Guidance

COVID-19 testing: terms and conditions

Updated 29 January 2024

This guidance was withdrawn on 8 March 2024

This content is now available at COVID-19: guidance and support.

The Secretary of State for Health and Social Care of 39 Victoria Street, Westminster, London, SW1H 0EU, United Kingdom (“DHSC”) and social care providers in the United Kingdom are seeking to collaborate to combat the SARS-CoV2-19 (“COVID-19”) pandemic.

In these terms and conditions (the “T&Cs”), “Provider” means the social care provider to which the T&Cs have been provided to. DHSC and the Provider have agreed that DHSC will support the Provider to carry out and facilitate COVID-19 testing of individuals associated with the Provider, including the Provider’s staff, service users or visitors (and including visiting professionals who are not part of a regular testing programme) (“Test Subjects”).

The key objective of the Testing (as defined below) is to ensure the ongoing safety of the entire social care community. The Testing has the additional objective of seeking to ascertain how access to testing can support Test Subjects’ wellbeing alongside wider infection, prevention, and control measures, and feed into a holistic risk-based approach. Commencement of the Testing (including the ordering of DHSC Supplies) by the Provider is deemed as acceptance of the T&Cs.

For the purpose of Decision 2012/21/EU of the European Commission of 20 December 2011, the T&Cs entrusts the Provider with the performance of public service obligations, which are set out in the T&Cs. DHSC and the Provider have agreed to proceed with the Testing upon and subject to the following terms.

1. Term

1.1 The agreement between the parties under the T&Cs will begin on commencement of the supply by DHSC of DHSC Supplies (as defined below) and/or Testing under the T&Cs (whichever is earlier) (“Commencement Date”).

1.2 The agreement shall continue from the Commencement Date for as long as the Provider continues to carry out the Testing (“Term”), at which point the agreement shall expire unless any extension is agreed in writing between the parties.

1.3 Any work such as training or preparation for the Testing by the parties prior to the Commencement Date shall be treated as having been performed under the T&Cs.

2. Standard operating procedure

2.1 DHSC has made available to the Provider a COVID-19 testing guidance document applicable to the Provider (“Guidance”), which sets out a detailed description and plan of the testing and ancillary responsibilities that are to be carried out by the Provider under the T&Cs. The definition of “Guidance” shall include each of the documents and webpages which are linked to in the Guidance.

2.2 In these T&Cs:

2.2.1 “On-Site Guidance” shall mean all sections of the Guidance which are applicable to On-Site Testing; and

2.2.2 “Home Test Guidance” shall mean all sections of the Guidance which are applicable to Home Testing.

2.3 The Self-Test Kits are supplied with instructions for use (the latest version being the “Instructions for Use”) which the Provider must provide to Test Subjects where such kits are collected pursuant to these T&Cs. DHSC may from time to time update the Instructions for Use.

2.4 Where Self-Test Kits are supplied with two sets of instructions for use, one from the original manufacturer and a second from DHSC, the “Instructions for Use” for such Self-Test Kits shall be the DHSC instructions for use and the original manufacturer’s instructions for use must not be provided to a Test Subject.

2.5 The Provider agrees to (as applicable):

2.5.1 carry out or facilitate COVID-19 testing on Test Subjects on-site at the Provider (“On-Site Testing”); and

2.5.2 to operate a collection site to enable Test Subjects to collect Self-Test Kits (as defined below) from the Provider for COVID-19 testing (“Home Testing”), each in accordance with the applicable Guidance (together, the “Testing”).

2.6 DHSC may update the Guidance during the Term from time to time and following such update will provide or make available a copy of the updated Guidance to the Provider. Unless otherwise agreed with DHSC in writing, any updated Guidance and/or Instructions for Use shall apply from the date on which it is provided to the Provider.

2.7 If DHSC makes a change to the Guidance which would have a material adverse impact on the Provider, the Provider may request that DHSC makes further changes to the Guidance to avoid or mitigate that impact. If DHSC does not make such further changes to the Guidance within 7 days, either party may immediately on written notice terminate the agreement.

