Guidance

Testing for coronavirus: privacy information

Updated 29 January 2024

This guidance was withdrawn on 8 March 2024

This content is now available at COVID-19: guidance and support.

Applies to England

Introduction

The government has rolled out a coronavirus (COVID-19) testing programme and you have chosen to book a home test or a test at a regional test site.

You can get a PCR test online.

If you have difficulties accessing the online system, you can register for a test by calling 119 (free from mobiles and landlines).

The test will confirm whether you currently have COVID-19. This is so that you can:

• take the right steps to look after yourself
• protect others
• know if you’re fit and well to return to work

Any test you take that is covered by the NHS Test and Trace service should not be used for purposes of international travel. You can purchase a private test if required. This is to ensure that those requiring a test have access to one.

If there is reasonable evidence that you contracted COVID-19 from an occupational exposure, your employer is obliged to report this to the Health and Safety Executive, as required by the Reporting of Injuries, Diseases and Dangerous Occurrences Regulations 2013 (RIDDOR).

There are different types of test you can take. These tests can be self-administered (that is, carried out by yourself), or staff-administered (that is, carried out by a member of staff), depending on the test chosen. As part of the test, you may also be sent additional instructions about the site that you’re visiting. NHS staff may be invited to an NHS site, such as a hospital, where facilities are available.

You may receive a home testing kit if you and the people you live with are in an outbreak area. You will need to register the home testing kit online using the instructions provided.

The test is completely voluntary. You can cancel the test that you’ve booked if you no longer need it. If you do decide to take a test, then you need to follow the instructions provided. As part of the registration process, we will send you a confirmation email with the details of your order or booking. If you are attending a test site, it is necessary to bring this with you.

Please note that if you access our service using your NHS login details, the identity verification services are managed by NHS Digital. See NHS Digital’s privacy notice and terms and conditions. This restriction does not apply to the personal information you provide to us separately.

Once you have taken the test, your sample will be analysed in a laboratory and you will be informed of the result (positive, negative or unclear) by text and/or email. You will be given advice on any next steps that you should take following your result.

If you live in England, your data will be sent to NHS Digital, who will now send your personal data to the UK Health Security Agency (UKHSA) and to the Test and Trace data analysis platform within the Department of Health and Social Care (DHSC) – as well as to a central database held by NHSX and controlled by NHS England. All personal information in these databases is held securely and access to your personal information is tightly governed, in line with data protection requirements.

For residents in Wales, Scotland and Northern Ireland, the public health authorities for these devolved nations have requested that NHS Digital collates your test results on their behalf, so these results can be sent to the relevant health authorities in these devolved nations to aid their response to COVID-19.

For more detailed information regarding the testing programme, go to Testing for coronavirus (COVID-19) on NHS.UK.

Data controller

On 1 October 2021, UKHSA came into being. UKHSA is an executive agency within DHSC and it combines many of the health protection activities previously undertaken by Public Health England (PHE) together with all of the activities of the NHS Test and Trace Programme and the Joint Biosecurity Centre (JBC). The processing activities and the data processors have not changed. Individual rights are not affected by this change.

DHSC has commissioned UKHSA on behalf of the UK government and DHSC will still be the data controller for the purposes of data protection legislation.

UKHSA is responsible for planning, preventing and responding to external health threats, and providing intellectual, scientific and operational leadership at national and local level, as well as on the global stage. UKHSA will ensure the nation can respond quickly and at greater scale to deal with pandemics and future threats.

Read more about what UKHSA does and read our general privacy notice.

DHSC is consulting and involving the Welsh, Scottish and Northern Irish governments, who may have their own testing processes specific to their area (along with country-specific information relating to COVID-19). Links to this information can be found in the Residents in Wales, Scotland and Northern Ireland section.

At different points in the process, other organisations including research organisations, may also be data controllers, depending on what they are doing with your personal information.

Other organisations will also carry out parts of the COVID-19 testing programme on behalf of DHSC but can only act on instructions provided to them by DHSC. These organisations are known as data processors. An example of such an organisation is Royal Mail Group, which will support necessary actions to deliver test kits to your home.

