Purposes for processing

When you call NHS 111 from a mobile phone, mast data are used to route your call to a local NHS provider. These data can locate the device to a small geographic area (typically, within 100m of the device). A local NHS provider is often best placed to deal with your call. Where you are using WiFi calling or we are otherwise unable to determine your location, we will ask you whether we may seek your consent to use geolocation data to route your call to a local NHS provider. These data provide GPS co-ordinates for the device (which can be accurate to a small number of metres). Where you do not wish to provide consent, your call will be picked up and you will be asked for the name of the nearest large town or city. This information is captured by Natural Language Processing, and used to route your call to a local NHS provider. Any mast and geolocation data are stored separately, not shared with any recipient, and deleted after 24 hours.

Categories of personal data

• calling line identification data (CLI data)
• mast data (where available)
• geolocation data (where there is consent)

Categories of recipients

• Vodafone Group Plc provides the telephony service for NHS 111 under contract to NHS England

Legal basis for processing

For GDPR purposes, NHS England’s lawful basis for processing is Article 6(1)(e) – ‘…task carried out in the public interest or in the exercise of official authority…’.

For the processing of special category (health) data, the condition is Article 9(2)(h) – ‘…health or social care…’.

For the use of geolocation data (only), consent is a requirement of The Privacy and Electronic Communications (EC Directive) Regulations 2003.