As part of the Department of Health and Social Care’s (DHSC, we or us) statutory functions we process special category of data as part of providing the NHS COVID-19 app. Special Category of Data is defined by Article 9 of the General Data Protection Regulations (‘GDPR’) and Schedule 1 of the Data Protection Act 2019 (‘DPA 2018’). We process the special category of data was process in accordance with the requirements set by the law. We do not process any criminal offence data, as defined by this legislation. ...
...
Data held only on the app on your phone will include:
- Data concerning health – such as your COVID-19 test result and your isolation status
- Venue details held only on your phone, might be indicative of other special categories of data. However, these details are only stored in your app. The summary or count included in the analytical data set does not include these details.
For example, a venue may indicate:
- Racial or ethnic origin;
- Political opinions;
- Religious or philosophical beliefs;
- Trade union membership;
- Data concerning a natural person’s sex life or sexual orientation.
- However, our systems cannot access or process this data we note it here to support transparency.
The central systems that we use to update app users’ processes COVID-19 test results for app users and enables the app to update their status. In order to ensure that the correct results are returned to the correct use we treat this as personal data, though we protect the identity of the app user (through pseudonymisation in GDPR terms) and promptly delete the data from our systems. So, for the central system we process:
- Data concerning health – such as your COVID-19 test result
The analytical data set, submitted every 6-hours, is managed to ensure that app users cannot be identified.