Each organisation will require a different level of information about you, but all will use only the minimum necessary information to attain the requisite objective as required to by the data controller.

See the data controllers and data processors section for a full list.

Data processors and other recipients of your data

Organisations that use your data and information, on behalf of a controller, can only do so with clear instructions from the controller. They cannot use your data and information for any other purpose (these organisations are called data processors). Any use of your personal information that is not covered by the instructions from the controller would be unlawful, unless the controller agrees and provides written permission to do this.

DHSC have appointed data processors to:

• register your test
• schedule appointments and capture information at the point of testing
• check your QR code on site
• check your identity as part of ordering a home test (this is not a credit check and does not affect your credit score)
• oversee the logistics of test kit deliveries
• link your personal details (provided on registering for the test) to the test result
• forward your test results, email address and phone number to NHS Business Services Authority to send you your test results
• receive data to enable your results and supporting information to be communicated back to you by text and email, along with supporting information
• ensure your test data is being processed properly

Services on behalf of DHSC may be provided by different organisations in different regions. A full list of data processors can be found in Annexe 8.

What personal data we collect

We collect the following data from you:

• full name (which included first and last name)
• date of birth
• other household members
• NHS number (for English residents only – only if you know it. Wales, Scotland and Northern Ireland residents may need to provide a different local identifier, which will be specified upon registering for a test)
• employer details
• test result status (whether positive more than 90 days ago),
• NHS Login account identifier (if you access our services using your NHS login details)
• vaccination status
• date and details of COVID-19 symptoms
• home and delivery address (including postcode)
• postcode district
• NHS number
• national insurance number
• phone numbers
• email address
• gender
• vehicle registration number (if booking a drive-in testing appointment)
• job title
• passenger journey details (for example, recent travel history – whether you travelled overseas in the last 14 days, and the country you spent most time in)
• health data (such as your test results)
• close contact details (for example, the name and contact details of people you have been in close contact with)
• data revealing racial or ethnic origin
• genetic data
• whether you are clinically vulnerable or require additional support

After your COVID-19 test, we will also collect and process your test results (positive, negative or unclear), so that we can inform you of your result and what steps you should take next.

The testing programme

There are a number of home test kit suppliers and their processes may vary slightly depending on which test kit you receive.

If you have registered for a home test, or have been sent one out because you’re in an outbreak area, then your name and address will be passed to our deliver provider, for example Royal Mail Group, which will deliver the testing kit.

The test kit will have a unique reference number. Once you have self-administered the test, you will need to follow the instructions on the test kit. Completed test kits will be collected by a courier or need to be posted via a priority post box and delivered to a laboratory for analysis.

If you have registered for an appointment at a regional test site, you will receive a QR code. This QR code will need to be scanned when you arrive at the site to check you in.

When you take the test, you will need to register the test kit barcode which has been assigned to you before returning it. Completed tests will then be sent to a laboratory for analysis.

The laboratory will analyse your test sample and provide your test result to the National Pathology Exchange (NPEx). The laboratory does not receive any of your personal data, only the specimen ID from the test kit from where the laboratory now attaches your test result to the specimen ID. NPEx will now link your registration record with your test result and pass this information on to NHS Business Services Authority, who will now inform you of your test result, by text and/or email.

NPEx will also:

• send results to NHS Digital, so they can collate data and information for each of the countries within the UK
• link the results to your GP records (for English residents only), by receiving your GP details from NHS Digital or UKHSA sending your results to your GP. Where NPEx can’t match the record, NHS Digital will try to. This will enable your GP to be informed of your test result without you needing to do anything

For Welsh, Scottish and Northern Irish residents, your results will be returned to Public Health Wales, NHS National Services Scotland and Northern Ireland public health bodies respectively, enabling them to respond to COVID-19.

Find out when to stay at home and what to do on NHS.UK.

After taking a COVID-19 test, and if you test positive:

• you may be contacted and invited by DHSC a few weeks after the date of your test result to be invited to take an antibody test. This test is also voluntary, and you do not have to take it. If you do decide to take an antibody test, you will be invited to register for a test that is similar to this one – please follow the instructions given to you when you register
• you may also be contacted by DHSC via email or text message to see if you wish to donate blood plasma as part of the potential treatment for coronavirus

If you test positive or negative, you may also be contacted by DHSC to see if you wish to contribute to the research effort of COVID-19. If you are interested in doing this, you need to follow the link in the text message.

