COVID-19 Vaccination Certificate Privacy statement
This statement is designed to help you understand how your COVID-19 vaccination data is processed so that you can have an electronic version of your vaccination certificate.
Your COVID-19 vaccination data forms part of the personal data held about you by Manx Care. Personal data is data which relates to you when you can be identified from that data or from that data when combined with other information which is in the possession of or is likely to come into the possession of Manx Care. The definition of personal data includes any expression of opinion about you and any indication of the intentions of Manx Care or any other person in respect of you.
If you feel that for any reason you might not understand this privacy statement, please contact the Manx Care Data Protection Officer (See contact details below) so that they can discuss this with you in person.
What personal data is processed and how is it used?
If you have chosen to have the COVID-19 vaccination, certain data about that vaccination is held by Manx Care as part of your health records. This includes the dates on which you had your vaccinations as well as the type of vaccine that was used. Further privacy information in relation to Manx Care is available at the Manx Care Privacy Notice page.
This is the specific privacy statement applicable to the Manx Care COVID-19 Vaccination Certificate.
If you don’t opt out of Manx Care sharing a copy of your COVID-19 vaccination data with NHS Digital (information about opting out is available on the Government's COVID-19 website) a copy of this data is transferred to NHS Digital to enable you to access your vaccination certificate.
Your COVID-19 vaccination data includes your NHS number, your name, your date of birth, your gender, your post code and the dates of your COVID-19 vaccinations as well as technical information about the type of vaccine you had. This information will be processed by NHS Digital to produce the electronic vaccination certificate (viewable on the NHS app).
Your NHS number, your name, your date of birth, your gender and your post code have to be provided to NHS Digital to confirm your identity using the Personal Demographics Service (the PDS), which is the national electronic database of NHS patient details, in order for your vaccination certificate to be available on the NHS app. Further privacy information about the PDS is available at the NHS' website.
If you wish to use the NHS app, your name, date of birth and information about each dose of the COVID-19 vaccine administered to you will be used to provide you with an electronic vaccine certificate within the app. Privacy information in respect of the NHS app is available at the NHS' website.
It is important to note that the use of the NHS app is subject to Terms and Conditions, some of which have privacy implications. Information about these Terms and Conditions is available via the links below:
- NHS' Prove who you are to get full access to the NHS App
- NHS' How to prove who you are without photo I.D.
It is important to note that if you don’t opt out, a copy of your COVID-19 vaccination data will be sent to NHS Digital even if you choose not to use the NHS app.
Your vaccination certificate may be used as part of the border controls operated by the Isle of Man Government in response to the COVID-19 pandemic if you wish to travel to the Island. Privacy information about how the certificate will be used is available on the Government's COVID-19 website. It could also be used by travel operators and venues that you wish to access and it will be important for you to consider the privacy aspects of such use. These are not included in this privacy statement.
Where is the data stored and how will it be transferred?
Your vaccination data is held within Medway which is Manx Care’s electronic hospital patient administration system. Medway is hosted on servers located in the Isle of Man.
If you do not opt out, a copy of your COVID-19 vaccination data will be extracted from Medway and then transferred electronically to NHS Digital using MESH. MESH stands for Message Exchange for Social Care and Health and it is the main secure large file transfer service used across health and social care organisations
Once your COVID-19 vaccination data has been transferred, it will be held by NHS Digital to produce your vaccination certificate visible via the NHS app. More information about how NHS Digital holds personal data is available at the NHS' website. Information about how NHS Digital use your information is also available via the NHS' website.
Who can see the data?
Your COVID-19 vaccination data within Medway is accessible by Manx Care.
If you do not opt out and a copy of your vaccination data is transferred to NHS Digital, it will be accessible by GTS for the purposes of the transfer. GTS stands for Government Technology Services which is a function of the Isle of Man Government.
Will your data be used for marketing purposes?
Your data will not be used for marketing purposes nor will your data be provided to any third party so that they can market their products or services to you.
How long is the data kept for?
Information about the retention of your data by Manx Care is available on the Manx Care Privacy Notice.
Any extract of data from Medway used for the purposes of transferring a copy of your COVID-19 vaccination data to NHS Digital will be held by Manx Care for the duration of certification requirements using the NHS app.
Information about the retention of your data by NHS Digital is available on the NHS' website.
If you wish to see the COVID-19 vaccination data processed about you, please contact Manx Care’s Data Protection Officer on:
+44 1624 650731
You have additional rights under the Isle of Man’s data protection legislation such as the right to rectification of incomplete data, the right to object and the right of erasure of data.
If you wish to exercise those rights, or if you wish to make a complaint about how your data has been processed, please contact the Manx Care Data Protection Officer using the details above.
You also have the right to request the Information Commissioner to undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Data Protection Act 2018. You can contact the Information Commissioner on +44 1624 693260 or by emailing firstname.lastname@example.org