2.8 In the event of conflict between the Guidance and the terms of the T&Cs, the terms of the T&Cs shall prevail.

3. Primary responsibilities – testing

3.1 Each Party agrees to perform the obligations that are allocated to it in the Guidance in accordance with the Guidance, the T&Cs and all applicable laws and regulations.

3.2 This clause 3 shall apply to all Testing that is undertaken by the Provider. In addition, clause 4 shall apply to any On-Site Testing undertaken by the Provider and clause 5 shall apply to any Home Testing undertaken by the Provider.

3.3 In addition to clause 3.1, the Provider shall:

Communication and set-up

3.3.1 liaise with the appointed representative(s) of any stakeholders at or connected to the Provider in connection with the Testing;

3.3.2 cooperate with DHSC in liaising with the applicable local authority bodies as required in connection with the Testing;

3.3.3 undertake and deliver all communications in accordance with DHSC guidance, including the communication of the Testing to potential Test Subjects; and

3.3.4 be responsible for the set-up and configuration of the Testing at the Provider and for ensuring the configuration is in accordance with applicable laws and guidance, including appropriate COVID-19 measures and appropriate site risk assessment;

Procurement of personnel and materials

3.3.5 provide, procure or otherwise arrange for the supply of suitably competent personnel to perform each of the roles set out in the Guidance designated to be provided by the Provider and to ensure that such personnel perform in accordance with the Guidance;

3.3.6 ensure that personnel who are to be involved in the Testing shall attend all training as required by the Guidance or by DHSC in advance of being involved in the Testing, and shall perform their role in relation to the Testing in accordance with any such training;

3.3.7 on request provide DHSC with appropriate evidence that each person has completed the training in clause 3.3.6;

3.3.8 provide such items as are necessary to carry out the Testing, except for any items which are to be provided by DHSC as listed in the Guidance;

3.3.9 inspect the DHSC Supplies in accordance after delivery in accordance with clause 6.4.2;

3.3.10 store the DHSC Supplies safely and securely in accordance with the Guidance and ensure that NHS Branded Kits are kept separate from any other testing kits held by the Provider;

Carrying out of the testing

3.3.11 be responsible for obtaining any necessary consents from Test Subjects in connection with the Testing;

3.3.12 at all times comply with applicable laws and regulation in carrying out the Testing, including but not limited to the Control of Substances Hazardous to Health 2002;

3.3.13 ensure that any waiting or queuing is done in a COVID-19 secure manner in compliance with all applicable laws and regulations;

3.3.14 perform the Testing with all reasonable skill and care and in accordance with the Guidance and applicable regulations;

3.3.15 cooperate in an independent or internal quality assurance programme that will be run to ensure sites are performing at the appropriate level. This will involve sites running known samples at periodic intervals. For social care providers, this will be phased over time and the QA plan and timelines will be agreed with the social care provider management teams. It will be overseen by the National Testing Programme’s Quality Assurance team. Further guidance will be provided on the timing and scope of this process;

3.3.16 separately from any business as usual waste, safely dispose of any waste, including samples, testing kits, kit peripherals and PPE, and any waste suspected of being contaminated with COVID-19, in accordance with the Guidance;

3.3.17 report any material problems or incidents with the DHSC Supplies to DHSC as soon as reasonably practicable in accordance with any processes agreed by the parties from time to time, save that any serious incident shall be reported as soon as possible to DHSC (in any event within 24 hours of the incident); and

3.3.18 provide such aggregated and anonymised data relating to Test Subjects as the parties may agree from time to time.

3.4 For the avoidance of doubt, the Provider has the right to deny a potential Test Subject who is displaying symptoms of COVID-19 from participating in the Testing and shall instead direct the individual to the appropriate symptomatic guidelines and practices.

4. Provider responsibilities – on-site testing

4.1 Where the Provider is undertaking On-Site Testing, in addition to the obligations in clause 3, the Provider shall comply with the On-Site Guidance and:

4.1.1 subject to clause 6.3.1, ensure that the On-Site Testing complies with the instructions for use for the On-Site Kits provided by DHSC; and

4.1.2 save where the parties agree otherwise in writing, only use the On-Site Kits provided by DHSC for the purpose of On-Site Testing and promptly on request return any unused or surplus On-Site Kits to DHSC.

