ImmForm Privacy Notice

1- Introduction

 The UK Health Security Agency (UKHSA ), which is an Executive Agency of the Department of Health and Social Care (DHSC), provides the ImmForm system to health care organisations within the UK to help deliver a part of UKHSA’s statutory public health functions. 

The ImmForm system is a website which collects vaccine uptake data relating to England immunisation programmes.It also provides vaccine and medicine ordering facilities to providers of the National Health Service (NHS) in the UK, pharmaceutical wholesalers, and to organisations responsible for ordering centrally supplied vaccines/medicines in Wales, Scotland, and the Crown Dependencies.
 
In order to provide fair and transparent processing under UK data protection law, this notice provides information to the registered users of the ImmForm system, for which extremely limited contact details are processed so that UKHSA can perform its associated public health functions.

2 - Identiy of the data controller

The data controller for the ImmForm system is the Department of Health and Social Care (DHSC), via its executive agency, the UK Health Security Agency (UKHSA).

3 - Contact details of the Data Protection Officer of the data controller

If you have any concerns about how we use and protect your personal information, you can contact the Department of Health and Social Care’s Data Protection Officer at data_protection@dhsc.gov.uk or by writing to:
 
Office of the Data Protection Officer
Department of Health and Social Care
1st Floor North
39 Victoria Street
London SW1H 0EU

4 - Purposes of processing your personal data

We process your personal data for the following public health related purposes:

• To register you as an authorised user of the ImmForm system which allows us to provide you with access to the facilities described in the ImmForm Terms of Use
• To provide you with helpful service messages relating to the public health functions of the ImmForm system.  These include:
  1. Providing you with information about the services you use
  2. Providing services such as sending you the Vaccine Update newsletter or sending you an email about a vaccination programme, such as Tripartite letter (formerly Chief Medical Officer (CMO) letters from the Department of Health and Social Care (DHSC), UKHSA and NHS England
  3. Providing you with relevant vaccine  related information
  4. Responding to your requests
  5. Contacting you about a specific issue (for example, we might call you if there are queries about a vaccine uptake survey or a vaccine supply order)
  6. Personalising the way the ImmForm website content is presented to you (e.g. if you tell us your role is an immunisation coordinator for NHS England local team, we ensure that you have access to vaccine uptake surveys and news items relevant to your role)
  7. To provide contact information for other customers, but only where it is lawful and appropriate for us to do so.  For example, to provide the immunisation coordinator details, email address and telephone number for vaccine uptake surveys – these are only visible to GP practices within that particular NHS England local team, in case they need to contact their immunisation coordinator regarding a commissioning query about that specific survey.
• To conduct necessary research with registered users of the ImmForm system which allows us to facilitate continuous service improvement
• To offer you the option to subscribe or unsubscribe to ImmForm Vaccine Update newsletters

5 - Legal basis for processing your personal data

The legal basis for processing your personal data is outlined below:
 
“processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” as set out in Article 6(1)(e), UK GDPR.]

6 - Condition for processing your special category personal data

The ImmForm system does not process special category personal data.

7 - Categories of personal data processed that may be processed as a result of a call to the service, including special category personal data

We process contact details for registered users, including:

• Name
• email address
• telephone number
• details about the organisation you work for (e.g. NHS England regional team; Integrated Care Boards (ICBs) former Strategic Information Partnerships (STPs); Sub-ICB Locations (SICBLs) former Clinical Commissioning Groups (CCGs); or GP Practice etc.; and
• the role you perform at that organisation (e.g. Screening and Immunisation Lead; Manager; Coordinator; nurse; doctor etc.)
• we collect information on how you use the site for more information please see our Cookie Policy

8 - Categories of recipients of your personal data

Within UKHSA, only a  small number of personnel have access to your personal data, to perform the purposes described above.

9 - Other recipients of your personal data

• In order to perform our public health functions, we may need to share your personal details with other organisations such as:
  • National Health Service within the United Kingdom
  • NHS Business Services Authority (NHSBSA)
  • Distributors
  • Your Local Authority
  • NHS Supply Chain
  • NHS Business Authority
  • Department of Health and Social Care (DHSC)
  • Respective health departments in the Devolved Nations
  • One or more data processors may be used from time to time to deliver the service
• In some very limited role-based and context-specific circumstances, your contact details will be shared with other ImmForm website users, for example, where NHS England immunisation coordinator’s names, email addresses and telephone numbers are displayed on vaccine uptake surveys for GP Practices within that NHS England local team are or SICBLs only

10 - How your personal data is kept secure

We have put in place a range of organisational processes and technical security measures to protect your personal information from loss, misuse and unauthorised access, disclosure, alteration, and destruction.
 
Your information is stored on computer systems that are kept up-to-date and regularly tested to make sure they are secure and protected from viruses and hacking. Our information technology systems use robust security protections and encryption measures.
 
Your personal information can only be seen by staff who have been trained to protect your confidentiality and in understanding laws and regulations such as the Data Protection Act 2018 and the UK GDPR.
 
Strict controls are in place to make sure those staff can only see your information if they need it to do their job, and they are only provided with access to the minimum necessary information. We may also share information with other organisations. Where we do, we take appropriate measures to ensure your information is used lawfully and protected.
 
Whenever possible, we only use your information in a form that does not directly identify you.
 

11 - Details of transfers of personal data to any third countries or international organisations  

The ImmForm system handles personal data within the UK with limited amounts of personal data being processed in the EU by a UKHSA data processor. Processing in the EU is deemed by the UK regulator to provide an adequate level of protection for the rights and freedoms of data subjects.
 

12 - How long we will hold your personal data 

We will only keep your personal information for as long as we need it to protect public health or as otherwise required by law.
 
We will keep your information in accordance with the time periods specified in the Records Management Code of Practice for Health and Social Care 2021.   
 
If you make an enquiry to the ImmForm team, we will keep the details of your enquiry and how it was resolved for 3 years.
 
Vaccine ordering or data submission data will be kept for a minimum of 5 years.
 

13 - The rights available to individuals in respect of the processing 

Under data protection law, you have several rights over your personal information. You have the right to:

• ask for a copy of any information we hold about you
• ask for any information we hold about you to be changed if it is inaccurate (we allow you to correct inaccurate information online yourself within the ImmForm system)
• ask us to consider restricting our use of your information, although this is not an absolute right and we may need to continue to use your information in the interests of public health – we will tell you why if this is the case
• object to us using any information we hold about you, although this is not an absolute right and we may need to continue to use your information: we will tell you why if this is the case
• delete any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case

You can exercise any of your rights by contacting us at:
 
The ImmForm Service Manager
Nobel House
17 Smith Square
London
SW1P 3JR

Email: helpdesk@immform.org.uk or
Telephone: 0207 183 8580
 
Where necessary, you will be asked to provide proof of your identity so that we can be sure we only provide you with your personal information.  You will not be asked to pay a charge for exercising your rights. If you make a request, we will respond to you within one month.

14 - The right to lodge a complaint with the Commissioner

You also have the right to contact the Information Commissioner’s Office if you have any concerns about how we use and protect your personal information. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO’s website at www.ico.org.uk or writing to the ICO at:
 
Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF
 

15 - The right to lodge a complaint with the Commissioner

The personal data processed within the ImmForm system is provided directly by the data subject.
 

16 - Details of the existence of automated decision-making including profiling

The processing of personal data within the ImmForm system does not involve any automated decision-making or profiling.

Updated 26/04/2023