Guidance

LFD Testing Agreement: England, Northern Ireland and Wales terms and conditions for COVID-19 workplace testing

Updated 29 January 2024

This guidance was withdrawn on 8 March 2024

This content is now available at COVID-19: guidance and support.

Introduction

This Agreement is entered into between The Secretary of State for Health and Social Care of 39 Victoria Street, Westminster, London, SW1H 0EU, United Kingdom, acting as part of the Crown (‘DHSC’) and the organisation which has agreed to participate in the testing programme described in this Agreement (‘Participating Organisation’) on the earlier of:

(i) the date on which the representative of the Participating Organisation confirms their agreement to these terms and conditions as part of registering the Participating Organisation with the Department of Health and Social Care (DHSC) for the Testing Programme defined below (‘Registration’) through DHSC Testing Programme online portal (‘Portal’); or

(ii) the date on which the Participating Organisation commences any participation in the Testing Programme (and by such participation, the Participating Organisation confirms their agreement to the terms and conditions of this Agreement).

This Agreement is formed of:

(i) these DHSC terms and conditions for coronavirus (COVID-19) testing, including (in the case of Workplace Collect Testing as defined below) the Annex and Addendum;

(ii) the Workplace testing: UK standard operating procedure (SOP) applicable to the relevant UK country in which the testing is to be carried out, as made available by DHSC (the ‘SOP’); and

(iii) any details submitted by the Participating Organisation and/or displayed in the Portal as part of its Registration.

As part of DHSC’s wider efforts to combat the COVID-19 pandemic, DHSC is supporting a testing programme for employers which uses lateral flow device (‘LFD’) test kits to aim to identify asymptomatic individuals who have COVID-19 (‘Testing Programme’). DHSC and the Participating Organisation have agreed to co-operate in the Testing Programme.

This Agreement covers 2 separate workstreams of the Testing Programme:

(i) ATS Testing: being the Participating Organisation’s running of a COVID-19 testing facility (‘Facility’) at one or more of the Participating Organisation’s operating location(s) (‘Location’). Part B of this Agreement (clauses 4 to 6) and the Annex do not apply to ATS Testing.

(ii) Workplace Collect Testing: being the Participating Organisation’s running of a COVID-19 self-testing programme, where LFD self-test kits are provided to asymptomatic individuals for use at home. Part A of this Agreement (clauses 1 to 3) does not apply to Workplace Collect Testing.

A Participating Organisation may only participate in the above workstreams of the Testing Programme as agreed with DHSC as part of its Registration, or any later update via the Portal.

This Agreement applies to private industry Participating Organisations and public sector Participating Organisations (including Crown Bodies). Certain provisions of this Agreement are modified in the case of public sector Participating Organisations (see clause 18) and Crown Bodies (see clause 19).

Part A: ATS Testing

1. Basis of the ATS Testing

1.1 The Facility will test such of the Participating Organisation’s employees, consultants, directors, contractors, sub-contractors or other individuals who work at the Location and visitors to the Location, in each case who volunteer and are over the age of 18 years old, and any other category of individual which DHSC agrees in writing can be included in the ATS Testing (together ‘Test Subjects’). In the case of visitors to the Location, such visitors may only be included in the ATS Testing to the extent consistent with any relevant guidance published by DHSC through the Portal as such guidance is updated by DHSC from time to time (‘Guidance’) or as otherwise expressly agreed by DHSC.

2. Participating Organisation responsibilities

2.1 The Participating Organisation shall perform the testing as described in this clause 2 (‘Testing’) in accordance with the SOP and with all reasonable skill and care.

2.2 Subject to Clause 3, the Participating Organisation shall provide all of the resources and materials that are necessary to enable the Participating Organisation to run, manage and control a testing Facility for the Test Subjects at the Location(s) notified to DHSC as part of Registration. The Participating Organisation may add one or more additional Facility Locations to this Agreement, or change the address of any existing Location, via the procedure notified to the Participating Organisation by DHSC. DHSC may, at its sole discretion, refuse to include any Facility Location in the Testing Programme.