5. Provider responsibilities – home testing

5.1 Where the Provider is undertaking Home Testing, in addition to the obligations in clause 3, the Provider shall comply with the Home Test Guidance and shall:

5.1.1 distribute the Self-Test Kits with the Instructions for Use and any applicable self-test guidance document(s) to Test Subjects for the purpose of the Home Testing pursuant to these T&Cs and not make any other use of the Self-Test Kits. The Provider shall use its reasonable endeavours to distribute the NHS Branded Kits with the Instructions for Use in accordance with any timeframes set out in the Home Test Guidance;

5.1.2 not do anything to modify, obscure or contradict the Instructions for Use;

5.1.3 advise the Test Subjects to promptly report their test results from the Self-Test Kits (whether positive, negative or void) via the available NHS Test and Trace processes and (in the case of the Provider’s staff) to promptly inform the Provider of any test results; and

5.1.4 in the event of any product recall in relation to NHS Branded Kits, provide any assistance reasonably requested by DHSC in identifying the location of the impacted NHS Branded Kits, returning or, at DHSC’s request, destroying impacted NHS Branded Kits, and/or contacting the affected Test Subject(s).

Test kit log

5.2 The Provider shall establish and maintain a test kit log in accordance with the Guidance and requirements of these T&Cs (“Test Kit Log”) (which may be comprised of a number of locally held documents where applicable).

5.3 Promptly after the Provider provides each NHS Branded Kit and Instructions for Use to a Test Subject, the Provider shall update the Test Kit Log to confirm:

5.3.1 the first name, last name, and telephone number and/or email address of the test subject;

5.3.2 that the Instructions for Use were provided to the relevant Test Subject with the NHS Branded Kits;

5.3.3 the date that the NHS Branded Kits and Instructions for Use were distributed to the Test Subject; and

5.3.4 the lot number(s) of the relevant NHS Branded Kits.

5.4 On written request by DHSC, the Provider shall:

5.4.1 make available to DHSC the data from its Test Kit Log (in a format as notified by DHSC) by uploading the data in accordance with any timelines and process as notified by DHSC; and

5.4.2 submit a copy of its Test Kit Log to DHSC (in the format as notified by DHSC).

6. DHSC responsibilities

6.1 In addition to clause 3.1, DHSC shall:

6.1.1 cooperate with the Provider in liaising with the applicable local authority bodies as required in connection with the Testing;

6.1.2 provide access to an online training and assessment tool for use by the individuals selected by the Provider to carry out Testing;

6.1.3 provide a reasonable level of advice and support to the Provider on matters relating to the Testing; and

6.1.4 provide such items as are listed as to be provided by DHSC in the Guidance and in such quantities as are agreed between the parties, including (as applicable), LFD antigen testing kits (as set out in clause 6.2), and PCR testing kits (as more fully described in the Guidance) (collectively, “DHSC Supplies”).

6.2 DHSC may provide the following types of LFD antigen testing kits under these T&Cs:

6.2.1 LFD antigen testing kits supplied for use in On-Site Testing (“On-Site Kits”);

6.2.2 NHS branded LFD antigen testing kits supplied for use in Self-Test Collect (“NHS Branded Kits”); and

6.2.3 LFD antigen testing kits supplied for use in Home Testing, including the NHS Branded Kits (“Self-Test Kits”).

6.3 DHSC shall be responsible for ensuring that:

6.3.1 save where the Guidance expressly states otherwise, the Guidance is appropriate for the applicable Testing in accordance with the T&Cs and applicable law and regulation (provided that the Provider acknowledges that the implementation of the Guidance by the Provider needs to take account of the particular circumstances of the Provider and accordingly the Guidance cannot include a comprehensive list of all actions that will be required to carry out the Testing at the Provider);

6.3.2 the DHSC Supplies are appropriate for use by the Provider to carry out the Testing in accordance with the Guidance, applicable instructions for use and the T&Cs; and

6.3.3 the DHSC Supplies are of the necessary quality and standard to enable the Provider to carry out the Testing and free from material defects. Subject to clause 6.4.1, if the Provider notifies DHSC that any DHSC Supplies have material defects, DHSC shall endeavour to provide replacements and it shall be the responsibility of the Provider to recall any DHSC Supplies from the Test Subjects if required to do so by DHSC.

