Privacy Notice for person accessing this service – Protecting & Using Your Information
Your privacy
At Clear Pharmacy we are committed to the highest privacy standards. During your CPVS consultation with our pharmacist, we will only collect data that is necessary for us to deliver the best possible service. This policy provides detailed information on why we collect your personal information as part of this service, how we use it and the very limited conditions under which we may disclose it to others. Personal information that is processed about you is governed by the Data Protection Act (DPA) 2018 and the UK General Data Protection Regulation (UK GDPR) 2018.
What is the Community Pharmacy Vaccination Service (CPVS)?
The CPVS allows a COVID-19 and/or flu vaccine and/or Men B vaccine to be administered free of charge at participating community pharmacies to eligible individuals. The CPVS provides vaccinations free of charge for people included in the national vaccination programmes set out by the Department of Health (DoH). The aim is to increase vaccine uptake by making the vaccine(s) more accessible through community pharmacy. In this way, it will help to protect you, your family and if applicable, your patients. As part of this service, personal information will be processed about you.
Why are you processing my personal information?
Your personal information will be processed to enable the provision of the CPVS. The pharmacy will process your personal data stored in the Vaccine Management System (VMS) under the DPA 2018. The Public Health Agency (PHA) is the Data Controller for the VMS. Your personal information is used for the following purposes: ID verification at the service, processing your vaccination, sharing vaccination details with your GP, sharing data with Business Service Organisation (BSO) to link vaccination to Health and Care Number (HCN) and follow up serious adverse incidents.
Information may be used by the PHA for analysis in health research, health protection and health promotion. Anonymised information may be used for reports and the production of official statistics.
Disease monitoring is a core public health function; therefore, it is important that we have the right information available to us at the right time to make the right healthcare decisions. This also helps us take effective actions across the public health system to help control the spread of disease.
Monitoring involves gathering a wide variety of anonymised data about a disease from a range of sources, to provide us with awareness on how effective a vaccine is. This is then used to inform public health action to help prevent and control disease.
Identifiable information provided by you, and collected about you, in relation to vaccination will be used to update your personal medical record.
What lawful basis applies to the processing of your personal data?
Your personal information will be processed according to the UK GDPR and the DPA 2018. Your data is processed as part of our public task (in line with GDPR Article 6(1)(e)) This refers to the processing that is necessary for the performance of the official tasks carried out in the public interest in providing and managing a health service. Some of the data processed relates to health data which is described as ‘special category data’. In relation to that processing, the following GDPR conditions apply:
- Article 9(2)(h) –processing is necessary for medical diagnosis, the provision of health treatment and management of a health and social care system
- Article 9(2)(i) –processing is necessary for reasons of public interest in the area of public health
- Article 9(2)(j) – processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes
As required by UK GDPR, Article 9(3), the following sections within the UK Data Protection Act 2018 are applicable:
- Data Protection Act 2019 Schedule 1, Part 1 (2) – Health or Social Care Purposes
- Data Protection Act 2018 – Schedule 1, Part 1 (3) – reasons of public interest in the area of public health
- Data Protection Act 2018 – Schedule 1, Part 1 (4) – necessary for archiving purposes, scientific or historical research purposes or statistical purposes
What categories of personal data are you processing?
The following data fields are recorded on the VMS when you receive a vaccination: your name, address, postcode, date of birth, Health and Care number, ethnicity, sex at birth, contact details, allergies.
The following will also need to be recorded on the VMS: answers to screening questions, date of vaccination, vaccine type administered, site of vaccination, vaccine expiry and batch number, dose, name of vaccinator, name of pharmacy where vaccination occurs.
For individuals employed as a health and social care worker additional information about organisation, professional group and job role will be collected. For young people and student’s additional information about which higher education or residential higher education institution is being attended may also be collected.
Where do you get my personal data from?
Much of the data we use will have been provided directly by you when you make or attend your vaccination appointment and from clinical data entered into the system at the time of your vaccination.
The VMS will receive data directly from:
- Information you provide when booking your appointment and when attending for your vaccination
- GP clinical and healthcare systems for accurate recording
Do you share my personal data with anyone else?
Yes. To help us provide the best care or service for you, we may need to share your information with:
- Other healthcare bodies and professionals, including GPs, hospitals and the PHA for the purposes of health protection.
- Anonymised information may also be shared with UK Health Security Agency (UKHSA) for the purposes of national disease monitoring.
- Anonymised information will be shared with the Department of Health (DoH) in Northern Ireland for the purposes of uptake monitoring.
- The Strategic Planning and Performance Group (SPPG) and BSO for the purposes of administering and managing health and social care services and to verify that the service has been delivered by the pharmacy, as part of post-payment verification.
How long do you keep my personal data?
This record will be retained in the pharmacy in line with the DoH retention policy identified in the document Good Management, Good Records – Disposal Schedule which, outlines the requirements for retention and disposal of community pharmacy held records.
Do you transfer my personal data to other countries?
Only in exceptional circumstances, e.g. where information needs to be shared with Public Health Agencies outside the UK for the purposes of disease surveillance and to protect the health of individuals and others potentially affected by an outbreak. Any transfers will be fully compliant with the UK GDPR and only when we have a legitimate basis for doing so.
What rights do I have?
- You have the right to obtain confirmation that your data is being processed, and access to your personal data.
- You are entitled to have personal data rectified if it is inaccurate or incomplete.
- You have a right to have personal data erased and to prevent processing, in specific circumstances.
- You have the right to ‘block’ or suppress processing of personal data, in specific circumstances.
- You have the right to data portability, in specific circumstances.
- You have the right to object to the processing, in specific circumstances.
- You have rights in relation toautomated decision making and profiling.
Further information on your rights is available at: ico.org.uk
How do I complain if I am not happy?
If you have any questions or concerns regarding your vaccination you can contact:
(insert name/contact details of relevant pharmacy staff member.)
If you have a concern regarding the Vaccine Management System and your privacy please contact the PHA Data Protection Officer DPO.PHA@hscni.net
Further information regarding the VMS and the associated privacy information can be found here.
If we cannot resolve your concerns you have the right to lodge a complaint with the Information Commissioners office:
The Information Commissioner’s Office – Northern Ireland
10th Floor
Causeway Tower
9 James Street South
Belfast
BT2 8DN
Telephone: 0303 123 1114
Email: ni@ico.org.uk
Review of this document
This document will be kept under review and updated as required; we reserve the right to make any changes and updates to this privacy policy without giving you notice as and when we need to. Our most up to date privacy policy is always available upon request.