2.3 The Participating Organisation shall be responsible for the management of the day to day testing process. In particular, the Participating Organisation shall:

Set up and marketing of Facility

2.3.1 be solely responsible for the communications, engagement and publication of the Testing to potential Test Subjects, which may include the creation of a dedicated webpage on the Participating Organisation’s intranet, the circulation of communications providing details of the Testing, sending personalised invitations to potential Test Subjects, and the displaying of posters at the Participating Organisation’s operating locations. The Participating Organisation shall make it clear in relevant communications that the Testing is on a voluntary basis;

2.3.2 be responsible for the set-up and configuration of the Facility and ensuring the configuration is in accordance with the SOP;

2.3.3 ensure that each Facility Location is validly registered with the relevant NHS Test and Trace systems prior to any Testing at the relevant Location;

2.3.4 where relevant, liaise with the appointed representative(s) of such trade unions (if any) as is necessary before, during and after the Testing;

2.3.5 erect suitable signage that provides details about the Testing being delivered at the Facility; and 2.3.6 provide all relevant personnel with suitable facilities at the Facility where appropriate (for example access to bathrooms and break areas);

Procurement of personnel

2.3.7 provide or procure the necessary amount of employees, contractors and/or other third parties to operate the Facility in accordance with the SOP, as well as to provide any required security and onsite first aid support (noting that multiple roles may in certain cases be performed by the same individual);

2.3.8 ensure that personnel who are to be involved in the Testing shall attend any training as required by the SOP and/or DHSC in advance of being involved in the Testing, and shall perform their role in relation to the Testing in accordance with any such training and training materials provided by DHSC;

2.3.9 provide DHSC’s employees, contractors and nominated third parties with access to the Facility as required for the performance of DHSC’s responsibilities under this Agreement;

2.3.10 comply with its legal obligations in relation to the health and safety of Test Subjects and any Participating Organisation, DHSC, or third party personnel whilst such persons are present at the Location for the purposes of the Testing;

2.3.11 provide DHSC with a copy of any Participating Organisation policy which DHSC and its employees, contractors and/or third parties must comply with whilst on-site at the Location; and

2.3.12 comply with its relevant legal obligations as an employer or which otherwise apply in relation to its employees or workers;

Procurement of materials

2.3.13 procure a sufficient supply of personal protective equipment (‘PPE’) to the Facility(s) for use by employees, contractors or third parties for the purpose of the Testing; and

2.3.14 provide waste disposal facilities meeting the requirements of the SOP, including appropriate bins, bags, and containers;

Carrying out of the testing

2.3.15 solely use the test kits provided by DHSC for the purpose of the Testing pursuant to this Agreement and the SOP and promptly return any unused or surplus test kits to DHSC on request (and in any event on expiry or termination of this Agreement);

2.3.16 be responsible for operating the appointment process of Test Subjects for the Testing;

2.3.17 arrange for Test Subjects to register for the test online on their arrival at the Facility, including the Test Subjects entering their personal details and details of their test kit barcode, using the relevant NHS Test and Trace website as listed in the SOP;

2.3.18 carry out the sample collection and processing, and recording of results, in accordance with the SOP;

2.3.19 not store or use test samples or results for any purpose other than for the Testing;

2.3.20 separately from any business as usual waste, safely dispose of any waste, including samples, test kits, kit peripherals and PPE, and any waste suspected of being contaminated with COVID-19, in accordance with the SOP; and

2.3.21 note that DHSC reserves the right to limit the extent to which the Participating Organisation can order further test kits where the number of test results which have been reported from the relevant Facilities to the NHS Test and Trace system is materially lower than the number of test kits supplied by or on behalf of DHSC to the Participating Organisation.

2.4 The Participating Organisation shall not charge for the provision of Testing unless any such charge is permitted by and in accordance with the Guidance.

2.5 The Participating Organisation shall not distribute the test kits to any other individual or organisation without the express written permission of DHSC. DHSC retains records of the lot numbers of test kits issued to each Participating Organisation for the purpose of auditing the distribution and use of such test kits.

2.6 The Participating Organisation may appoint a third party to run the Facility on behalf of the Participating Organisation (‘Outsourced Provider’) provided that:

2.6.1 any such appointment is in accordance with any applicable Guidance;

2.6.2 the Outsourced Provider must be on the list of private providers of COVID-19 general testing as maintained by DHSC (such list is currently available on the GOV.UK website) and the Participating Organisation must suspend or terminate any use of the Outsourced Provider during any period in which the Outsourced Provider ceases to be on such list;

2.6.3 the Outsourced Provider must comply with any applicable notification and reporting requirements (and the Participating Organisation is not required to submit any relevant reports in respect of the Testing insofar as the Outsourced Provider has done so); and

2.6.4 the Participating Organisation must have an appropriate contract in place with the Outsourced Provider in respect of the Testing including an obligation on the Outsourced Provider to meet the applicable requirements of the SOP, and an ability for the Participating Organisation to terminate the appointment of the Outsourced Provider in the event that this Agreement expires or is terminated or the Outsourced provider ceases to be on the above DHSC list.