6.4 Unless otherwise agreed by the Parties in writing, any DHSC Supplies provided by DHSC for use by the Provider:

6.4.1 shall be provided at DHSC’s sole discretion (save that DHSC will use reasonable endeavours to meet any volumes agreed with the Provider);

6.4.2 shall be inspected by the Provider after receipt in order that the Provider can confirm that the DHSC Supplies that have been delivered include the expected quantity and type of DHSC Supplies;

6.4.3 must be returned to DHSC within any agreed timescales for such return or otherwise promptly upon DHSC’s request; and

6.4.4 subject to clauses 6.4.2 and 6.4.3 above, shall be used by the Provider at the Provider’s risk and the Provider shall upon written request by DHSC reimburse DHSC for any loss or damage relating to Managed Devices caused by the Provider (fair wear and tear exempted).

7. Data protection

7.1 Each party will process personal data under or in connection with this T&Cs. Save for where the Provider is acting as a data processor in accordance with Schedule 1, each party will be a controller in respect of the information that it processes under or connection with this T&Cs. Without limitation to the foregoing, the parties intend that:

7.1.1 subject to clause 7.1.2, the Provider shall be the controller in respect of any personal data it collects from Test Subjects (including in arranging the attendance of Test Subjects at the Provider and receipt of any positive test results from Test Subjects); and

7.1.2 DHSC shall be the controller in respect of any personal data: (a) DHSC collects from the Provider and/or its personnel for the purposes of procuring the provision of training under clause 6.1.2; (b) DHSC receives from the Provider in the completed Test Kit Log; and (c) processed through the NHS Test and Trace digital system.

7.2 In carrying out its obligations under this T&Cs, each party shall comply with its obligations under the Data Protection Act 2018 and any other applicable laws relating to the protection of personal data and the privacy of individuals (all as amended, updated or re-enacted from time to time).

7.3 In particular, the Provider shall in accordance with the Guidance obtain and keep a written record of each Test Subject’s (or where applicable a Test Subject’s parent or legal guardian) consent to participate in the Testing.

7.4 In the event that either party receives a data rights request relating to personal data processed under or in connection with this agreement, such party will ensure that such request is appropriately actioned in respect of the personal data for which the recipient of the request is a data controller.

7.5 Where applicable, each party agrees to comply with the obligations placed on it in Schedule 1.

8. Confidential information

8.1 For the purposes of this T&Cs, “Confidential Information” shall mean information, data (including personal data) and material of any nature, which either party may receive or obtain in connection with the conclusion and/or operation of the T&Cs which is designated as confidential by either party or that ought reasonably to be considered as confidential.

8.2 Each party shall take all proper steps to keep confidential all Confidential Information of the other party which is disclosed to or obtained by it under or as a result of the T&Cs, and shall not disclose the same to any third party and shall allow access to the same to its own employees only on a need-to-know basis, except to the extent that any such Confidential Information becomes public through no fault of that party and except for use reasonably necessary for the performance of the T&Cs.

8.3 Notwithstanding clause 8.2:

8.3.1 either party may disclose Confidential Information received from the other to its contractors to the extent necessary to enable them to comply with their obligations under the T&Cs; and

8.3.2 DHSC may use and disclose the Confidential Information for the purpose of improving the process and operations involved in the Testing, which may include DHSC sharing information relating to the experiences and insights gained as a result of the Testing

8.4 Nothing in the T&Cs shall restrict or prevent DHSC from disclosing the name and address of the Provider to any other organisation involved in the DHSC COVID-19 testing programme.

8.5 Notwithstanding the termination or expiry of the T&Cs, this clause shall be valid for a further period of seven years from the date of termination or expiry.

9. Freedom of Information Act

9.1 The Provider acknowledges that DHSC is subject to the Freedom of Information Act 2000 and the Environmental Information Regulations 2004 (together “FOIA”) and shall assist and co-operate with DHSC to enable it to comply with the requirements of FOIA in relation to the T&Cs.

