Providing online consultation services

Purposes for processing

NHS England and NHS Improvement have supported the wider NHS by commissioning online consultation services for GPs and NHS trusts. For the purposes of the General Data Protection Regulation (GDPR):

  • NHS England is a joint controller with GPs for the provision of the eConsult online consultation service
  • NHS Improvement is a joint controller with NHS Trusts for the provision of the Attend Anywhere online consultation service

Sources of the data

For all platforms: personal data required to support the provision of online consultations is collected directly from patients as part of registering for or engaging with the platforms.

For eConsult only: where patients utilise eConsult via the NHS App, the data they supply will be matched with data held by the NHS Login service in order to verify their identity.

For Attend Anywhere only: additional personal data about colleagues are collected from staff in GPs, NHS trusts and NHS Improvement for the purposes of user account creation and management.

Categories of personal data

For eConsult: patients registered with GP’s using the platform.

For Attend Anywhere: patients referred to NHS trusts using the platform, staff of NHS trusts using the platform and staff of NHS Improvement. 

Categories of recipients

For eConsult: GPs only.

For Attend Anywhere: NHS trusts (identifiable patient data), NHS Improvement (clinician data and de-identified consultation metrics), Advanced Solutions (clinician data and de-identified consultation metrics to provide a technical service desk) and Edge (clinician data and de-identified consultation metrics to provide a service evaluation).

Legal basis for processing

For GDPR purposes NHS England’s lawful basis for processing data associated with GPs’ online consultation services is Article 6(1)(e) ‘…exercise of official authority…’. NHS England does not receive or process any special categories of personal data for this purpose.

For GDPR purposes NHS Improvement’s lawful basis for processing data associated with NHS trusts’ online consultation services is Article 6(1)(e) ‘…exercise of official authority…’. NHS Improvement does not receive or process any special categories of personal data for this purpose.