3. DHSC responsibilities

3.1 DHSC shall, at no cost to the Participating Organisation (including, for the avoidance of doubt, any delivery charges):

3.1.1 supply (or procure the supply of) LFD antigen test kits to the Facility(s), together with appropriate test kit peripherals (including guidance material and instructions), subject to availability and to DHSC accepting a relevant order. The Participating Organisation will be assigned a maximum allocation of test kits by DHSC, taking into account the expected number of Test Subjects and the proposed frequency of testing. The Participating Organisation may place an order for the test kits through the Portal (including the relevant proposed delivery address), and DHSC shall promptly notify the Participating Organisation of whether the order (and such delivery address) is accepted and the detailed delivery or collection arrangements for such test kits under accepted orders; and

3.1.2 provide the Participating Organisation (either through the SOP or otherwise) with:

(i) guidelines on how to publicise the Testing and communicate its availability to potential Test Subjects; and

(ii) guidelines which detail the methods that the Participating Organisation may employ to resource the necessary personnel for the Testing; and

3.1.3 make available suitable materials to relevant personnel for the purposes of training on carrying out the Testing.

DHSC acknowledges that the Participating Organisation’s ability to conduct the Testing is contingent on DHSC’s compliance with this clause 3.1.

3.2 DHSC confirms that the test kits provided to the Participating Organisation by or on behalf of DHSC under this Agreement shall be fit for purpose.

3.3 Insofar as DHSC has access to the Facility as part of the delivery of the Testing, DHSC shall, and shall ensure that DHSC’s employees and its contractors shall, only use such access for the purpose of supporting the Testing and shall comply with any relevant Participating Organisation policies that have been provided to DHSC in advance in respect of any such access.

Part B: Workplace Collect Testing

4. Basis of the Workplace Collect Testing

4.1 DHSC will provide LFD self-test kits (‘Testing Kits’) to the Participating Organisation, and the Participating Organisation will distribute them to such employees, consultants, directors, contractors, sub-contractors or other individuals, in each case who volunteer and are over the age of 18 years old, and any other category of individual which DHSC agrees in writing can be included in the Workplace Collect Testing (together ‘Test Subjects’), enabling the Test Subjects to self-administer tests.

4.2 DHSC will provide instructions for use for the Testing Kits together with the Testing Kits (the latest version of which provided to the Participating Organisation in accordance with this Agreement being the ‘Instructions for Use’).

4.3 The Participating Organisation agrees to distribute, in accordance with the SOP, Testing Kits and the Instructions for Use to Test Subjects to enable them to test themselves for COVID-19 (‘Self Testing’).

5. Participating Organisation responsibilities

5.1 The Participating Organisation shall establish and maintain a COVID-19 test kit log using the template provided by DHSC in accordance with the requirements of this Agreement (‘Test Kit Log’).

5.2 Promptly after receipt of each delivery of Testing Kits from DHSC under this Agreement, the Participating Organisation shall:

5.2.1 inspect the Testing Kits to confirm that the expected quantity and type of Testing Kits have been delivered; and

5.2.2 record the volume, lot number and date of receipt of the Testing Kits.

5.3 Following receipt of the Testing Kits, the Participating Organisation shall:

5.3.1 store the Testing Kits safely and securely in accordance with the SOP; and

5.3.2 distribute the Testing Kits with the current Instructions for Use to Test Subjects in accordance with the SOP from the agreed locations notified to DHSC as part of Registration (unless otherwise agreed with DHSC in writing).

5.4 Promptly after the Participating Organisation provides each Testing Kit and Instructions for Use to a Test Subject, the Participating Organisation shall update the Test Kit Log to confirm:

5.4.1 the name of the Test Subject to whom it has provided Testing Kits and their telephone number;

5.4.2 the number of Testing Kits issued to that Test Subject;

5.4.3 that the Instructions for Use were provided to the relevant Test Subject with the Testing Kits;

5.4.4 the date that the Testing Kits and Instructions for Use were distributed to the Test Subject;

5.4.5 the lot number(s) of the relevant Testing Kits; and

5.4.6 any other information required in the most recent Test Kit Log template issued to the Participating Organisation by DHSC.

5.5 The Participating Organisation shall retain the data recorded in the Test Kit Log for 12 months from the date of collection of the relevant data. The Participating Organisation shall submit a copy of its Test Kit Log to DHSC on written request (in the format and via the mechanism as notified to the Participating Organisation by DHSC).

