Purpose for processing

The purpose of this campaign, supporting NHS England’s responsibility to promote health equity and better outcomes, is to deliver a national proactive outreach campaign for the Personalised Prevention Services (PPS) Talking Therapies. The service aims to help people who may benefit from support for anxiety, depression, or low mood, related to long‑term conditions, recognise if the service could support them, encourage self-referral, and provide them with clear information about available NHS Talking Therapies services.

The PPS service will use Cohorting‑as‑a‑Service (CaaS), Select People for Invitation (SPI)  to identify qualifying adults, and notifications will be sent via NHS Notify.

These NHS England systems, which have their access restricted to only authorised staff, only require a small amount of personal data to assess eligibility. For this campaign, your NHS Number, postcode, age and matching diagnostic codes for specific long-term conditions are used invitations will be delivered via SMS message.

No personal data capable of identifying you is shared with any local Talking Therapies service providers.

All personal data is secured with access restricted to authorised NHS England Staff in line with the Data Security and Protection Toolkit and ISO 27001 standards. Anonymised information (information you cannot be identified from), for example, metrics that show uptake rates, may be shared for service improvement with the team leading the campaign.

Categories of personal data

NHS England processes the following types of personal data:

Personal data:

• NHS Number
• Age
• Postcode

Special category data (health data):

• Diagnostic codes indicating the presence of one or more specified long‑term conditions
• Indicators of mental health‑related need

Who we share data with

• We do not share any personal data with anyone outside of NHS England.
• Anonymised metrics (for example: uptake rates) may be shared for service improvement with the team leading the campaign.

Retention

How long we keep the data:

• Cohorting as a Service, and the Select People for Invite service, has its data deleted after two years, in line with our data retention policy.
• Suppression record (to prevent repeat notifications): Up to two years.

Where we store the data:

Your data is stored securely in NHS England’s internal systems. These systems are hosted on accredited UK-based servers compliant with the NHS Data Security and Protection Toolkit and ISO 27001 standards. Data is encrypted with access restricted to authorised NHS staff on a need-to-know basis through role-based access controls and multi-factor authentication. No data is stored outside the UK or in cloud services without equivalent safeguards.

Legal Basis for Processing

This processing activity is regarded as Direct Care

Personal Data:

• UK GDPR Article 6(1)(e):
  Processing is necessary for the performance of a public task carried out in the exercise of official authority vested in NHS England. Supported by;
• NHS Act 2006, sections:
• 13E and 13G which requires NHS England to secure continuous improvement in the quality and access to health services.
• 13H requires NHS England must promote the involvement of patients, their carers, and representatives in decisions related to the prevention or diagnosis of illness and their care or treatment.

Special Category Data (Health Data):

• UK GDPR Article 9(2)(h):
  The processing is necessary for the “provision of health or social care or treatment”

supported by DPA 2018 Schedule 1, Part 1, paragraph 2(2)(f).

Common Law Duty of Confidentiality:

The common law duty of confidentiality is met by implied consent for processing of the data for direct care.