The NHS Business Services Authority (NHSBSA) is responsible for the administration of the Vaccine Damage Payment Scheme (VDPS), while the Department of Health & Social Care (DHSC) is responsible for the policy.
DHSC and the NHSBSA are joint controllers of data related to the VDPS. This privacy notice explains what information we collect when you use this service. It also contains information about how we use, store, and transfer that information to build trust in the service and its operations.
Why we process your information
We will use the information you provide to:
- assess and process your application
- pay you
- check for fraud and errors
- analyse general trends to support more effective planning of NHS services
By law, we must process this information to be able to provide this service.
We will ask you for:
- information to identify you, and if necessary, your partner or any named individual provided on the claims form
- your contact details
- bank account details, which will be requested to process your payment if your claim is successful
We will collect information to support your claim which includes medical records, National Insurance number, and any supporting information you may wish to provide to support your claim.
Your information will not be transferred outside the UK, Isle of Man or your country of residency.
Sharing your information
We may share your information with:
- the Department of Health and Social Care (DHSC) for audit, planning, policy and information purposes, and to assist with complex cases
- Centre for Health and Disability Assessments (CHDA) or Crawford & Company and RTW Plus/Pertemps Medical to assess your claim
- His Majesty’s Courts and Tribunals Service (HMCTS) to process any appeals
Your information may be shared with other organisations if they have a legal right to it.
Confidential patient information
When necessary, we will only share information that can identify you with those:
- directly involved in reviewing and processing your claim
- with a legal right to it
- who you have given us permission to share with
Keeping your personal information
Your personal data will be retained for no longer than is necessary for the purpose for which it was obtained. The retention period is dependent upon the outcome of your application.
- If a claim is rejected without medical records being assessed, the claims form will be retained for 6 years. For example, the claim does not qualify where a vaccine was given outside the UK or Isle of Man (the full eligibility list is available on the GOV.UK Vaccine Damage Payment page). Notice of claim made will be retained indefinitely.
- If your claim is successful, medical records will be retained for 6 years. Notice of payment will be retained for 50 years.
- All other rejected claims will be retained for 150 years to allow for any future appeals by you or your next of kin. Notice of claim made will be retained indefinitely.
Anonymised information will be retained for planning and information purposes such as dates, vaccine administered, medical condition(s) and decision made.
The UK Covid-19 Inquiry may require us to retain your personal data for longer than 6 years.
Your rights
The information you provided will be managed as required by Data Protection law.
You have the right to:
- receive a copy of the information the NHSBSA holds about you
- request your information be changed if you believe it was not correct at the time you provided it
- request that your information be deleted if you believe the NHSBSA is processing it for longer than is necessary
- withdraw consent at any time without any consequence to you
- have access to your information restricted when you request your information be changed or use your right to be forgotten
Find out more about your rights and how we process information.