Purposes for which your data will be used

DHSC is the data controller for the following purposes:

• confirming your appointment to take at test at the test site
• performing a QR code check at the test site
• receiving and processing your COVID-19 test
• returning your test results to you
• sharing your results with Welsh/Scottish/Northern Irish health bodies (if you live in that country) which would help to inform local planning and responses to COVID-19
• sharing results with UKHSA (if you live in England) to help plan and respond to COVID-19
• sharing your vaccination status with UKHSA (if you live in England) to understand the effectiveness of COVID-19 vaccines, including their effectiveness against different strains or variants of the COVID-19 virus and, where appropriate, to ask you to do a repeat test and/or an antibody test
• sharing your self-isolation status with your local authority (if you live in England) to verify any application you may have made for a self-isolation support payment
• sharing your COVID-19 test result with your local hospital, if you are booked in for elective surgery (via your Summary Care Record). This only applies if you have taken a test and you have a Summary Care Record
• sharing your results with NHS Digital to analyse data in relation to COVID-19 (if you live in England)
• undertaking quality assurance of the testing process (for example, clinical process assurance)
• instructing the data processors to share data for research purposes. The data processor will have appropriate data security to manage this data
• monitoring the flow of test data across the NHS Test and Trace systems to ensure that the tests being submitted to laboratories flow across approved systems and are processed in these systems as mandated (this is also known as test flow monitoring)
• for analysis to support operational decisions to improve the full end-to-end testing process such as:
  • day-to-day use (for example, whether someone attended their appointment)
  • to inform regional test sites of improvements to the testing process (for example, manage capacity or throughput)
  • supporting end-to-end logistics planning
• contacting you to invite you for a survey to better understand motivation and behaviours related to LFD results reporting

Your information used for other purposes

Your information may also be used for different purposes that are not directly related to your health and care. Wherever possible, this will be done using information that does not identify you (anonymous data). These include:

• research into COVID-19 (including potentially being invited to a research project)
• service evaluation of new COVID-19 diagnostic products
• planning of services or actions in response to COVID-19
• monitoring the progress and development of COVID-19
• validating new initiatives and use cases adequacy and appropriateness for pandemic management to COVID-19

Information provided by you, and collected about you, in relation to testing for COVID-19 will not be used for any purpose that is not linked to controlling the spread of COVID-19.

There may be times when it is necessary for your personal data to be used. Any release of information that could identify you will be lawful and at a minimum necessary for that purpose.

NHS Digital is required by law, by DHSC and NHS England, to collect, analyse and share information relating to COVID-19, only when this information is requested by other healthcare organisations or researchers. This information may be collected from various healthcare organisations and may be given to other healthcare and research organisations responding to and/or conducting research on COVID-19.

If you live in England or Wales, your permission is not always required for your personal data to be used to contact you or to ask if you wish to participate in health research. For example, the law permits this to happen where it is approved by the Secretary of State or the Health Research Authority so that approved medical research can take place. You may therefore still be invited to participate in COVID-19 vaccine studies without your permission where the law allows this, but this does not mean that you have to participate.

If you live in Northern Ireland, Scotland or Wales you can find links to this information in the Residents in Wales, Scotland and Northern Ireland section.

Legal basis under UK GDPR and Data Protection Act 2018

DHSC’s legal basis for processing your personal data is:

• GDPR Article 6(1)(e) – the processing is necessary for the performance of its official tasks carried out in the public interest in providing and managing a health service
• GDPR Article 9(2)(h) – the processing is necessary for the management of health/social care systems or services
• GDPR Article 9(2)(i) – the processing is necessary for reasons of public interest in the area of public health
• Data Protection Act 2018 – Schedule 1, Part 1, (2) (2) (f) – health or social care purposes

Other organisations involved in processing your data will be doing so either with an agreement in place with DHSC to provide that service, or with a legal basis of their own (such as NHS Digital).

