Skip to main content

Vaccination Bookings for patients of The Ridge Primary Care Network Privacy Notice


Details of what information we collect from you, why we are collecting it, what we do with it, and who it might be shared with

Tunbridge Wells Borough Council are processing (using) data about you to offer you a booking appointment to receive a Coronavirus vaccine.

This is being done by us on behalf of you GP Surgery, in order to expedite the roll-out of the vaccination programme and ensure patients of the Ridge Primary Care Network (PCN) receive a vaccine as soon as possible.

The appointment will be made by us, but the vaccine will be delivered through the NHS either by your GP surgery, or through a vaccination centre. More details will be provided at the time of booking.

In order to book these appointments on behalf of the Ridge PCN, Tunbridge Wells Borough Council will receive the following information from the PCN:

  • Name
  • Date of birth
  • Postcode
  • Telephone number
  • NHS Number

This information is needed by Tunbridge Wells Borough Council in order to ensure the correct person is identified when offering the appointment, and to provide contact details in order to do this.

We are legally allowed to process your data on behalf of the NHS under the Coronavirus (Covid-19): Notice Under Regulation 3(4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI), issued by the Secretary of State for the Department of Health and Social Care on 6 August 2020.

We can only use your data for a purpose(s) identified in that Notice however, which are:

  • understanding COVID-19 and risks to public health, trends in COVID-19 and such risks, and controlling and preventing the spread of COVID-19 and such risks
  • processing to support NHS Test and Trace
  • identifying and understanding information about patients or potential patients with or at risk of COVID-19, information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19
  • understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of COVID-19 and the availability and capacity of those services or that care
  • monitoring and managing the response to COVID-19 by health and social care bodies and the government including providing information to the public about COVID-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services
  • delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of health care and adult social care services
  • research and planning in relation to COVID-19

To process your data we are relying on the condition within Article 6, Paragraph 1(e) of the General Data Protection Regulations:

  • The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

And we are relying on the condition within Article 9, Paragraph 9(g) of the General Data Protection Regulations:

  • Processing is necessary for reasons of substantial public interest, on the basis of Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

We do not need your consent to use your data for this processing, but you do still have rights which can be applied to your data (see below for more information).

Tunbridge Wells Borough Council will retain the data for as long as it is necessary to complete the purpose for the processing, and in any event not longer than 14 January 2023, by which date your data will be deleted from our systems.

Should the Ridge PCN request that we delete your data sooner than this or should the purpose for the processing or the legal gateway no longer be valid, your data will be deleted immediately.

No profiling, monitoring or automated decision making will form part of our processing of your data.

We may decide to match the data we receive from the Ridge PCN with our own records (such as Council Tax records) if the contact information we receive is out of date, but we will not use this contact information for any other reason than to offer you a booking appointment for the Coronavirus vaccine, or for the reason we have originally collected the data from you.

We will not share our data with the Ridge PCN unless an appropriate data sharing agreement has been agreed and a legal gateway identified.

No other organisations will be recipients of your data.

All data held by Tunbridge Wells Borough Council is stored securely on servers within the UK and will not be sent outside of the European Economic Area (EEA).

Only limited people within the organisation, and designated representatives within our organisation will have access to your data. The data will only be held in password protected, electronic format, stored on servers within the EEA.

You have a right to:

Be informed about how we will use your personal data (see this privacy notice).

Request access to your personal data (a Subject Access Request).

Request a copy of your personal data in an accessible (machine readable) format.

Object to the way in which your data is used by us.

Ask us to rectify your personal data (if you believe it to be incorrect).

Ask us to delete your personal data.

Ask us to restrict the use of your personal data.

Ask us to process your information using human decision making (rather than automation or computer decision making).

We do not have to grant any requests resulting from the exercise of your rights above, but we do have to respond to you as soon as possible (or within one month) with reasons why we have denied them.
Where you have requested to exercise your rights under data protection laws, we will notify all other recipient organisations of your request. They will consider your request separately and may or may not grant the request depending on their own assessment.

We will not be receiving any data regarding children for the purposes of this processing.

If you have any questions or concerns about your personal data, or would like to exercise any of your rights under the Data Protection Act, please contact Jane Clarke, Data Protection Officer, Tunbridge Wells Borough Council, dataprotection@tunbridgewells.gov.uk, or call 01892 554077.

If you wish to make a complaint about how the Council is handling your data, you can email dataprotection@tunbridgewells.gov.uk or contact the Information Commissioner’s Officer at the ICO website, or call 0303 123 1113.