Product description

The Long COVID Dashboard is used by NHS organisations responsible for NHS Long COVID services to provide them with information about:

• the operation of the Long COVID care services across England, including how busy each service is and the capacity of each service
• how long patients currently have to wait to be treated by their local Long COVID treatment service

The Dashboard enables the NHS to provide the appropriate care services to those patients suffering from Long COVID by understanding the demand on Long COVID services and to target funding at those services where the patient demand exceeds the service capacity.

What are the purposes for processing my personal data in this Product?

The Dashboard helps  the NHS to  understand how many patients are accessing the Long COVID services and why. By having a clearer understanding of how the services are being used, the NHS can continually improve patient experience at the Long COVID service facilities and better co-ordinate patient care across the services.

The Dashboard does not show any personal information (called ‘personal data under data protection laws) to the NHS colleague who is using the Dashboard – the user will only see aggregated numbers, such as the total number of patients using a particular Long COVID service. But, personal information is used in order to create the aggregate information which is shown in the Dashboards.

The personal information which is used to create the Dashboard relates to patients who have received treatment for Long COVID from an NHS hospital or from NHS Long COVID services. Before being displayed in the Dashboard, the information which can be used to identify you is removed.  The information which is removed includes your name, NHS number, full address and full date of birth. That information is removed before it even enters the Federated Data Platform.

The Dashboards allow the NHS to improve the safety, co-ordination, and delivery of Long COVID Services by giving an oversight of the performance of those services. The Dashboards also help identify problems with the services which need to be resolved.

What personal information about me is used in this Product?

To create the Dashboard, we use personal data about patients who have used Long COVID Services.  We remove information which can identify individuals and then the Dashboard only displays the numbers of individuals who fall into different categories – none of the information in the Dashboard can be used to identify a person.

The personal data which is used to create the Dashboard is:

• the postcode for the patient’s home address
• the patient’s age
• the patient’s gender
• information about the patient’s medical conditions, diagnosis and treatment (which relate to Long COVID)

The dashboard also shows operational information about Long COVID services including:

• waiting times for each Long COVID service
• capacity of each Long COVID service

Who is my personal information shared with?

We remove the information which can identify an individual from the personal information we use to create the Dashboard.  That information, which is ‘de-identified’, is analysed by a small number of data analysts in NHS England. The analysts use that information to create the anonymous, aggregated information which is then displayed in the Dashboards. The information in the Dashboard relate to the number of patients who fall into a particular category – they don’t identify any particular person. When the information is displayed in the Dashboard, it is no longer personal data.

Your personal data will not therefore be shared with any other organisation as part of the Dashboard.

Authorised users from NHS England and certain other NHS organisations (called Integrated Care Boards) can access the anonymous data in the dashboards for the reasons we explained above.

UK GDPR Information

Controllers of your personal data

The UK General Data Protection Regulation is one of the most important laws in the UK relating to data protection (which is about protecting information about people).

Under the UK GDPR, NHS England is the controller of your personal data which is used in the background to create the Dashboard (but which doesn’t appear in the dashboard). This means that NHS England is the organisation which is responsible for taking care of your personal information for the purpose of creating the Dashboards.

Legal grounds for processing your personal data

Under the UK GDPR, we need to rely on a ‘lawful basis’ to use your personal data.  There are six different ‘lawful basis’ to choose from and they are listed in Article 6 of the UK GDPR.  When we use information about your health, we also need to rely on a second lawful basis which are listed in Article 9 of the UK GDPR.

To create the Dashboard, the lawful basis which we are relying on are:

• legal obligation – Article 6(1)(c)… ‘the processing is necessary for compliance with a legal obligation’. This lawful basis applies as NHS England is directed under a law (section 254 of the Health and Social Care Act 2012) to collect and analyse personal data for the purpose of producing the dashboards
• substantial public interest – Article 9(2)(g) ‘processing is necessary for reasons of substantial public interest’. We also rely on the lawful basis which is set out in Schedule 1, Part 2, Paragraph 6 of the Data Protection Act 2018 as we’re using the data for “statutory etc and government purposes”. This We rely on this lawful basis as we are using the personal data under the legal obligation described above

Processor acting on behalf of NHS England

Under data protection, a processor is an organisation which can only use specific personal information as instructed by a controller.

To create the Dashboard, NHS England is the controller of your personal information which is de-identified. The Dashboard sits on the Federated Data Platform.  We use Palantir Technologies UK LTD to provide the Federated Data Platform as our processor. Palantir provides the data platform and the technology that the Dashboard uses and can only act on the instructions of NHS England when using the personal data.

Your rights under UK GDPR

You have the following rights under UK GDPR in relation to our use of your personal information to create the Dashboard:

• right to be informed
• right of access
• right to rectify

You can read more about each of these rights in our NHS Federated Data Platform Privacy Notice.

You can contact NHS England’s Data Protection Officer at england.dpo@nhs.net.

Does the National Data Opt Out or any other opt out apply to the Dashboard?

The National Data Opt-Out gives individuals an opportunity to ‘opt-out’ from their personal information being used for purposes other than for their direct care.  The opt-out does not apply in every situation.

The National Data Opt-Out does not apply for the use of your data to create the Dashboard. This is because we are required by law to use your data to create the Dashboard.

More information about when the National Data Opt Out does not apply is available at When your choice about sharing data from your health records does not apply – NHS (www.nhs.uk)

Another type of opt-out is the ‘Type One Opt Outs’ which can prevent your information from leaving your GP practice.  The Type One Opt Outs do not apply to the Dashboards as no confidential patient information obtained from GP Practices is used to create the Dashboard.

More information

For more information about how personal data is processed within the Federated Data Platform please see the NHS Federated Data Platform Privacy Notice

Last updated date: 7 June  2024