged by law to make use of your personal information and record the care and treatment we provide to you. This is also necessary to allow us to provide you with safe and effective care. It would not be correct to say that you have a choice as to whether or not we will use your personal information if we are going to provide you with care and treatment. For this reason, instead of consent, we rely on specific provisions under the law, such as ‘…a task carried out in the public interest or in the exercise of official authority vested in the controller.’
This means we use your personal information to provide you with your direct care without seeking your consent. However, you do have the right to object to our use of your information. We will consider your objection but if we comply with your wishes we will explain how this could have an impact on our ability to provide you with care.
While most of the information we process will be for direct healthcare purposes, please note that there are other important reasons that we may need to process your personal information. For example:
- For private care patients we will need to process your data for the administration and obtaining payment for services provided
- To conduct clinical research (although any published data is anonymised)
We will only use your personal information for the purposes for which we collected it, unless we reasonably consider that we need to use it for another reason and that reason is compatible with the original purpose and / or within our legitimate interests.
We will only use enough of your personal information that will be relevant and necessary for us to carry out various tasks within the delivery of your care.
We will keep your information accurate and up to date when using it and if it is found to be wrong, we will make it right, where appropriate, as soon as we can.
We will only retain your personal information for as long as necessary to fulfil the purposes we collected it for, including for the purposes of satisfying any legal, regulatory, accounting, or reporting requirements.
To determine the appropriate retention period for personal information, we consider the amount, nature, and sensitivity of the personal information, the potential risk of harm from unauthorised use or disclosure of your personal information, the purposes for which we process your personal information and whether we can achieve those purposes through other means, and the applicable legal requirements. In addition, all records held by the NHS are subject to the Records Management Code of Practice for Health and Social Care 2016 (the Code). The Code sets out best practice guidance on how long we should keep your patient information before we are able to review and securely dispose of it.
Details of retention periods for different aspects of your personal information are (available in our retention policy which you can request from us by contacting us).
In some circumstances we may anonymise and de-identify your personal information (so that it can no longer be associated with you) for research or statistical purposes. In these circumstances we may use this information indefinitely without further notice to you.
We have secure processes in place to keep your personal information safe when it is being used, shared, and when it is being stored.
We have put in place appropriate security measures to prevent your personal information from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, we limit access to your personal information to those employees, agents, contractors and other third parties who have a legitimate need to know. They will only process your personal information on our instructions and they are subject to a duty of confidentiality.
We have put in place procedures to deal with any suspected personal information breach and will notify you and any applicable regulator of a breach where we are legally required to do so.
Your personal information will be shared with the team who are caring for you and are providing your treatment.
NHS and other agencies, including social services and private healthcare organisations work together so we may need to share information about you, with other professionals and services involved in your care. We will only share your information in this way if it is considered necessary.
You have the right to refuse/withdraw your consent to information sharing at any time. Please discuss this with your relevant health care professional involved in your care who can seek advice from our Information Governance department. If you want to withdraw your consent to us sharing your information and this is likely to change the way you receive further care we will explain this to you so that you can make a fully informed choice.
A person’s right to confidentiality is not absolute and there may be other circumstances when we must share information from your patient record with other agencies. In these rare circumstances we are not required to have your consent and rely on other lawful grounds to process the data for example, our legitimate interests for the purposes of improving our services and website in order to run our organisation effectively and efficiently. We may also process data where it is necessary for the performance of a contract, for example for private patients we need to process billing information.
Other examples of this are:
- If there is a concern that you are putting yourself at risk of serious harm
- If there is concern that you are putting another person at risk of serious harm
- If there is concern that you are putting a child at risk of harm
- If we have been instructed to do so by a court
- Immigration authorities / relevant third parties requiring information to obtain payment for services provided to overseas visitors
- If the information is essential for the investigation of a serious crime
- If you are subject to the Mental Health Act (1983), there are circumstances in which your ‘nearest relative’ must receive information even if you object
- If your information falls within a category that needs to be notified for public health or other legal reasons, such as certain infectious diseases
- If regulators use their legal powers to require us to provide them with patient information as part of any investigations they are undertaking.