9.2 The Provider further acknowledges that DHSC may be obliged to disclose any information (including Confidential Information) which it holds in response to a request received under FOIA, and that the extent, content and format of the disclosure is DHSC’s decision.

9.3 The Provider shall ensure that all Information (as defined in section 84 of Freedom of Information Act 2000) produced in the course of the T&Cs or relating to the T&Cs is retained for disclosure for a period of seven (7) years from the date of expiry or termination of the T&Cs and shall permit DHSC to inspect such records as requested from time to time during the Term of the T&Cs.

9.4 In no event shall the Provider respond directly to a Request For Information (as defined in the Freedom of Information Act 2000, and such term shall include its equivalent under the Environmental Information Regulations 2004) related or otherwise connected to DHSC or this T&Cs unless expressly authorised to do so by DHSC.

10. Liability

10.1 The parties expressly exclude liability for loss of data, profits, business, goodwill or anticipated savings, and all other indirect or consequential loss or damages suffered or incurred by a party under or in connection with the T&Cs.

10.2 Nothing in the T&Cs shall limit or exclude either party’s liability for:

10.2.1 death or personal injury or damage to property caused by negligence on the part of that party or its employees, contractors or agents; or

10.2.2 any matter in respect of which it would be unlawful for that party to exclude or restrict liability.

11. Costs

11.1 Each party shall bear its own costs in relation to the Testing and carrying out its responsibilities under the T&Cs.

12. Termination

12.1 Either party may terminate the T&Cs on fourteen (14) days written notice to the other party.

12.2 Either party may immediately terminate the T&Cs by issuing a notice in writing to the other party if the other party is in material breach of any obligation in the T&Cs which is either incapable or remedy or, where capable of remedy, that breach is not remedied within seven (7) days of receiving notice specifying the breach and requiring it to be remedied.

12.3 On termination or expiry of the T&Cs, the Provider shall promptly return to DHSC at DHSC’s request, all other equipment, materials and property that DHSC has supplied to the Provider in connection with the Testing, including the testing kits, which are unused and which have not been distributed to Test Subjects.

12.4 The termination of the T&Cs shall be without prejudice to the rights and remedies of a party which may have accrued at the date of termination.

13. Change in applicable law or guidance

13.1 Neither party shall be liable to the other party for any delay or failure to perform, its obligations under the T&Cs (other than a payment of money) to the extent that such delay or failure is a result of changes in applicable law and/or government guidance which mean that the Testing cannot be carried out (in all material respects) without such laws and/or government guidance being breached, or if either party can reasonably demonstrate that despite all reasonable endeavours it is unable to secure the supply of non-COVID-19 infected personnel to the Testing due to the levels of COVID-19 infections in the population of the United Kingdom.

13.2 Notwithstanding clause 13.1, each party shall use all reasonable endeavours to continue to perform its obligations under the T&Cs to the extent possible (in accordance with applicable laws and guidance), which may include only providing part of the Testing.

13.3 However, if either party is prevented from performing its material obligations under the T&Cs and the parties are unable to agree a way to facilitate the continued performance of the T&Cs, either party may terminate the T&Cs with immediate effect by notice in writing.

14. Publicity

14.1 Save for the publicity carried out by the parties in promoting the Testing to potential Test Subjects in accordance with the T&Cs, neither party shall make any press announcement in relation to the T&Cs or any part of it in any way, without the prior written consent of the other party.

15. General

15.1 The parties irrevocably agree that the T&Cs shall be subject to the laws of England and Wales and that the courts of England and Wales shall have exclusive jurisdiction to hear and settle any dispute in connection with the T&Cs.

15.2 In the event of the transfer of all or a substantial part of DHSC’s activities to one or more government bodies, DHSC’s rights and obligations shall, notwithstanding any provision to the contrary in the T&Cs, automatically transfer to such other government body.

15.3 Except as provided elsewhere in the T&Cs, a person who is not a party to the T&Cs shall not have any rights under or in connection with it.

15.4 If any part of the T&Cs is prohibited by law or judged by a court to be unlawful, void or unenforceable, it must be read as if that part was removed from the T&Cs as much as required and rendered ineffective as far as possible without affecting the rest of the T&Cs, whether it is valid or enforceable.

