Guidance

[Withdrawn] Elective care: COVID-19 self-test for patients

Updated 8 March 2022

This guidance was withdrawn on 17 May 2022

This guidance is out of date. Read about the changes to testing for coronavirus (COVID-19) in England.

Applies to England

Ownership of the personal data

To enable the COVID-19 testing to be completed, NHS trusts that use the Elective Care COVID-19 Home Testing Service (ECCHTS) need to process your personal data, including the sharing of your personal data where this is allowed under data protection legislation. NHS trusts are the data controllers for the data required, for the ordering of tests kits and implementing local arrangements based on a patient’s test result.

We will process personal data relating to users, under article 6.1(e) of the UK GDPR - which is that the processing of your personal data is necessary for the performance of a public task carried out in the public interest. We will also process special category personal data under the provisions of article 9.2(i) of the UK GDPR, and part 1 of Schedule 1(3) of DPA 2018 where it is in the public interest, on public health grounds to ensure we can minimise the spread of COVID-19 in a timely manner and enable us to continue to deliver services as safely and securely as possible.

Ownership of the personal data shared with DHSC

The Department of Health and Social Care (DHSC) is the data controller for the information that the NHS trusts provide to them, when we order a test kit, to be delivered to your home. For more information about what the DHSC does with your personal data, please see their privacy notice.

The NHS trusts and independent health provider organisations who order test kits for patients remain the data controllers for the data they retain about you, such as for ordering your test kits, and implementing local arrangements based on your (patient) test result. You can read the NHS trust’s privacy notice on their website or you can request a copy to be sent to you. This will help you to understand how your personal data is used prior to taking a test.

Test kit log

The following personal data is collected by the NHS trust and the independent health provider organisations, that has organised a test on your behalf:

• date of procedure
• first name
• last name
• date of birth
• gender
• NHS number
• address
• mobile phone number
• test result

For this test kit log, the NHS trust is acting as a ‘processor’ for the DHSC, and this information will not be shared with DHSC.

How we store your personal information

NHS trusts and independent health provider organisations will maintain the test kit log, which would contain your personal details (outlined above). This information will only be stored securely on locally managed systems with appropriate access controls implemented by your NHS trust, and will only be accessible to personnel involved in the management of tests and implementing local arrangements based on the test result.

The NHS trusts and independent health provider organisations shall not keep the personal data contained in the test kit log for longer than 12 months from the date on which it is collected.

DHSC will retain information your personal data pertaining to your test results for up to 8 years.

Processing of personal data relating to test results

NHS trusts and independent health provider organisations will use test result information to enact its own COVID-19 control processes whilst ensuring respect to personal privacy in line with our data protection responsibilities. Please contact your NHS trust if you wish to make a request.

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to your NHS trust, addressing it to the office for data protection queries.

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113