5.6 The Participating Organisation shall:

5.6.1 distribute the Testing Kits to Test Subjects solely for the purpose of the Self Testing by Test Subjects pursuant to this Agreement and not make any other use of the Testing Kits or distribute the Testing Kits to anyone other than the Test Subjects;

5.6.2 distribute the Testing Kits with the Instructions for Use, and the Participating Organisation shall not do anything to modify, obscure or contradict the Instructions for Use;

5.6.3 promptly on request return any unused or surplus Testing Kits to DHSC which have not been dispatched to Test Subjects;

5.6.4 report any problems or incidents with the Testing Kits to DHSC as soon as reasonably practicable in accordance with any processes notified to the Participating Organisation by DHSC;

5.6.5 advise the Test Subjects to promptly report their test results from the Testing Kits (whether positive, negative or void) via the NHS Test and Trace digital solution and to promptly inform their line manager or other appropriate contact at the Participating Organisation of any positive test results;

5.6.6 undertake and deliver all communications in relation to the Self Testing in accordance with the SOP and other DHSC guidance, including the communication of the Self Testing and impact of the results of Self Testing to potential Test Subjects; and

5.6.7 in the event of any product recall in relation to Testing Kits, provide any assistance reasonably requested by DHSC in identifying the location of the impacted Testing Kits, returning or destroying impacted Testing Kits, and/or contacting the relevant Test Subjects.  

6. DHSC responsibilities

6.1 DHSC shall arrange for the delivery of Testing Kits to the Participating Organisation (subject to the availability of DHSC supplies of the same), in volumes to be agreed between the parties. Delivery by DHSC shall be made to a single location as notified to DHSC at Registration or as otherwise agreed between the parties. The supply of Testing Kits shall be at DHSC’s sole discretion (save that DHSC will use its reasonable endeavours to meet any volumes and delivery timeframes notified to the Participating Organisation).

6.2 DHSC shall be responsible for ensuring that:

6.2.1 the SOP (including the Instructions for Use) is appropriate for Self Testing in accordance with this Agreement and applicable law and regulation;

6.2.2 the Testing Kits are appropriate for use by Test Subjects to carry out the Self Testing in accordance with the SOP and this Agreement; and

6.2.3 the Testing Kits are of the necessary quality and standard to enable Test Subjects to carry out the Self Testing and are free from material defects. Subject to clause 6.1, if the Participating Organisation notifies DHSC that any Testing Kits have material defects, DHSC shall endeavour to provide replacements.

Part C: Testing Programme terms

7. Standard Operating Procedure

7.1 The Participating Organisation has been provided with access to the SOP which sets out general guidance for the testing and ancillary responsibilities that are to be carried out by each party under this Agreement.

7.2 Each party agrees to comply with the roles and responsibilities assigned to it under the SOP and to co-operate with the other party in order to achieve the objectives set out in the SOP.

7.3 The parties shall each ensure that their own relevant personnel are aware of the applicable provisions of the SOP and comply fully with the SOP.

7.4 DHSC may update the SOP from time to time. The updated SOP shall apply from the date on which it is notified to the Participating Organisation (which shall include for these purposes DHSC making the updated SOP available at the relevant web address). Participating Organisations should check the web address regularly for any updated documentation.

7.5 In the event of conflict between the SOP and the terms of this Agreement, the terms of this Agreement shall prevail.

8. Term

8.1 DHSC and the Participating Organisation shall begin the Testing Programme on the start date agreed with DHSC as part of Registration (‘Commencement Date’). The Testing Programme shall continue for the duration of this Agreement, which shall be from the Commencement Date (or such other end date as is displayed in the Portal as part of Registration or otherwise notified in writing by DHSC to the Participating Organisation) (‘Term’), at which point this Agreement shall expire unless any extension is agreed in writing between the parties.

8.2 Any work such as training or preparation for the Testing Programme by either party prior to the Commencement Date shall be treated as having been performed under the terms and conditions of this Agreement. Unless expressly agreed otherwise, this Agreement shall supersede any existing terms and conditions between DHSC and the Participating Organisation which apply to the Testing Programme.

9. Data protection

9.1 Each party will process personal data under or in connection with this Agreement. Save for where the Participating Organisation is acting as a data processor pursuant to clause 5.1 by maintaining a Test Kit Log in accordance with the Annex (Data processing provisions), each party will be a data controller in respect of the information that it processes under or connection with this Agreement.

9.2 Without limitation to the foregoing, the parties intend that, in relation to ATS Testing:

9.2.1 the Participating Organisation shall be the controller in respect of the personal data it collects from Test Subjects (including in arranging the attendance of Test Subjects at the Facility);

9.2.2 DHSC shall be the controller in respect of any personal data it collects from the Participating Organisation and/or Testing personnel for the purposes of the provision of training materials under clause 3.1.3 and in respect of any personal data processed through the NHS Test and Trace digital system;

9.2.3 The parties do not intend to disclose or share any personal data to each other under or in connection with this Agreement (including without limitation in relation to the Test Subjects). Where the Participating Organisation submits any data to the NHS Test and Trace digital system, the parties intend that the Participating Organisation will not be able to identify the relevant Test Subjects that the data relates to. To the extent that the parties each process personal data relating to the Test Subjects, each will do so as a separate independent data controllers; and

9.2.4 Notwithstanding clause 9.2.3, DHSC does not intend to disclose any results obtained during Testing directly to the Participating Organisation under this Agreement.

