This privacy notice explains how your personal information may be used as part of the COVID-19, flu and Respiratory Syncytial Virus (RSV) vaccination programmes for 2026 to 2028.

NHS Wales needs certain information to identify eligible patients, send invitations and manage vaccination programmes safely and effectively.

Why your information is shared

To support the COVID-19, influenza, also known as flu, and Respiratory Syncytial Virus, also known as RSV, vaccination programmes, Welsh Ministers have directed Local Health Boards to request GP practices to make information available to Digital Health and Care Wales, also known as DHCW.

This information is used to identify priority groups, send invitations, book appointments for COVID-19, flu and RSV vaccinations, and manage and monitor immunisations through the Welsh Immunisation System.

What information is collected

DHCW will collect information reasonably required to identify individuals who are eligible for a COVID-19, flu or RSV vaccination.

This is based on the eligibility criteria set out in the UK Health Security Agency’s Green Book and reflected in the relevant Welsh Health Circulars.

Relevant information includes, but is not limited to:

  • The eligible person’s NHS number
  • The category of the underlying health condition which makes the person eligible to receive a COVID-19, flu or RSV vaccination
How your information is used

As directed by the Local Health Board, relevant information about eligible patients will be extracted from GP systems by DHCW and added to the Welsh Immunisation System.

This is necessary for the effective monitoring and delivery of the COVID-19, flu and RSV vaccination programmes.

Delivery of the 2026 to 2028 vaccination programmes

The data will be used to:

  • Identify eligibility for vaccination
  • Allow eligible patients to be offered COVID-19, flu and RSV vaccinations
  • Allow invitations to be issued to eligible patients
  • Allow vaccination appointments to be booked
  • Support administrative processes relating to effective resource planning and delivery of the COVID-19, flu and RSV programmes

Reporting on the 2025 to 2026 flu programme

The data will also be used to process information collected during the 2025 to 2026 flu vaccination programme for statutory reporting purposes.

Statistical and monitoring purposes

The information may also be used:

  • To manage and monitor COVID-19, flu and RSV immunisations
  • To assess the effectiveness of the vaccination programme
  • To support the development and publication of routine reports using anonymised data by NHS Wales staff

This reporting will help inform decisions about how NHS Wales and Welsh Government can improve COVID-19, flu and RSV programme delivery.

Legal basis for processing

In accordance with paragraph 85 of Schedule 3 to the National Health Service (General Medical Services Contracts) (Wales) Regulations 2023, also known as the GMS Contract Regulations, Welsh Ministers have directed Local Health Boards to request GP contractors disclose the relevant information.

This is for the delivery of the COVID-19, flu and RSV vaccination programmes, in line with the eligibility criteria set out in the UKHSA Green Book and reflected in the relevant Welsh Health Circulars.

GP contractors are required to comply with this request under the terms of the GMS Contract Regulations.

Local Health Boards will authorise DHCW in writing to collect and process this information as reasonably required in connection with the Local Health Board’s functions for the vaccination programmes.

DHCW is directed to collect and process the relevant information from GPs for the purposes of delivering the COVID-19, flu and RSV vaccination programmes.

Lawful basis under GDPR

For GDPR purposes, the practice’s lawful basis for processing this information is:

  • Article 6(1)(e) — exercise of official authority
  • Article 9(2)(h) — health and social care
  • Article 9(2)(i) — public health purposes

Directions enabling processing

Directions have been issued to enable this processing to take place:

  • Local Health Boards, in exercise of the power conferred by section 12(3) of the National Health Service (Wales) Act 2006, for the purposes of providing information under paragraph 85 of Schedule 3 to the GMS Contract Regulations.
  • Digital Health and Care Wales, in exercise of the power conferred by section 23(1) of the National Health Service (Wales) Act 2006, for the purposes of article 3(a) and (b) of the Digital Health and Care Wales (Establishment and Membership) Order 2020 and paragraph 3(1)(a) of the Digital Health and Care Wales (No.2) Directions 2021.
How your information is stored and protected

Your personal information is protected in several ways.

  • The information required will be securely extracted from the practice system
  • It will be stored by DHCW on computer systems that have been tested to ensure they are secure
  • Systems are kept up to date to protect them from viruses and hacking
  • Your personal information is stored only within the UK
  • Only staff who have been specifically trained to protect your privacy can access the information
  • Strict controls ensure staff can only see the minimum information necessary to do their job
Your rights over your information

Under data protection law, you have a number of rights over your personal information.

You have the right to:

  • Ask for a copy of any information we hold about you
  • Ask for any information we hold about you that you think is inaccurate and needs to be changed
  • Ask us to restrict our use of your information, for example where you think the information we are using is inaccurate
  • Object to us using any information we hold about you, although this is not an absolute right
  • Ask us to delete information we hold about you, although this may not always be possible
  • Ask us not to use your information to make automated decisions about you without the involvement of one of our staff

You can access any of your rights by contacting the practice.