Privacy Notice

This privacy notice explains how your personal information may be used as part of the COVID-19, Flu and Respiratory Syncytial Virus (RSV) vaccination programmes for 2026–2028.

NHS Wales needs certain information to identify eligible patients, send invitations, and manage vaccination programmes safely and effectively.

Why your information is shared

To enable the deployment of the COVID-19, influenza (flu) and respiratory syncytial virus (RSV) vaccination programmes Welsh Ministers have directed Local Health Boards to request GP practices to make the following information available to Digital Health and Care Wales (DHCW) for the purpose of identifying priority groups, to send invitations, to book appointments for COVID-19, flu and RSV vaccinations and to manage and monitor immunisations via the Welsh Immunisation System.

Data being collected

Information reasonably required by DHCW to identify individuals eligible for a COVID-19, flu and RSV vaccination (in line with the eligibility criteria set out in the UK Health Security Agency’s Green Book (UKHSA Green Book) and reflected in the relevant Welsh Health Circulars (WHCs), and to support the management, delivery and reporting of the vaccination programmes to those eligible.

Such relevant information includes (but is not limited to):

The eligible person’s NHS number.
The category of the underlying health condition which makes the individual eligible to receive a COVID-19, flu or RSV vaccination.

How data is used and disclosed

As directed by ABUHB, relevant information concerning eligible patients will be extracted from GP systems by DHCW and will be added to the Welsh Immunisation System.

This is necessary for the effective monitoring and deployment of the COVID-19, flu and RSV vaccination programmes.

Delivery of the 2026 – 2028 COVID-19, Flu and RSV Vaccination Programmes

The data will be used to:

Identify relevant eligibility for vaccination and allow eligible patients to be appropriately offered COVID-19, flu and RSV vaccinations.
Allow invitations to be issued to eligible patients.
Allow vaccination appointments to be booked.
Support administrative processes relating to effective resource planning and delivery of the COVID-19, flu and RSV programmes.

Reporting on the 2025–26 Flu Programme

The data will also be used to process information collected during the 2025–26 flu vaccination programme for statutory reporting purposes.

Statistical and monitoring purposes

The information may also be used:

To manage and monitor COVID-19, flu and RSV immunisations.
To assess the effectiveness of the vaccination programme.
To support development and publishing of routine reports using anonymised data by NHS Wales staff.

This reporting will subsequently inform decisions about how to improve COVID-19, flu and RSV programme delivery by NHS Wales and Welsh Government.

Legal basis for processing

In accordance with paragraph 85 of Schedule 3 to the National Health Service (General Medical Services Contracts) (Wales) Regulations 2023 (“GMS Contract Regulations”), Welsh Ministers have directed Local Health Boards to request GP contractors disclose the relevant information for the delivery of the COVID-19, flu and RSV vaccination programmes, in line with the eligibility criteria set out in the UKHSA Green Book and reflected in the relevant WHCs.

GP contractors are required to comply with this request under the terms of the GMS Contract Regulations.

Local Health Boards will authorise DHCW in writing to collect and process this information as reasonably required in connection with the Local Health Board’s functions in respect of the COVID-19, flu and RSV vaccination programmes.

DHCW is directed to collect and process the relevant information from GPs for the purposes of delivering the COVID-19, flu and RSV vaccination programmes.

For GDPR purposes the Practice’s lawful basis for processing this information is:

Article 6(1)(e) – exercise of official authority
Article 9(2)(h) – health and social care
Article 9(2)(i) – public health purposes

Directions have been issued as follows that enable this processing to take place:

Local Health Boards (“LHBs”) in exercise of the power conferred by section 12(3) of the National Health Service (Wales) Act 2006 (“NHS (Wales) Act 2006”) for the purposes of the provision of information under paragraph 85 of Schedule 3 to the GMS Contract Regulations.
Digital Health and Care Wales (“DHCW”) in exercise of the power conferred by section 23(1) of the NHS (Wales) Act 2006, for the purposes of article 3(a) and (b) of the Digital Health and Care Wales (Establishment and Membership) Order 2020 and paragraph 3(1)(a) of the Digital Health and Care Wales (No.2) Directions 2021.

How your information is stored and protected

Your personal information is protected in several ways.

The information required will be securely extracted from the practice system.
It will be stored by DHCW on computer systems that have been tested to ensure they are secure.
Systems are kept up to date to protect them from viruses and hacking.
Your personal information is stored only within the UK.
Only staff who have been specifically trained to protect your privacy can access the information.
Strict controls ensure staff can only see the minimum information necessary to do their job.

Your rights over your information

Under data protection law, you have a number of rights over your personal information.

You have the right to:

Ask for a copy of any information we hold about you.
Ask for any information we hold about you that you think is inaccurate and needs to be changed.
Ask us to restrict our use of your information, for example where you think the information we are using is inaccurate.
Object to us using any information we hold about you (this is not an absolute right).
Ask us to delete information we hold about you (this may not always be possible).
Ask us not to use your information to make automated decisions about you without the involvement of one of our staff.

You can access any of your rights by contacting the practice.