COVID-19 Privacy Notice

As we move away from the initial response to COVID-19 the health and social care system will need to continue to take action to manage and mitigate the spread and impact of the outbreak.

We have been given notice, under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) to process data for purposes set out in Regulation 3(1) of COPI

Purpose and requirement of this Notice

The purpose of this notice under Regulation 3(4) requires us to process confidential patient information, including disseminating to a person or organisation permitted to process confidential patient information under Regulation 3(3) of COPI for the purposes set out in Regulation 3(1) of COPI to support the Secretary of State’s response to COVID-19 (Covid-19 Purpose).

Organisations are only required to process such confidential patient information:

  • where the confidential patient information to be processed is required for a COVID-19 Purpose and will be processed solely for that COVID-19 Purpose in accordance with Regulation 7 of COPI
  • from the date of this Notice until 31 October 2022 (which includes a case where the dissemination of the information in question was authorised by a previous regulation 3(4) Notice and began before the date of this Notice, but which continues on or after that date)


We will demonstrate effective compliance by carrying out the required processing using the OpenSAFELY platform

Covid-19 Purpose.

A COVID-19 Purpose includes but is not limited to the following:

  • understanding COVID-19 and risks to public health, trends in COVID-19 and such risks, and controlling and preventing the spread of COVID-19 and such risks
  • processing to support the NHS Test and Trace programme
  • identifying and understanding information about patients or potential patients with or at risk of COVID-19, information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19
  • understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of COVID-19 and the availability and capacity of those services or that care
  • monitoring and managing the response to COVID-19 by health and social care bodies and the Government including providing information to the public about COVID-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services
  • delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of health care and adult social care services
  • research and planning in relation to COVID-19 

Recording of processing

 A record will be kept by The Kakoty Practice of all data processed under this Notice.

Sending Public Health Messages

Data protection and electronic communication laws will not stop us from sending public health messages to you, either by phone, text or email as these messages are not direct marketing.

Visitors to The Practice

We have an obligation to protect our staff and employees’ health, so it is reasonable for staff at The Kakoty Practice to ask any visitors to our practice to tell us if they have visited a particular country or are experiencing COVID-19 symptoms. This must only be in pre-approved circumstances and we would also ask all patients to consider government advice on the NHS 111 website and not attend the practice.

Where it is necessary for us to collect information and specific health data about visitors to our practice, we will not collect more information than we need, and we will ensure that any information collected is treated with the appropriate safeguards.

 Review and Expiry of this Notice

This Notice will be reviewed on or before 31st October 2022 and may be extended by The Secretary of State.  If no further notice is sent to us by The Secretary of State this Notice will expire on 31st October 2022.