Your rights as a data subject

UK GDPR

By law, you have a number of rights as a data subject and this testing programme does not take away or reduce these rights.

These rights are:

• your right to get copies of your information – you have the right to ask for a copy of any information about you that is used
• your right to get your information corrected – you have the right to ask for any information held about you that you think is inaccurate to be corrected
• your right to limit how your information is used – you have the right to ask for any of the information held about you to be restricted, for example, if you think inaccurate information is being used
• your right to object to your information being used – you can ask for any information held about you to not be used. However, this is not an absolute right and we may need to continue using your information. We will tell you if this is the case
• your right to get information deleted – this is not an absolute right and we may need to continue to use your information. We will tell you if this is the case

If you’re unhappy or wish to complain about how your personal data is used as part of this programme, you should contact DHSC in the first instance to resolve your issue. DHSC may have to work with partner organisations to resolve your complaint (for example, if you have a complaint about Randox test kits, then DHSC would work with Randox to resolve this).

If you’re still not satisfied, you can complain to the Information Commissioner’s Office.

Retention and storage of your data

We will retain your personal data for up to 8 years, in accordance with the Records Management Code of Practice for Health and Social Care 2021, but will dispose of your data sooner if it’s appropriate to do so. For Welsh, Scottish and Northern Ireland residents, please see Residents living in Wales, Scotland or Northern Ireland for country-specific information on retention of records.

Information that identifies you will be stored securely and processed in the UK. Information that does not, and cannot, identify you may be stored and processed outside of the UK (for example, information purely about the number of tests conducted or the number of outcomes from tests).

Data Protection Officer

The Data Protection Officer for DHSC is Lee Cramp, who can be contacted by sending an email to data_protection@dhsc.gov.uk

List of data controllers and data processors

Data controllers for the testing programme are:

• DHSC
• NHS England – who manages the central database where results go to, enabling organisations to respond to COVID-19
• NHS Digital – for:
  • giving NPEx access to your NHS number and your registered GP details (from NHS Digital’s Personal Demographics Service) so that your test result can be sent to your GP
  • sending information on residents of Wales, Scotland and Northern Ireland, to Public Health Wales, NHS National Services Scotland and Northern Ireland public health bodies (respectively), who have requested NHS Digital to process information relating to their resident population for COVID-19
  • managing the ‘Ask for a coronavirus test service’ on the NHS.UK website for test booking for members of the public
  • linking your result to your GP record if NPEx cannot match details with confidence
• NHS Digital is the controller for any personal information you provided to NHS Digital to get an NHS login account and verify your identity and uses that personal information solely for that single purpose. For this personal information, DHSC’s role is a ‘processor’ only and we must act under the instructions provided by NHS Digital (as the ‘controller’) when verifying your identity
• UKHSA – when they receive results and use them to plan their response to COVID-19 and for contact tracing
• research organisations – when receiving data to carry out research with relation to COVID-19

A full list of data processors for the testing programme can be found in Annexe 8.

International data transfers

Personal data may be shared with the World Health Organization (WHO) as part of an international co-ordinated response to the COVID-19 pandemic. These transfers of personal data are made under Article 49(1)(d) of the UK General Data Protection Regulation – where we need to make the restricted transfer for important reasons of public interest.

For some COVID-19 and vaccine trials, personal information that would not identify you is sent to other data controllers in the US, who would process this information to meet purposes as set out in this privacy notice. With these data controllers, we have agreements in place that adhere to the ICO’s Data Sharing Code of Practice, which ensures that your data is secured and that these transfers are made under Article 46(2)(c) of the UK General Data Protection Regulation – where we need to make the restricted transfer for important reasons of public interest.

A complete list of recipients of your personal data is captured in Annexe 8 of this privacy notice.

Security

We use appropriate technical, organisational and administrative security measures to protect any information. This is overseen by our Chief Information Security Officer. We have written procedures and policies which are regularly audited, and the audits are reviewed at senior level within the DHSC, and also externally audited by third party assurance providers, and sometimes by the regulator (the Information Commissioner’s Office).

