Privacy Notice

Privacy Notice – Department of Health (DoH)

This is the Privacy Notice for the COVID-19 NI app which can be downloaded to mobile devices from the Google Play and Apple Stores. The app is designed to help the public in Northern Ireland keep up to date with the latest advice on the Covid-19 pandemic. The app was developed on behalf of the Department of Health and Health and Social Care organisations across Northern Ireland (HSCNI). This Privacy Notice provides a broad description of the way your personal information will be processed when submitted via the app.

Why are you processing my personal information?

The primary purpose of this app is to help the public in Northern Ireland keep up to date with the latest advice on the Covid-19 pandemic, helping users to:

• Decide if they have the symptoms of coronavirus infection;
• Depending on the severity of illness, know how to cope and what to do;
• Decide if they need to get clinical advice and how to access it;;
• Give advice to vulnerable members of the public;
• Provide links to trusted information resources;
• Direct individuals to be able to get an isolation note if they have to self-isolate;
• Provide an advice search function of FAQs that will be updated regularly;

The app will also help HSCNI plan services and ensure that resources are directed to the areas of greatest need. 

In order to process personal information HSCNI must have a lawful basis for doing so and at least one of the following must apply:

• Consent: the individual has given clear consent for you to process their personal data for a specific purpose.
• Contract: the processing is necessary for a contract you have with the individual, or because they have asked you to take specific steps before entering into a contract.
• Legal obligation: the processing is necessary for you to comply with the law (not including contractual obligations).
• Vital interests: the processing is necessary to protect someone’s life.
• Public task: the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law.
• Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)

Processing of data submitted via the Covid-19 NI app is likely to fall under points 4 & 5 above.

What categories of personal data are you processing?

Information submitted by users of the app will not be used by the HSCNI for identification purposes. HSCNI recognises that if we had requested for your date of birth and postcode, for some parts of Northern Ireland the combination of a full postcode when combined with the date of birth may be sufficient for identification. To avoid this, we have instead requested age (as opposed to date of birth), to enable us to provide suitable advice related to age and symptoms, while avoiding potential identification.

The app asks users to indicate if they are adding symptoms for themselves or someone else, age, full NI postcode, does the individual normally get invited for the flu vaccine, whether the individual is pregnant, whether the individual has a high temperature, whether the individual has a new or continuous cough, whether the individual lives with anyone with coronavirus symptoms.

Where do you get my personal data from?

Information is provided by the app user either about themselves or on behalf of someone.

Do you share my personal data with anyone else?

Information submitted via the app may be shared with HSCNI organisations for the purposes of health protection and surveillance. Information may also be shared with Public Health England for the purposes of national disease surveillance.

Information may also be shared with external organisations such as universities, auditors and survey/research organisations etc.

Extracts of information may also appear on HSCNI websites or in Press documents as appropriate across HSC organisations in Northern Ireland, the Department of Health and other government departments.

Do you transfer my personal data to other countries?

Information submitted via the app is stored in secure, cloud storage that is owned by the Northern Ireland Health and Care System and is located in the European Economic Area (EEA) in accordance with the national guidance at this link. This Health and Social Care facility will be transferred to secure, cloud storage specifically in the UK, but this may not happen prior to the end of the Covid-19 pandemic and decommissioning of the Covid-19 NI app.

How long do you keep my personal data?

We will retain personal information in line with specific guidance issued by the Department of Health in Northern Ireland. The length of time we keep your information for will depend on the types of records created. If you want to find out more about how long your records are retained, you can view the “Good Management, Good Records” section under “Disposal Schedule” on Department of Health’s website at this link.

What rights do I have?

The Data Protection Act 2018 and GDPR provide individuals with a number of rights relating to their personal data:

• The right to obtain confirmation that their personal information is being processed and access to personal information;
• The right to have personal information rectified if it is inaccurate or incomplete;
• The right to have personal information erased and to prevent processing, in specific circumstances;
• The right to ‘block’ or suppress processing of personal information, in specific circumstances;
• The right to portability, in specific circumstances;
• The right to object to the processing, in specific circumstances;
• Rights in relation to automated decision making and profiling;

Further information on your rights can be found on the Information Commissioners website at this link.

How do I complain if I am not happy?

If you are unhappy with any aspect of this privacy notice, or with how your personal information is being processed, please contact the Data Protection Officer at the following address:

Data Protection Officer: Charlene McQuillan
Department of Health (DoH)
Castle Buildings
Stormont
Belfast
BT4 3SG
Tel: 028 90522353

Email: DPO@health-ni.gov.uk

If you are still not happy, you have the right to lodge a complaint with the Information Commissioner’s Office (ICO):

Information Commissioner’s Office 
Wycliffe House 
Water Lane 
Wilmslow 
Cheshire 
SK9 5AF
Tel: 0303 123 1113

Email: casework@ico.org.uk 

Website: https://ico.org.uk/global/contact-us/ 

Changes to this Privacy Notice 

This Privacy Notice will be kept under regular review and any updates will be placed on this website.