15.5 DHSC may amend the T&Cs at any time by issuing a notification to the Provider of the amendments to the T&Cs. If the Provider does not wish to continue with Testing on the basis of any updated T&Cs, it may terminate these T&Cs by giving notice in writing to DHSC. Any amendments shall be effective seven (7) days following the date of receipt by the Provider of notification, provided that DHSC has not within such seven (7) days received a notice from the Provider to terminate these T&Cs.

15.6 Notices shall be sent to such address as the relevant party may give notice to the other party for the purpose of service of notices under the T&Cs.

Schedule 1: data processing clauses

1. Definitions

1.1 In this Schedule:

1.1.1 “Data Protection Legislation” shall mean (i) the retained EU law version of the General Data Protection Regulation (EU) 2016/679 as enacted into English law (UK GDPR) and as revised and superseded from time to time; (ii) the Data Protection Act 2018 (DPA 2018) and as revised and superseded from time to time; (iii) Privacy and Electronic Communications Regulations 2003 and as revised and superseded from time to time; and (iv) any other laws and regulations relating to the Processing of Personal Data and privacy which apply to a Party and, if applicable, the guidance and codes of practice issued by the relevant data protection or supervisory authority and expressly includes the common law duty of confidentiality;

1.1.2 “Data Subject”, “Controller”, “International Organisation”, “Personal Data Breach”, “Processor” and “Processing” have the same meaning as in the Data Protection Legislation;

1.1.3 “Personal Data” has the meaning set out in the Data Protection Legislation in relation to data Processed under the T&Cs;

1.1.4 “Regulator” means any independent public authority responsible for monitoring the application of the Data Protection Legislation in the UK; and

1.1.5 “Third Country” means any country other than the UK at the time of transfer of Personal Data.

1.2 For the purposes of the Data Protection Legislation, the Provider is a Processor acting on behalf of The Test and Trace Programme of the DHSC as the Controller (“DHSC”), in the circumstances identified in the Annex to this Schedule (“Annex”).

2. Obligations

2.1 The Provider agrees that it will comply with its obligations under the Data Protection Legislation and shall, in relation to any Personal Data Processed in connection with its obligations under the T&Cs:

2.1.1 Process the Personal Data only to the extent necessary for the purpose set out in the Annex to this Schedule and in accordance with DHSC’s written instructions (including with respect to transfers of Personal Data to a Third Country or to an International Organisation);

2.1.2 Process that Personal Data only in accordance with the Annex unless the Provider is required to do otherwise by applicable law. If it is so required the Provider shall notify DHSC before Processing the Personal Data unless prohibited by applicable law from doing so; and

2.1.3 ensure that the Data Subjects whose Personal Data are Processed by Provider under the T&Cs are provided with a privacy notice in the form provided by DHSC and in accordance with any processes notified by DHSC.

2.2 The Provider will ensure that:

2.2.1 its personnel do not Process the Personal Data except in accordance with the T&Cs (and in particular the Annex);

2.2.2 it takes all reasonable steps to ensure the reliability and integrity of any of the Provider’s personnel who have access to the Personal Data and ensure that they:

(i) are aware of and comply with the Provider’s duties under the T&Cs;

(ii) are subject to appropriate confidentiality undertakings with the Provider or any sub processor;

(iii) are informed of the confidential nature of the Personal Data and do not publish, disclose or divulge any of the Personal Data to any third party unless directed in writing to do so by DHSC or as otherwise permitted by the T&Cs; and

(iv) take responsibility for the use, care, protection and handling of the Personal Data.

2.3 The Provider shall notify DHSC, as soon as reasonably practicable, about any request or complaint received from a Data Subject (without responding to that request, unless authorised to do so by DHSC) and assist DHSC by technical and organisational measures, insofar as possible for the fulfilment of DHSC’s obligations in respect of such requests and complaints.