Automated decision making or profiling

DHSC considers that any automated decision making is authorised by law, specifically section 2A of the NHS Act (2006) which permits the Secretary of State to take such steps as he considers appropriate for the purpose of protecting public health.

Changes to this policy

We keep our privacy notice under regular review, and we will make new versions available on our privacy notice page on GOV.UK.

Residents living in Wales, Scotland or Northern Ireland

If you live in Wales, Scotland or Northern Ireland, further information about how your government will use your information (which is specific to each country) can be found here:

• Wales
• Scotland
• Northern Ireland

Annexe 1: care home testing

There are no nationally set direct restrictions on visiting in care homes.

As the government has increased the capacity to test the population, testing is also being rolled out at care homes and similar places of residence, such as:

• residential homes
• nursing homes
• hospices – including hospice at home services
• children’s homes managed by a local authority

The list is not exhaustive, and the term ‘home’ is used here to represent these types of residence.

Residents – how we use your data

The term ‘resident’ is used to mean any person whose normal place of residence is one of the types of homes listed above (or similar).

All residents are eligible for a test, whether you’re showing symptoms of COVID-19 or not. This test may be conducted in one of the following ways:

• the manager of the home will register on GOV.UK via a unique care home portal for the number of home test kits they need for their residents and staff, then register each person individually (so the test kit number can be linked to your details). The staff of the home will administer the tests and they will be collected by courier from the home and sent for analysis
• the home will be visited by a testing unit that can test all residents and staff present on the day

The test is voluntary, and you do not have to take it.

For residents unable to give their details because they do not have mental capacity, the manager can provide these details to the mobile testing unit. Only relevant personal details will be provided.

If a testing unit visits your home, they will provide you with instructions and assistance in taking the test, and test kits provided to your home will come with instructions for the staff in how to administer the test.

Once the test has been taken, your sample will be sent off for analysis, and the result will be sent back to you and/or the manager. This is because the manager will need to take action if you test positive, such as moving you to a different part of the home to reduce the risk of spreading the infection to other residents or staff.

If someone has been legally appointed to manage your affairs (such as someone with Power of Attorney status for you), they will also be informed of the result (although this does not apply for Power of Attorneys who have been appointed to manage your financial affairs only).

If you’re a resident in England, your result will also be sent to your GP so they are aware and can plan what care you need. See full guidance on care home visiting.

Staff – how we use your data

You’re also eligible for a test. Taking a test is voluntary, but we strongly encourage you to take a test for the reasons outlined above.

Tests will be conducted in the same way, so if you’re working on the day a testing unit is on site, you can take a test. If they visit on a day when you are not working, the manager can book a home test for you. The kit will be delivered to the home. You can also self-register for a test.

The test will be taken as outlined above. However, when the manager registers you for a test, they will either:

• ask you to input your email address and mobile phone number, so results go directly to you
• input your email address and mobile phone number from your staff record, and ask you to check they are accurate

This is to ensure your test result is sent to you, rather than the manager.

The manager must not input home contact details (as they might for residents) for staff members. You will receive a code to enter into the booking system to verify your contact details.

If you test positive for COVID-19, then you must inform your employer, both for your own personal care and support (as you will need to self-isolate) and for the manager to be able to manage the home provision. You do not need to inform your employer of a negative test.

If you live in England, your result will also be sent to your GP to update your medical records.

Essential care givers and visitors

Essential care givers and visitors will need to follow the same testing arrangements as staff for both regular asymptomatic testing and in an outbreak. Personal data collected will be processed in the same manner as staff stated above. Further information on staff testing regimes can be found in the care home testing guidance. For residents of other devolved nations, please follow the link for each devolved nation above.

Annexe 2: self-testing and reporting

Self-testing and reporting may be used in either symptomatic or asymptomatic populations. This allows the test subject to register their details along with the test kit ID number, and report on their result. This testing model will be used for testing within such places as care homes, NHS staff and key workers (or other settings to which self-testing and self-reporting adoption has been deemed appropriate).

The individual taking the test and their role in the test process will be captured (for example, resident, staff or visitor). The individual self asserts their results directly on the portal, and from a technology and privacy perspective, there is nothing additional to the data collected to existing Registration Lite services.

