Privacy notice

This scheme fulfils the Prime Minister's 21 May 2020 announcement to deliver a system for health and care staff to be exempt from the Immigration Health Surcharge, with eligible cases being backdated to 31 March 2020.

As a result of this announcement, arrangements have been put in place to ensure any non-EEA nationals applying for a Health and Care Visa to work in a health or social care setting, in an eligible occupation, will be exempt from paying the IHS.

The NHS Business Services Authority is responsible for administering the Immigration Health Surcharge Reimbursement Scheme, through which eligible applicants can receive reimbursement for the Immigration Health Surcharge paid during their visa application process.

The Department of Health and Social Care, NHS Business Services Authority and the Home Office are joint data controllers responsible for this service.

The information in this privacy notice shows how and why the organisations responsible for the scheme will handle the personal data you provide in your application to the scheme.

Why we process your information

We will use the information you give in your Immigration Health Surcharge Reimbursement application to:

process and manage your Immigration Health Surcharge reimbursement application
authorise UK Visas and Immigration team (UKVI) part of the Home Office to make a reimbursement payment to you if eligible
consider any Internal or External Review of a refusal to make a reimbursement to you under the Scheme
help plan and make improvements to NHS services
analyse the uptake of the Immigration Health Surcharge reimbursement
analyse with other user information to understand patterns and trends that will be used to plan and make improvements to NHS Services

Your information will not be transferred outside the UK or European Economic Area.

How we gather and use your personal data

By law, we must process this information to be able to provide this service.

We will ask you for:

information to identify you (e.g. name, address, date of birth and National Insurance number)
your Immigration Health Surcharge reference number
details of your qualifying employer in the health or social care sectors
details of your role or job description for the qualifying employer
evidence of your qualifying employment period (pay statements)
details to help us facilitate your payment

We are only allowed to use, gather and share personal information where we have an appropriate legal basis to do so under Data Protection law. The Home Office and the Department of Health and Social Care collects and processes personal information to fulfil its legal and official functions.

We will be processing information under the Article 6(1) (a) of the GDPR – the data subject has given us consent to the processing of his or her personal information. The legal basis for the processing of your data will, also fall under Article 6(1) (e) of the GDPR – that is, that the processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.

Sharing your personal information

To make any reimbursement payments due to you under the Scheme, we will share your personal data with UKVI to make the payments.

To support more effective planning and improvements to NHS services, we may share our understanding of patterns and trends gained from applicants with:

NHS Commissioners and service providers
Department of Health and Social Care
NHS Counter Fraud Authority
The Home Office (United Kingdom Visa and Immigration)

To prevent, detect and investigate fraud and errors, we may share your information with NHS service providers.

Automated decision-making and profiling

Article 22 of the GDPR provides the right not to be subject to a decision made solely on the basis of automated processing which produces legal or other significant effects. Parts of our processing may involve degrees of automation, but complex or adverse decisions will always be taken by a trained officer or caseworker.

We may use personal information, for example from previous applicants, to develop tools that allow us to assess and then process applications in a particular way. This helps us to target our resources and ensure our processing is efficient, allowing us to minimise costs while protecting the public effectively. However, a case officer would still decide these cases. Any profiling must comply with our wider obligations under equality legislation.

Keeping your personal information

We will keep your personal data on our systems and files for as long as you are eligible for the scheme. We will delete your data no later than 7 years from when you leave the scheme.

Your rights

The information you provided will be managed as required by data protection law.

You have the right to:

receive a copy of the information the NHSBSA and the Department of Health and Social Care hold about you
request your information be changed if you believe it was not correct at the time you provided it
request that your information be deleted if you believe we are keeping it for longer than necessary
request a review of the automated decision on whether you are eligible for the Immigration Health Surcharge reimbursement

To request access to personal data we hold about you or to exercise any of these rights, please write to our Data Protection Officer using the contact details provided below.

Postal applications are not being processed because of coronavirus (COVID-19) until further notice.

Find out more about your rights and how we process information.

How do we use cookies?

Find out more about the cookies we use when you use our online services.

Address and contact details of our Data Protection Officer

The Department of Health and Social Care (“the Department”) and NHS Business Services Authority (“NHSBSA”) are joint controllers for the scheme. The Department is also the data controller for its executive agencies (Public Health England and the Medicines and Healthcare Products Regulatory Agency)

The Data Protection Officer is John Ryder who can be contacted by:

DHSC

Data Protection Officer
Department of Health and Social Care
1st Floor North
39 Victoria Street
London
SW1H 0EU

Email: data_protection@dhsc.gov.uk

NHSBSA

Data Protection Officer
Information Governance
NHSBSA
Stella House
Goldcrest Way
Newburn Riverside
Newcastle Upon Tyne
NE15 8NY

Email: dataprotection@nhsbsa.nhs.uk

How to complain

You also have the right to complain to the Information Commissioner's Office about the way we handle your information or respond to your requests for access to your personal information or the exercise of your other rights under the GDPR or the Data Protection Act 2018.