9.3 In carrying out its obligations under this Agreement, each party shall comply with its obligations under the Data Protection Act 2018 and any other applicable laws and regulations relating to the protection of personal data and the privacy of individuals (all as amended, updated or re-enacted from time to time).

10. Confidential information

10.1 For the purposes of this Agreement, ‘Confidential Information’ shall mean information, data and material of any nature, including personal data, which either party may receive or obtain in connection with the conclusion and/or operation of this Agreement which is designated as confidential by either party or that ought reasonably to be considered as confidential (however it is conveyed or on whatever media it is stored) and, for the purposes of this Agreement, shall include any data created in the course of the Testing Programme (‘Testing Data’). Where the parties have entered into a non-disclosure agreement in relation to the Testing Programme and/or DHSC’s testing strategy, any information disclosed under such non-disclosure agreement shall be deemed to be Confidential Information under this Agreement.

10.2 Each party shall take all proper steps to keep confidential all Confidential Information of the other party which is disclosed to or obtained by it under or as a result of this Agreement, and shall not disclose the same to any third party and shall allow access to the same to its own employees only on a need-to-know basis, except to the extent that any such Confidential Information becomes public through no fault of that party and except for use reasonably necessary for the performance of this Agreement.

10.3 Notwithstanding clause 10.2, DHSC shall be entitled to disclose Confidential Information received from the Participating Organisation to its contractors or other third parties to the extent necessary to enable them to support the Testing in accordance with this Agreement, provided that such contractors or other third parties have entered into a contract containing confidentiality provisions no less onerous than those contained in this Agreement.

10.4 Upon termination of this Agreement, where possible and on written request, save as expressly provided in this Agreement, each party shall return to the other party or securely destroy any Confidential Information (without retaining copies) provided for the purposes of this Agreement, save that this shall not apply to any Testing Data in the possession of DHSC and/or any Confidential Information held on backup IT systems (provided that any such information shall remain subject to the obligations of confidentiality in this clause 10).

10.5 The Participating Organisation shall not use any Testing Data or other relevant Confidential Information as part of any form of research project, or otherwise publish any Testing Data, without the prior written consent of DHSC.

10.6 Notwithstanding the termination or expiry of this Agreement for whatever reason, the obligations and restrictions in this clause shall be valid for a further period of 3 years from the date of termination or expiry of this Agreement.

10.7 Nothing in this Agreement shall restrict or prevent DHSC from disclosing the name of the Participating Organisation, the address of any Facility, and information on the volumes of tests, to any Crown Body, local government entity, or any other organisation involved in the DHSC COVID-19 testing programme.

11. Freedom of Information Act

11.1 The Participating Organisation acknowledges that DHSC is subject to the Freedom of Information Act 2000 and the Environmental Information Regulations 2004 (together ‘FOIA’) and shall assist and co-operate with any reasonable written requests from DHSC to enable it to comply with the requirements of FOIA in relation to this Agreement.

11.2 The Participating Organisation further acknowledges that DHSC may be obliged to disclose any information (including Confidential Information) which it holds in response to a request received under FOIA, and that the extent, content and format of the disclosure is DHSC’s decision. Where possible, prior to any such disclosure involving Confidential Information disclosed to DHSC by the Participating Organisation, the Participating Organisation shall be consulted by the DHSC.

11.3 The Participating Organisation shall permit DHSC to inspect such records as are maintained by the Participating Organisation in relation to its performance of this Agreement as reasonably requested in writing from time to time during the Term of this Agreement.

11.4 In no event shall the Participating Organisation respond directly to a Request For Information (as defined in the Freedom of Information Act 2000, and such term shall include its equivalent under the Environmental Information Regulations 2004) related or otherwise connected to DHSC or this Agreement unless expressly authorised to do so by DHSC.

12. Liability

12.1 Neither party shall be liable to the other party for loss of profits, business, goodwill or anticipated savings, or any indirect or consequential loss or damages suffered or incurred by a party under or in connection with this Agreement.

12.2 Subject to clauses 12.1 and 12.3, the total liability of the Participating Organisation to DHSC under or in connection with this Agreement, whether in contract, tort (including negligence) or otherwise, shall in no circumstances exceed £100,000.

12.3 Nothing in this Agreement shall limit or exclude either party’s liability for:

12.3.1 death or personal injury caused by negligence on the part of the relevant party or its employees, contractors or agents; or

12.3.2 any matter in respect of which it would be unlawful to exclude or restrict liability.

13. Costs

13.1 Each party shall bear its own costs in relation to the Testing Programme and carrying out its responsibilities under this Agreement.

