Guidance

Change NHS online portal: privacy notice

Updated 18 November 2024

Applies to England

Privacy notice

Summary of initiative

The Secretary of State for Health and Social Care has initiated an extensive engagement exercise to help develop a 10 Year Health Plan that will reform the NHS and make a health service fit for the future in England.

The Department of Health and Social Care (DHSC) is working with an external supplier, Thinks Insight and Strategy, to launch an online survey portal under the name ‘Change NHS: a health service fit for the future’. This portal is hosted via GoVocal, a contracted supplier of Thinks Insight and Strategy. The portal consists of surveys to collect the views, ideas and experiences from the public and health and care staff on health care in England.

There will also be a series of ‘deliberative events’ as part of this engagement. The separate privacy notice for this is available on the Change NHS: help build a health service fit for the future page.

Data controller

DHSC is the data controller.

What personal data we collect

The online portal will ask you to register using your name and email address.

On completing the first survey, you have the option of sharing information about yourself including:

• age
• sex
• gender
• postcode
• region where you live
• ethnicity
• nationality
• whether you have a long term health condition
• health services accessed in the last 12 months

Those who work in the NHS will also have the option to share:

• their role
• type of organisation they work for
• length of time working in their role

Individuals can provide personal experiences of using and, for staff, working in health and care. Individuals may volunteer to share information that relates to individual physical or mental health conditions, and information relating to sexual orientation. Individuals will be asked to ensure that the responses they submit to the portal questions do not contain any identifiable personal data.

As part of using the GoVocal platform, if you provide permission by accepting cookies on the platform, they and their third party processors acting on their behalf collect information about the usage of the platform to assess its proper functioning and security. As a result, GoVocal may collect technical information about you such as your internet protocal (IP) address and browser details. GoVocal may also gather usage data to improve its services. You can opt out of this collection at all times in your cookie settings.

How we use your data (purposes)

Data collected via the online portal provided by GoVocal will be thematically analysed by Thinks Insight and Strategy and Yonder Data Solutions, with the purpose of informing the 10 Year Health Plan.

All data taken from the portal will be anonymised before it is shared with Yonder Data Solutions, DHSC and NHS England. This means that your personal data will be removed, and you will no longer be identifiable. This data can be used to provide broad analyses of the findings. Anonymised data may be published as part of the final engagement report and used to inform future policy development in DHSC and NHS England.

Your username will be visible for any contributions you make to the activity ‘Your ideas for change’, alongside your name if you choose to enter this. This personal data will not be included when data is taken from the portal but your username and name, if entered, will remain visible on the portal for any ideas you choose to submit.

Legal basis for processing personal data

Under Article 6 of the United Kingdom General Data Protection Regulation (UK GDPR), the lawful basis we rely on for processing personal data is: (e) the processing is necessary to perform a task or function in the public interest or for our official functions and the task or function has a clear basis in law.

This is in line with the Secretary of State’s duties in relation to the promotion and provision of the health service in England (including public health functions), and the improvement in the quality of services, as outlined in part 1 of the NHS Act 2006 (as amended by the Health and Social Care Act 2012).

It is necessary for DHSC and NHS to consult views from members of the public and those that work in the NHS about the future of it. The data involved covers Article 9 (special categories of data) and under part 1 Schedule 1 of the Data Protection Act 2018 number 4(c).

In addition, we are also processing special category data under the following conditions as per Article 9 of the UK GDPR:

• (g) reasons of substantial public interest (with a basis in law)

• (h) health or social care (with a basis in law)

• (j) archiving, research and statistics (with a basis in law)

Data processors and other recipients of personal data

DHSC has commissioned an external supplier, Thinks Insight and Strategy, to help run the engagement for the 10 Year Health Plan. The portal is hosted through an online platform, GoVocal, which is a contracted supplier of Thinks Insight and Strategy. See GoVocal’s privacy notice.

Yonder Data Solutions will be responsible for thematically analysing and coding the open text questions on the portal, who are a contracted supplier of Thinks Insight and Strategy.

DHSC will share data collected from the portal with NHS England to inform policy development.

International data transfers and storage locations

Information will be processed and stored in the UK and EU.

Retention and disposal policy

Personal information will be deleted 12 months after the portal closes. All data will be anonymised before it is shared with DHSC and NHS England to inform future policy development.

How we keep your data secure

Personal data will be securely stored by Thinks Insight and Strategy and GoVocal. Anonymised data that has been processed by Thinks Insight and Strategy and Yonder Data Solutions will be securely kept by DHSC and NHS England.

Your rights as a data subject

By law, data subjects have a number of rights, and this processing does not take away or reduce these rights under the EU General Data Protection Regulation (2016/679) and the UK Data Protection Act 2018 applies.

These rights are:

• the right to get copies of information - individuals have the right to ask for a copy of any information about them that is used

• the right to get information corrected - individuals have the right to ask for any information held about them that they think is inaccurate to be corrected

• the right to limit how the information is used - individuals have the right to ask for any of the information held about them to be restricted - for example, if they think inaccurate information is being used

• the right to object to the information being used - individuals can ask for any information held about them to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case

• the right to get information deleted - this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case

Comments or complaints

Anyone unhappy or wishing to complain about how personal data is used as part of this programme should contact data_protection@dhsc.gov.uk in the first instance or write to:

Data Protection Officer
1st Floor North
39 Victoria Street
London
SW1H 0EU

Anyone who is still not satisfied can complain to the Information Commissioner’s Office. Their postal address is:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Automated decision making or profiling

No decision will be made about individuals solely based on automated decision making (where a decision is taken about them using an electronic system without human involvement) which has a significant impact on them.

Changes to this privacy notice

This privacy notice is kept under regular review. This privacy notice was last updated on 18 November 2024.