The only data point captured in this service that is not asked for in Registration Lite is the self-asserted result (positive, negative or invalid).

To satisfy Medicines and Healthcare products Regulatory Agency (MHRA) requirements we will require the test site to collect the first name, surname and contact telephone number of the test participants who have collected the self-test kits from an authorised location. This is so we can have end-user traceability in order to fulfil our regulatory requirement to MHRA in the event of a batch recall, or adverse incidents investigation, or issuing of a field safety notice. We will capture this data only for tracing the individual.

As part of the self-testing and self-reporting journey in capturing a test subjects LFD result, and reporting the results to UKHSA, we have an option through which a test subject result on the LFD device can be read digitally via the test subject’s device camera being used to submit their self-test result (for example a mobile phone). We also provide to you, other options via the result submission journey, where you can manually input your results.

This digital LFD reader is able to determine what a test subject result is and submit this result on behalf of the test subject to UKHSA. When you choose this option, Article 22 of the UK GDPR is triggered, which is the existence of automated decision making. This essentially means that our reader is able to read your LFD device, and automatically present a result to you and to the Test and Trace service without human intervention. Processing of your personal data is authorised by the COPI Notices, which legitimises such processing activities within UKHSA.

There are slight changes to data flows and the front-end data capture (the same infrastructure is used for this, as that is also used for most of the collection of your data and the registration of your test results). This means that your test results flow down into the various downstream systems already in use. However, data will not flow down into GP records.

Data will flow down into our analytical systems, to be accessed by our internal teams for UKHSA reporting purposes, and data will go to our confirmatory communication provider, who will now send an SMS or email to you with your test result.

Annexe 3: cohort pooling

Cohort pooling presents a major opportunity for the UK National Testing Programme as it can significantly increase testing capacity with minimal additional capital investment or disruption to existing lab processes, while simultaneously reducing reagent consumption per test.

Sample pooling is a method which can be applied to testing processes to increase throughput.

Pooling involves aggregating multiple individual samples into a single pool which is tested using the same RT-PCR methodology.

An RT-PCR, also known as a real-time polymerase chain reaction, is a laboratory technique of molecular biology based on the polymerase chain reaction. It monitors the amplification of a targeted DNA molecule during the PCR, not at its end, as in conventional PCR.

A negative result indicates that all samples in the pool are negative. A positive result indicates that one or more samples in the pool are positive. Subsequent testing, informed by policy decisions, can then be used to attribute individual results. Those with a positive test result will be contacted and advised to take an individual test.

While cohort pooling returns a single result for the entire cohort, instead of individual results for each subject within the cohort or pool, there are several use cases that have been identified for which cohort pooling would be a valuable diagnostic tool.

All pooling methodologies, including cohort pooling, offer greater efficiency than individual testing for populations with a low prevalence rate (1 to 5%). For populations with a higher prevalence rate (>5%), the need to retest to identify positive samples within pools reduces the efficiency gained.

Annexe 4: lateral flow testing

Lateral flow testing may be used in either symptomatic or asymptomatic populations who are at risk of COVID-19 infection. It is used to ease service demand on labs and to produce results rapidly (within 15 to 20 minutes), for timely reporting and for early detection, isolation and contact tracing of data subjects who might be infected by COVID-19.

Lateral flow immunochromatographic assays, known as lateral flow devices, are intended for the qualitative detection of nucleocapsid antigens from SARS-CoV-2 in human nasal swabs, throat swabs, or saliva samples.

Once you have taken the test, your sample will be analysed at the site and you will be informed of the result (positive, negative or unclear). An app will allow for result communication through existing data flows. You will be advised on any next steps that you should take following your result.

Negative results do not rule out possible infection and should be considered in the context of a patient’s recent exposures, history and the presence of clinical signs and symptoms consistent with COVID-19, and confirmed with a PCR test, if necessary, for patient management. The way your data is used and managed is the same as the PCR test outlined in the overarching privacy notice.