14. Termination

14.1 Either party may terminate this Agreement on not less than 7 days’ notice in writing to the other party.

14.2 On termination or expiry of this Agreement, the Participating Organisation shall, at DHSC’s request, promptly return to DHSC all equipment, materials and property that DHSC has supplied to the Participating Organisation under this Agreement, including any test kits which the Participating Organisation has not used or distributed to Test Subjects.

14.3 The termination of this Agreement shall be without prejudice to the rights and remedies of a party which survive or may have accrued at the date of termination.

15. Publicity

15.1 Neither party shall make any press announcement in relation to, or publicise, this Agreement or any part of it in any way, without the prior written consent of the other party. Consent from any Government Department shall constitute consent by DHSC for these purposes. This clause shall not restrict or prevent any announcement or publicity by a Government Department other than DHSC.

15.2 Subject to clause 15.3, clause 15.1 shall not prevent publicity issued by the Participating Organisation in order to promote the Testing to potential Test Subjects in accordance with this Agreement.

15.3 The Participating Organisation shall only publicise the availability of Testing to potential Test Subjects who are not employees, consultants, directors, contractors or sub-contractors of the Participating Organisation where such publicity is permitted by and in accordance with the Guidance.

15.4 Nothing in this Agreement shall prevent or restrict any information disclosure, publication or announcement required by applicable law or regulation.

15.5 Provided that the Participating Organisation has ordered LFD test kits from DHSC and subject to the Participating Organisation complying with the terms of this Agreement, the Participating Organisation shall be entitled to publicise its participation in the Testing Programme through the display of a physical or virtual ‘We offer testing to our staff’ sticker in the form supplied to the Participating Organisation by DHSC (‘WOTTOS Sticker’). If the Participating Organisation elects to display a WOTTOS Sticker, such WOTTOS Sticker must solely be displayed in an unamended form and in respect of the Participating Organisation’s business and/or premises where its staff are entitled to participate in the Testing Programme. The Participating Organisation shall not distribute any physical WOTTOS Stickers to any third party, and shall promptly remove the WOTTOS Stickers in the event that the Participating Organisation is no longer participating in the Testing Programme or if otherwise requested to do so by DHSC. All intellectual property rights in the WOTTOS Stickers are owned by or licensed to DHSC.

16. Governing Law and Jurisdiction

16.1 This Agreement shall be considered as a contract made in England and shall be subject to the laws of England.

16.2 Both parties agree that the courts of England and Wales shall have exclusive jurisdiction to hear and settle any action, suit, proceeding or dispute in connection with this Agreement and irrevocably submit to the jurisdiction of those courts.

17. General

17.1 Capitalised terms used in this Agreement shall have the meaning set out in these terms and conditions. 17.2 In the event of the transfer of all or a substantial part of DHSC’s relevant activities to one or more government bodies, DHSC’s rights and obligations shall, notwithstanding any provision to the contrary in this Agreement, automatically transfer to such other government body.

17.3 Except as provided elsewhere in this Agreement, a person who is not a party to this Agreement shall not have any rights under or in connection with it.

17.4 If any part of this Agreement is prohibited by law or judged by a court to be unlawful, void or unenforceable, it must be read as if that part was removed from this Agreement as much as required and rendered ineffective as far as possible without affecting the rest of this Agreement, whether its valid or enforceable.

17.5 DHSC may amend this Agreement at any time by issuing a notification to the Participating Organisation that these terms and conditions have been amended and making a copy of the amended terms and conditions available to the Participating Organisation. Such amendments shall be effective 7 days following the date of receipt by the Participating Organisation of such notification in the absence of receipt by DHSC within such 7 days of notice from the Participating Organisation to terminate this Agreement.

17.6 Notices under this Agreement for DHSC shall be sent to the following email address:

P-and-PSector@dhsc.gov.uk

For the Participating Organisation, notices shall be sent to the email address supplied to the Portal as part of Registration or such other address as the relevant party may give notice to the other party for the purpose of service of notices under this Agreement. For the purposes of this Agreement ‘in writing’ includes email. 17.7 This Agreement (including the SOP) is the entire agreement between the parties relating to its subject matter, and replaces all previous statements and agreements whether written or oral.

18. Public sector organisations only

18.1 Where the Participating Organisation is named in the Public Sector Classification Guide as published and amended from time to time by the UK Office for National Statistics, the following provisions of this clause 18 shall apply:

18.1.1 To the extent agreed with DHSC, where the Participating Organisation is participating in ATS Testing, DHSC shall procure a sufficient supply of PPE to the Facility(s) for use by employees, contractors or third parties for the purpose of the Testing. Such PPE may be ordered by the Participating Organisation via the Portal. DHSC confirms that the PPE provided by or on behalf of DHSC under this Agreement shall be fit for purpose. Clause 2.3.13 shall only apply to the extent that such PPE is not provided by DHSC.

