Privacy notice

Now the UK has left the EU, EU and Swiss citizens moving to the UK will be subject to immigration rules and will be required to pay the immigration health surcharge (IHS), paid in full and upfront at the point of visa application.

As agreed with the EU under the Trade and Cooperation Agreement, Department of Health and Social Care (DHSC) has implemented a new scheme whereby certain EU insured S1 holders and students (and their dependants), may be entitled to a full or partial reimbursement of their IHS.

The NHS Business Services Authority is responsible for administering the IHS scheme. This scheme allows eligible applicants to get a reimbursement for the IHS paid during their visa application process.

DHSC, NHS Business Services Authority and the Home Office are joint data controllers responsible for this service.

The information in this privacy notice shows how and why the organisations responsible for the scheme will handle the personal data you provide in your application to the scheme.

Why we process your information

We’ll use the information you give in your IHS reimbursement application to:

  • process and manage your Immigration Health Surcharge reimbursement application
  • authorise NHS Business Services Authority to make a reimbursement payment to you if eligible
  • consider any review of a refusal to make a reimbursement to you under the scheme
  • help plan and make improvements to NHS services
  • analyse the uptake of the IHS reimbursement
  • analyse with other user information to understand patterns and trends that will be used to plan and make improvements to NHS Services

Your information will not be transferred outside the UK or European Economic Area (EEA).

How we gather and use your personal data

By law, we must process this information to be able to provide this service.

We will ask you for:

  • information to identify you, such as your name, address and date of birth
  • your IHS reference number
  • details of your qualifying employer in the health or social care sectors
  • evidence of your qualifying European Health Insurance Card (EHIC)
  • evidence of your qualifying Confirmation of Acceptance of Studies (CAS) statement or equivalent

We’re only allowed to use, gather and share personal information where we have an appropriate legal basis to do so under Data Protection law.

The Home Office and DHSC collects and processes personal information to fulfil its legal and official functions.

We’ll be processing information under the ‘Article 6(1)(a)’ of the GDPR:

“The data subject has given us consent to the processing of his or her personal information”.

The legal basis for the processing of your data will, also fall under ‘Article 6(1)(e)’ of the GDPR:

“The processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”.

Sharing your personal information

To make any reimbursement payments due to you under the scheme, we’ll share your personal data with United Kingdom Visa and Immigration (UKVI) to make the payments via UKVI’s payment portal.

To support more effective planning and improvements to NHS services, we may share our understanding of patterns and trends gained from applicants with:

  • NHS Commissioners and service providers
  • DHSC
  • NHS Counter Fraud Authority (NHSCFA)
  • The Home Office (UKVI)

To prevent, detect and investigate fraud and errors, we may share your information with NHS service providers.

Automated decision-making and profiling

Article 22 of the GDPR provides the right not to be subject to a decision made solely on the basis of automated processing.

Although some of our processes are automated, no decisions will be made about you based solely on automated decision-making. Automatic decision-making is where a decision is taken about you using an electronic system without human involvement. Decisions will always be taken by a trained officer or caseworker.

We may use personal information, for example, from previous applicants, to develop tools that allow us to assess and then process applications in a particular way. This helps us to target our resources and make sure our processing is efficient. This allows us to minimise costs while protecting the public effectively. However, a case officer would still decide these cases. Any profiling must comply with our wider obligations under equality legislation.

Keeping your personal information

We’ll keep your personal data on our systems and files for as long as you are eligible for the scheme.

We’ll delete your data no later than 7 years from when you leave the scheme.

Your rights

The information you provided will be managed as required by data protection law.

You have the right to:

  • receive a copy of the information NHSBSA and DHSC hold about you
  • request your information be changed if you believe it was not correct at the time you provided it
  • request that your information be deleted if you believe we are keeping it for longer than necessary
  • request a review of the automated decision on whether you are eligible for the IHS reimbursement

To request access to personal data we hold about you or to exercise any of these rights, contact our data protection officer using the contact details provided.

Postal applications are not being processed because of coronavirus (COVID-19) until further notice.

Find out more about your rights and how we process information.

Address and contact details of our data protection officer

DHSC and NHSBSA are joint controllers for the scheme.

The Department is also the data controller for its executive agencies, which are Public Health England and the Medicines and Healthcare Products Regulatory Agency.

DHSC

Data Protection Officer
Department of Health and Social Care
1st Floor North
39 Victoria Street
London
SW1H 0EU

Email: data_protection@dhsc.gov.uk

NHSBSA

Data Protection Officer
Information Governance
NHSBSA
Stella House
Goldcrest Way
Newburn Riverside
Newcastle Upon Tyne
NE15 8NY

Email: dataprotection@nhsbsa.nhs.uk

How do we use cookies?

Find out more about the cookies we use when you use our online services.

How to complain

You also have the right to complain to the Information Commissioner's Office about the way we handle your information or respond to your requests for access to your personal information or the exercise of your other rights under the GDPR or the Data Protection Act 2018.

You can contact the Information Commissioner's Office by:

  • Telephone: 0303 123 1113
  • Post:
    Wycliffe House,
    Water Lane,
    Wilmslow,
    Cheshire
    SK9 5AF
  • Website: www.ico.org.uk