As part of submitting your test results, we’ve created software as a medical device reader, which is able to read your LFT device results and determine whether it is a positive, negative or void result. The software reports the result to our back-end systems, where all the activities of NHS Test and Trace services are done.

The intention of this project is not to collect any personal data when individuals are asked to take images of their test barcodes.

In the very rare instance where personal data may be accidentally submitted by individuals, as part of taking images of test barcodes, there will be further processing of the image. However, any additional information included in the image cannot be removed without deletion of the image itself and so will remain in the image.

Annexe 5: international arrivals

Test on Arrival scheme

If you’re travelling to England from abroad, you may need proof of a negative COVID-19 test in order to enter the country. If you qualify as fully vaccinated for travel to England, you do not need to take a test before travel.

If you do not qualify as fully vaccinated, you must take a COVID-19 test before you travel to England from abroad. You must take the test in the 2 days before your service to England departs. You must also book and pay for a COVID-19 PCR test to be taken after you arrive in England.

You’ll need to book for such testing before you arrive in the UK.

More information on how to book such tests:

• before you travel to England
• after you’ve arrived in England

More information about how the devolved nations process your personal information can be found in the privacy notice above.

The personal information that you’ve provided to your testing provider is shared with UKHSA for purposes outlined in the Purposes for which your data will be used section of this privacy notice.

UKHSA may need to process your personal information for fraud prevention, detection and investigation purposes. This would include whether the test was booked online or taken by assisted digital means. This processing of your personal information exempts all medical data, and we may share your personal information with law enforcement authorities where legally required. UKHSA would not need to have access to your test results, but we will need to have access to information that a test has been taken and completed.

Test to Release scheme

The Test to Release scheme ended on 11 February 2022. People no longer need to quarantine after they arrive in England.

What you must do depends on whether you qualify as fully vaccinated under the rules for travel to England. More information is available in the Test on Arrival scheme section in this privacy notice.

Annexe 6: genomic sequencing

As part of the COVID-19 testing programme, there is a need to be more targeted in the samples we sequence to ensure we are supporting the identification and management of variants of concern.

The current process in place at DHSC for identifying subjects of interest occurs late in the end-to-end process. This means that samples that should be prioritised for sequencing are discarded before being identified. In addition, many samples of interest are processed in Lighthouse Laboratories that do not have an established process to forward these samples for genomic sequencing.

Currently, UKHSA is sequencing approximately 25% of potential prioritised samples. So, during registration we will ask you to provide us with information so that we can identify whether you are a ‘subject of interest’.

Annexe 7: Direct LAMP Testing within the Test and Trace Programme

Direct LAMP is a laboratory-based testing technology which compliments a package of test types, such as LFD and PCR, used for COVID-19 testing.

Direct LAMP is supporting asymptomatic staff testing in some NHS trusts. The laboratories involved in direct LAMP process test results using a digital processing system and submit this data to UKHSA through their lab LIMS (Laboratory Information Management System).

In summary, your data is submitted by you, on registration, through the portal established by the laboratory contracted by your trust to process your direct LAMP test. The lab then submits this UKHSA infrastructure via UKHSA’s Second Generation Surveillance System (SGSS) database. Once the data enters the infrastructure, it will follow the already established procedures used by the wider UKHSA, and the data will be subject to processing by third parties, as standard practice. Your data is used to update your GP medical record and for the purposes set out in the privacy notice, of which this forms an annexe.

Annexe 8: list of personal data recipients

Each organisation that processes your information must provide you with information about how they do this, and this information will be limited to their role in the test programme. This should be publicly available on their website or can be requested from them. For example, if you want to know more about how NHS Digital uses your information, then you can visit their website.

Data processors can only act upon written instruction from a data controller, they cannot use data and information without permission of the data controller.