2.4 The Provider shall notify DHSC immediately if in relation to it Processing Personal Data under or in connection with the T&Cs it:

2.4.1 receives any other request, complaint or communication relating to either party’s obligations under the Data Protection Legislation;

2.4.2 receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data Processed under the T&Cs;

2.4.3 receives a request from any third party for disclosure of Personal Data where compliance with such request is required or purported to be required by law; or

2.4.4 becomes aware of a Personal Data Breach.

2.5 The Provider shall keep and maintain accurate records and information to demonstrate its compliance with this Schedule.

2.6 The Provider shall on request by DHSC:

2.6.1 taking into account the nature of the Processing and the information available to the Provider, assist DHSC in ensuring compliance with its obligations under Articles 32 to 36 of the UK GDPR (where applicable) in respect of the Personal Data; and

2.6.2 make available its records and information maintained under paragraph 2.5 and to demonstrate the Provider’s compliance with this Schedule and on reasonable advance notice in writing otherwise permit, and contribute to, audits carried out by DHSC (or its authorised representative) with respect to the Personal Data and its Personal Data Processing activity.

2.7 The Provider shall:

2.7.1 only allow sub processors to Process Personal Data under the T&Cs where such sub processors are engaged by the Provider for the purpose set out in the Annex and where the Processing by such sub processors is required for that purpose; and

2.7.2 enter into a written agreement with the sub processor which gives effect to the terms set out in this Schedule such that they apply to the sub processor.

2.8 The Provider shall promptly on request from DHSC provide to DHSC details of all sub processors it has allowed to Process Personal Data under the Agreement and such information regarding the sub processors as DHSC may reasonably require.

2.9 The Provider shall remain fully liable for all acts or omissions of any of its sub processors.

2.10 On termination or expiry of the T&Cs and from time to time in accordance with any data retention, deletion or destruction requirements notified by DHSC, the Provider shall destroy, delete or return (as DHSC directs) all Personal Data and delete all existing copies of such data unless required by law to keep or store such Personal Data.

2.11 DHSC may, at any time revise or amend this Schedule in accordance with clause 15.5 of the T&Cs either by:

2.11.1 replacing this Schedule with any applicable controller to processor standard clauses or similar terms adopted in accordance with Article 28 of the UK GDPR; or

2.11.2 amending this Schedule to ensure that it complies with any guidance issued by the Information Commissioner’s Office.

Annex: data processing details

Description	Details
Circumstances where the Provider is acting as a Processor on behalf of DHSC	The Provider acts as a Processor in respect of processing of Personal Data in a Test Kit Log it compiles on behalf of DHSC for the purposes set out in this Annex.
Duration of Processing	The Provider will gather and share this data for the term that they run a self-test collect site, or other test site setup which involves the collection of end-user data in line with the purposes specified in this Annex (MHRA traceability requirement).
Categories of Data Subjects	Test Subjects who have participated in Home Testing. The individual appointed by the Provider to assist with the distribution of NHS Branded Kits to the Test Subjects.
Type of Personal Data	First name, last name, telephone number of Test Subject, details of lot/batch number for the NHS Branded Kits they receive, location where they received the NHS Branded Kits, date on which they received the NHS Branded Kits and other categories of information set out in the template Test Kit Log. First name, last name of the operator distributing the NHS Branded Kits.
Nature and purposes of Processing	To be able to fulfil DHSC’s regulatory responsibility to the Medicines and Healthcare products Regulatory Authority (“MHRA”). As the legal manufacturer for some test kit types, DHSC needs to be able to trace the end user in the event of a batch recall or field safety notice.
How Personal Data is stored	Test Kit Log (whether maintained in an excel file, paper test kit log or other means as required by DHSC) populated by the Provider (or its operators distributing the NHS Branded Kits) with the Personal Data detailed in this Annex.
Retention period	The data collected by the Provider shall be submitted to DHSC on request. The data will be kept for no longer than 12 months from the day of collection by the Provider and will be deleted from all the Provider’s systems as soon as instructed to do so by DHSC. DHSC will keep the data for no more than 8 years.
Third Countries to which Personal Data will be transferred to	None.
Sub processors	Subject to clauses 2.7 to 2.9 of Schedule 1, the Provider may appoint third parties to carry out data entry into the Test Kit Log where such third parties form part of the staff operating the self-test collect site for the Provider.