PRIVACY NOTICE –COVID-19 / FLU / RSV VACCINATION PROGRAMME 2026-28

To enable the deployment of the COVID-19, influenza (flu) and respiratory syncytial virus (RSV) vaccination programmes Welsh Ministers have directed Local Health Boards to request GP practices to make the following information available to Digital Health and Care Wales (DHCW) for the purpose of identifying priority groups, to send invitations, to book appointments for COVID-19, flu and RSV vaccinations and to manage and monitor immunisations via the Welsh Immunisation System.

Data being collected

Information reasonably required by DHCW to identify individuals eligible for a COVID-19, flu and RSV vaccination (in line with the eligibility criteria set out in the UK Health Security Agency’s Green Book (UKHSA Green Book) and reflected in the relevant Welsh Health Circulars (WHCs), and to support the management, delivery and reporting of the vaccination programmes to those eligible. 

Such relevant information includes (but is not limited to):

-       The eligible person’s NHS number.

-       The category of the underlying health condition which makes the individual eligible to receive a COVID-19, flu or RSV vaccination.

How data is used and disclosed

As directed by Powys Teaching Health Board relevant information concerning eligible patients will be extracted from GP systems by DHCW and will be added to the Welsh Immunisation System.

This is necessary for the effective monitoring and deployment of the COVID-19, flu and RSV vaccination programmes. The data will be used for:

1.    Delivery of the 2026 - 2028 COVID-19, Flu and RSV Vaccination Programmes:

·         To identify relevant eligibility for vaccination and allow eligible patients to be appropriately offered COVID-19, flu and RSV vaccinations.

·         To allow invitations to be issued to eligible patients.

·         To allow vaccination appointments to be booked.

·         To support administrative processes relating to effective resource planning and delivery of the COVID-19, flu and RSV programmes.

2.    Reporting on the 2025-26 Flu Programme

·         The data will also be used to process information collected during the 2025-26 flu vaccination programme for statutory reporting purposes.

3.    Statistical and monitoring purposes

·         To manage and monitor COVID-19, flu and RSV immunisations.

·         To assess the effectiveness of the vaccination programme.

·         To support development and publishing of routine reports using anonymised data by NHS Wales staff. This reporting will subsequently inform decisions about how to improve COVID-19, flu and RSV programme delivery by NHS Wales and Welsh Government.

Legal basis for processing

In accordance with paragraph 85 of Schedule 3 to the National Health Service (General Medical Services Contracts) (Wales) Regulations 2023 (“GMS Contract Regulations”), Welsh Ministers have directed Local Health Boards to request GP contractors disclose the relevant information for the delivery of the COVID-19, flu and RSV vaccination programmes, in line with the eligibility criteria set out in the UKHSA Green Book and reflected in the relevant WHCs. GP contractors are required to comply with this request under the terms of the GMS Contract Regulations.

Local Health Boards will authorise DHCW in writing to collect and process this information as reasonably required in connection with the Local Health Board’s functions in respect of the COVID-19, flu and RSV vaccination programmes.

DHCW is directed to collect and process the relevant information from GPs for the purposes of delivering the COVID-19, flu and RSV vaccination programmes.

For GDPR Purposes the Practice’s lawful basis for processing this information is Article 6(1)(e) exercise of official authority and for the processing of special categories (health) data the conditions are 9(2)(h) Health and social care and 9(2)(i) public health purposes.

Directions have been issued as follows that enable this processing to take place:

a)      Local Health Boards (“LHBs”) in exercise of the power conferred by section 12(3) of the National Health Service (Wales) Act 2006 (“NHS (Wales) Act 2006”) for the purposes of the provision of information under paragraph 85 of Schedule 3 to the GMS Contract Regulations, and

b)     Digital Health and Care Wales (“DHCW”) in exercise of the power conferred by section 23(1) of the NHS (Wales) Act 2006, for the purposes of article 3(a) and (b) of the Digital Health and Care Wales (Establishment and Membership) Order 2020 and paragraph 3(1)(a) of the Digital Health and Care Wales (No.2) Directions 2021.

How your information is stored and protected

Your personal information is protected in several ways. The information required will be securely extracted from the practice system and stored by DHCW on computer systems that have been tested to make sure they are secure and which are kept up to date to protect them from viruses and hacking.

Your personal information is only stored within the UK and can only be seen by staff who have been specifically trained to protect your privacy.

Strong controls are in place to make sure all these staff can only see the minimum amount of personal information they need to do their job.

Your Rights over your information

Under data protection law, you have a number of rights over your personal information. You have the right to:

·         ask for a copy of any information we hold about you;

·         ask for any information we hold about you that you think is inaccurate and needs to be changed;

·         ask us to restrict our use of your information, for example, where you think the information we are using is inaccurate;

·         object to us using any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case;

·         delete any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case; and

·         ask us not to use your information to make automated decisions about you without the involvement of one of our staff.

You can access any of your rights by contacting the practice.