Name	Services they provide
ACF Technologies	Providing software to enable you to book a test at a regional test site
Amazon Web Services (AWS)	Providing digital solution for ordering home test kits
AstraZeneca (Laboratory)	Analysing sample from the completed test kits and sharing results with NPEx
Barcode Warehouse	Providing bar codes for test kits
Boots	Providing testers and test supervisors on regional test sites
Charitable organisations	Where used by local authorities, delivering specific support requirements to enable you to self-isolate
Courier 1 (DHL)	Distribution, storage, packing and transport of test kits
Courier 2 (Royal Mail Group)	Collecting completed test kits from homes and delivering them to labs
Courier 3 (Kuenhe + Nagel)	Distribution, storage, packing and transport of test kits
Deloitte	Sending test invitation text messages to referred employees, hosts and maintaining the digital platform that the test tracking system sits on, managing the registration and appointment booking, providing the capability for users to enter sample bar codes, responsible for holding data captured by the registration system and making it available to the NHS
EMIS Health	Providing Keystone product to enable NPEx to link your test result to your GP record
Experience Lab	Providing user or market research for people who have undertaken tests
G4S	Providing facilities management for some regional test sites
Gov.notify	Providing SMS message to you on days 0,2 and 8 of your international arrival. Day 0 informs you of the number to expect the 2-way SMS exchange required for testing confirmation messages on day 2 and day 8.
Gov.pay	Providing payment services to allow UKHSA to accept a wide range of payment methods for travel test kits
Jigsaw24	Providing mobile phones and SIMs for the mobile test units apps
Kainos	Developing and maintaining the NHS UKHSA travel test booking platform, the home ordering service for test kits, the test results service and assisted lateral flow device service
Laboratory 1 (Milton Keynes)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 2 (Alderley Edge)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 3 (Glasgow)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 4 (Cambridge – run by AstraZeneca)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 5 (HSL & UCL)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 6 (Imperial College London)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 7 (Charnwood Lighthouse Laboratory)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 8 (Newport)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 9 (Integrated COVID Hub North East)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 10 (BSPS)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 11 (Queen Mary’s University, London)	Analysing sample from the completed test kit and sharing results with NPEx
Laboratory 12 (Plymouth Lighthouse Laboratory – UHP)	Analysing sample from the completed test kit and sharing results with NPEx
Levy	Providing facilities management for some regional test sites
Ministry of Defence/Armed Forces	Providing mobile test units, providing testing staff at some regional test sites
National Pathology Exchange (NPEx) – hosted by Calderdale and Huddersfield NHS Trust	Receiving results from labs and linking results to test registration, flowing results data to NHS Business Services Authority, flowing results data to NHS Digital, flowing results to your GP via the Keystone product
NHS Business Services Authority	Reporting non-Randox results back to the individual who has taken the test, collating results and sending country-specific data to the 4 home countries
NHS Digital	Managing the ‘Ask for a coronavirus test’ section of the NHS.UK website (for members of the public booking tests)
NHS England	Receiving results data from NPEx (via Arden and Greater East Midlands Commissioning Support Unit, part of NHS England, who strip out any identifiable data from it), to include in the NHS Data Store (called Foundry)
Novavax inc (based in the US)	For the conduct of scientific research in a vaccine study
Office of National Statistics (ONS)	Research and analytics for monitoring of COVID-19
Palantir	Analysis of anonymised data
PCI-PAL	Providing payment services to allow UKHSA to accept a wide range of payment methods for travel test kits
PPD Global Limited (based in the US)	For the conduct of scientific research in a vaccine study
UK Health Security Agency (UKSHA)	Analysis of results data for monitoring of COVID-19
Public Health Scotland	Analysis of results data for monitoring of COVID-19
Public Health Wales	Analysis of results data for monitoring of COVID-19
Public Health Agency (Northern Ireland)	Analysis of results data for monitoring of COVID-19
Randox	Supplying home test kits, analysing the samples, informing you of the result of your Randox home test
Serco	Providing facilities management for some regional test sites
Royal Mail	Providing logistics for home delivery of test kits, collecting completed test kits from homes and delivering them to labs
ServerLabs	Building the digital solution
Sodexo	Providing testers on regional test sites, providing facilities management for some regional test sites
Splunk Inc	Providing software to monitor your test data across the Test and Trace systems
Teleperformance	Providing call centre assistance
TransUnion	Providing identity verification checks as part of the registration process for a home test kit (this is not a credit check and will not affect your credit score)
Qualtrics	Online survey service provider for the Test and Trace programme