NHS Patient Survey Programme (NPSP) is part of the government’s commitment to ensure patient feedback is used to inform the improvement and development of NHS services. We may share your contact information with an NHS approved contractor to be used for the purpose of the NPSP. Please note that no information about your care and treatment is provided to the organisation that does this survey.
NHS Digital, on behalf of NHS England, assesses the effectiveness of the care provided by publicly-funded services. We have to share information from your patient record such as referrals, assessments, diagnoses, activities (e.g. taking a blood pressure test) and in some cases, your answers to questionnaires on a regular basis to meet our NHS contract obligations.
You have the right to object to us sharing your information to NHS Digital – this will not affect your care in any way. For information about how you can opt-out of sharing your data with NHS Digital please click on this link.
You have certain rights over your personal information. These include the right to access a copy of your personal information or have some elements of it transmitted to you or another health provider in a common electronic format. In certain circumstances you can have your personal information corrected or erased, or you can restrict our use of it. You also have the right to object to the way we use your personal information as described above.
We generally won’t charge you to exercise these rights. You have the following rights:
You have a right to ask UCLH if we have your personal information. If we do, you have a right to know:
- why we have it
- what type of information we possess
- whether we have or will send it to others, especially outside the European Economic Area
- how long we will keep it
- where we got it from
- details of any automated decision-making
If you want, you can ask for a copy of your information.
Where any of your information is incorrect, you have a right to tell us to correct it promptly. Please tell us as quickly as possible if you change your address or other contact details. If your information is incomplete, you can ask us to correct this too.
In certain circumstances, you’ll have the following extra rights:
Right to object
Depending on the legal basis on which we are using your information, you may be entitled to object.
Erasure (right to be forgotten)
You may have a right to have some or all of the information we hold about you deleted. However you should be aware that, as a NHS trust, we are required to retain many records even after you close your file.
In certain circumstances you are may be entitled to receive some of your information from us electronically. We can either pass the information to you or to another person or organisation if you want.
You might also be entitled to ask us to restrict our use of your information — for example, if you think the information we hold on you is incorrect.
If you consent to us using your information, you have the right to withdraw that consent at any time.
You can do this by contacting the Data Rights team:
UCLH Archivist and Records Manager
2nd floor A, Maple House
149 Tottenham Court Road
We aim to work with you on any request, complaint or question you have about your personal information. However, if you believe we have not adequately resolved a matter, you have the right, at any time, to complain to the Information Commissioner’s Officer (ICO).
As an independent UK authority, the ICO upholds information rights in the public interest, promotes openness by public bodies and data privacy for individuals. You can visit their website at https:/
We use a number of different cookies on our site. If you do not know what cookies are, or how to control or delete them, then we recommend you visit http://
The list below describes the types of cookies we use on this site. Currently we operate an ‘implied consent’ policy which means that we assume you are happy with this usage. If you are not happy, then you should either not use this site, delete the cookies having visited the site, or you should browse the site using your browser’s anonymous usage setting (called “Incognito” in Chrome, “InPrivate” for Internet Explorer, “Private Browsing” in Firefox and Safari etc.)
You can find out more about Google’s position on privacy as regards its analytics service at http://
Third Party Cookies
These are cookies set on your machine by external websites whose services are used on this site. Cookies of this type are the sharing buttons across the site allow visitors to share content onto social networks. Cookies are currently set by LinkedIn, Twitter, Facebook, Instagram and YouTube. In order to implement these buttons, and connect them to the relevant social networks and external sites, there are scripts from domains outside of our website. You should be aware that these sites are likely to be collecting information about what you are doing all around the internet, including on this website.
You should check the respective policies of each of these sites to see how exactly they use your information and to find out how to opt out, or delete, such information.
Third party content and linking to other websites
Following a link to another website
These policies will explain how they collect and use your personal information, and whether they pass this on to websites they link you to.
Third party website content