18.1.2 Where the Participating Organisation is subject to FOIA, or to the Freedom of Information (Scotland) Act 2002 or the Environmental Information (Scotland) Regulations 2004 (together ‘FOISA’), the reciprocal of clauses 11.1 and 11.2 shall also apply such that ‘Participating Organisation’ is replaced by ‘DHSC’, ‘DHSC’ is replaced by ‘Participating Organisation’, and references to ‘FOIA’ are replaced by ‘FOIA or FOISA as applicable’. Clause 11.4 shall not apply to this Agreement.

18.1.3 Nothing in this Agreement shall be interpreted as limiting, superseding, or otherwise affecting any party’s normal operations in carrying out its statutory, regulatory or other duties.

19. Crown bodies only

19.1.1 Where the Participating Organisation is a Crown Body, where ‘Crown’ means the government of the United Kingdom (including the Northern Ireland Assembly and Executive Committee, the Scottish Ministers and the National Assembly for Wales), including, but not limited to, government ministers and government departments and particular bodies, persons, commissions or agencies from time to time carrying out functions on its behalf, and ‘Crown Body’ means any department, office or executive agency of the Crown (including without limitation any Government Department or Executive Agency of such a Department), the following provisions of this clause 19 shall apply in addition to clause 18:

19.1.2 This Agreement has the status of a Memorandum of Understanding between the parties, in that it is not intended to be legally binding and no legal obligations or legal rights shall arise between the parties from the provisions of the Agreement. Notwithstanding the above, the parties enter into this Agreement intending to honour their obligations.

19.1.3 This Agreement establishes the responsibilities of the parties and the general principles for their cooperation.

19.1.4 The following clauses of this Agreement shall not apply: clauses 10, 11, 12, 14.3, 15, 16 and 17.

Annex – Data processing provisions (only applicable to Workplace Collect Testing)

1. Definitions

1.1 In this Annex:

1.1.1 ‘Data Protection Legislation’ shall mean (i) the retained EU law version of the General Data Protection Regulation (EU) 2016/679 as enacted into English law (UK GDPR) and as revised and superseded from time to time; (ii) the Data Protection Act 2018 (DPA 2018) and as revised and superseded from time to time; (iii) Privacy and Electronic Communications Regulations 2003 and as revised and superseded from time to time; and (iv) any other laws and regulations relating to the Processing of Personal Data and privacy which apply to a Party and, if applicable, the guidance and codes of practice issued by the relevant data protection or supervisory authority and expressly includes the common law duty of confidentiality.

1.1.2 ‘Data Subject’, ‘Controller’, ‘International Organisation’, ‘Personal Data Breach’, ‘Processor’ and ‘Processing’ have the same meaning as in the Data Protection Legislation;

1.1.3 ‘Personal Data’ has the meaning set out in the Data Protection Legislation in relation to data Processed under this Agreement;

1.1.4 ‘Regulator’ means any independent public authority responsible for monitoring the application of the Data Protection Legislation in the UK; and

1.1.5 ‘Third Country’ means any country other than the UK at the time of transfer of Personal Data. 1.2 For the purposes of the Data Protection Legislation, the Participating Organisation is a Processor acting on behalf of DHSC as the Controller (‘DHSC’), in the circumstances identified in Addendum A to this Annex.

2. Obligations

2.1 The Participating Organisation agrees that it will comply with its obligations under the Data Protection Legislation and shall, in relation to any Personal Data Processed in connection with its obligations under this Agreement:

2.1.1 Process the Personal Data only to the extent necessary for the purpose set out in Addendum A to this Annex and in accordance with DHSC’s written instructions (including with respect to transfers of Personal Data to a Third Country or to an International Organisation);

2.1.2 Process that Personal Data only in accordance with Addendum A unless the Participating Organisation is required to do otherwise by applicable law. If it is so required the Participating Organisation shall notify DHSC before Processing the Personal Data unless prohibited by applicable law from doing so; and

2.1.3 ensure that the Data Subjects whose Personal Data are Processed by the Participating Organisation under the Agreement are provided with a privacy notice in the form provided by DHSC and in accordance with any processes notified by DHSC.

2.2 The Participating Organisation will ensure that:

2.2.1 its personnel do not Process the Personal Data except in accordance with this Agreement (and in particular Addendum A to this Annex); and

2.2.2 it takes all reasonable steps to ensure the reliability and integrity of any Participating Organisation personnel who have access to the Personal Data and ensure that they:

(i) are aware of and comply with the Participating Organisation’s duties under this Agreement;

(ii) are subject to appropriate confidentiality undertakings with the Participating Organisation or any subprocessor;

(iii) are informed of the confidential nature of the Personal Data and do not publish, disclose or divulge any of the Personal Data to any third party unless directed in writing to do so by DHSC or as otherwise permitted by this Agreement; and

(iv) take responsibility for the use, care, protection and handling of the Personal Data.

2.3 The Participating Organisation shall notify DHSC, as soon as reasonably practicable, about any request or complaint received from a Data Subject (without responding to that request, unless authorised to do so by DHSC) and assist DHSC by technical and organisational measures, insofar as possible for the fulfilment of DHSC’s obligations in respect of such requests and complaints.

2.4 The Participating Organisation shall notify DHSC immediately if in relation to it Processing Personal Data under or in connection with this Agreement it:

2.4.1 receives any other request, complaint or communication relating to either party’s obligations under the Data Protection Legislation;

2.4.2 receives any communication from the Information Commissioner or any other regulatory authority in connection with Personal Data Processed under this Agreement;

2.4.3 receives a request from any third party for disclosure of Personal Data where compliance with such request is required or purported to be required by law; or

2.4.4 becomes aware of a Personal Data Breach.

2.5 The Participating Organisation shall keep and maintain accurate records and information to demonstrate its compliance with this Annex.

2.6 The Participating Organisation shall on request by DHSC:

2.6.1 taking into account the nature of the Processing and the information available to the Participating Organisation, assist DHSC in ensuring compliance with its obligations under Articles 32 to 36 of the UK GDPR (where applicable) in respect of the Personal Data; and

2.6.2 make available its records and information maintained under paragraph 2.5 and to demonstrate the Participating Organisation’s compliance with this Annex and on reasonable advance notice in writing otherwise permit, and contribute to, audits carried out by DHSC (or its authorised representative) with respect to the Personal Data and its Personal Data Processing activity.

2.7 The Participating Organisation shall:

2.7.1 only allow subprocessors to Process Personal Data under the Agreement where such subprocessors are engaged by the Participating Organisation for the purpose set out in the Addendum A to this Annex and where the Processing by such subprocessors is required for that purpose; and

2.7.2 enter into a written agreement with the subprocessor which give effect to the terms set out in this Annex such that they apply to the subprocessor.

2.8 The Participating Organisation shall promptly on request from DHSC provide to DHSC details of all subprocessors it has allowed to Process Personal Data under the Agreement and such information regarding the subprocessors as DHSC may reasonably require.

2.9 The Participating Organisation shall remain fully liable for all acts or omissions of any of its subprocessors.

2.10 On termination or expiry of the Agreement and from time to time in accordance with any data retention, deletion or destruction requirements notified by DHSC, the Participating Organisation shall destroy, delete or return (as DHSC directs) all Personal Data and delete all existing copies of such data unless required by law to keep or store such Personal Data.

Addendum A – Data Processing details

Description	Details
Circumstances where the Participating Organisation is acting as a Processor on behalf of DHSC	The Participating Organisation acts as a Processor in respect of processing of Personal Data in a Test Kit Log it compiles and maintains on behalf of DHSC for the purposes set out in this Addendum A.
Duration of Processing	The Participating Organisation will gather this data for the term that they run a self-test collect site, or other test site setup which involves the collection of end-user data in line with the purposes specified in this Addendum A (MHRA traceability requirement). The Test Kit Log data will be passed to DHSC on request. The data will be retained as stated in this Addendum A.
Categories of Data Subjects	Test Subjects who have participated in COVID-19 testing at home. The individual appointed by the Participating Organisation to assist with the distribution of Testing Kits to the Test Subjects (insofar as such individual is named in the Test Kit Log).
Type of Personal Data	First name, last name, telephone number of Test Subject, details of lot/batch number for the Testing Kits they receive, location where they received the Testing Kits, date on which they received the Testing Kits and other categories of information set out in the template Test Kit Log. First name, last name of the operator distributing the Testing Kits (insofar as such individual is named in the Test Kit Log).
Nature and purposes of Processing	To be able to fulfil DHSC’s regulatory responsibility to the Medicines and Healthcare products Regulatory Authority (MHRA). As the legal manufacturer or some test kit types, DHSC needs to be able to trace the end user in the event of a batch recall or field safety notice.
How Personal Data is stored	Test Kit Log (whether maintained in an excel file, paper test kit log or other means as required by DHSC) populated by the Participating Organisation (or its operators distributing the Testing Kits) with the Personal Data detailed in this Addendum A.
Retention period	The Personal Data collected by the Participating Organisation is to be passed to DHSC on request. The Personal Data will be kept for no longer than 12 months from the date of collection by the Participating Organisation.
Third Countries to which Personal Data will be transferred to	None.
Subprocessors	Subject to paragraphs 2.7 to 2.9 of the Annex, the Participating Organisation may appoint third parties to carry out data entry into the Test Kit Log where such third parties form part of the personnel operating the self-test collect site for the Participating Organisation.