COVID-19 certification: NHS COVID Pass Verifier privacy notice

How the NHS COVID Pass Verifier uses your data and what your rights are

What is the purpose of the NHS COVID Pass Verifier app?

The purpose of the NHS COVID Pass Verifier app (the Verifier app) is to allow the device onto which the Verifier app is downloaded to scan and read a 2D barcode produced by the NHS COVID Pass service. The 2D barcode contains information associated with the service user’s digital "COVID Pass". This 2D barcode confirms that the service user has been fully vaccinated against COVID-19 or has met negative testing or exemption requirements, to verify their COVID Pass for the purposes of international travel, or for domestic purposes which the government may approve from time to time.

The Verifier app is only designed for use in conjunction with the Service, and must not be used for any other purpose.

Note: The NHS COVID Pass Verifier app is not the same as the NHS COVID Pass app or the NHS Test and Trace app.

What does the NHS COVID Pass Verifier app do?

The COVID Pass Verifier allows the operator to scan a COVID Pass 2D barcode, displayed by a member of the public, to show their COVID Pass status.

How does the NHS COVID-19 Pass service work?

The scanning device for the 2D barcode is known as the NHS COVID Pass Verifier and is downloaded as an app, to a mobile smartphone from the Apple Play Store or or from other app providers, in order to verify barcodes displayed on the devices of NHS COVID Pass service users.

For the international journey, the scanner or verifier views the information contained in the barcode by using the camera on the phone of COVID Pass Verifier operator. Once the 2D barcode is successfully scanned, a vaccine status will automatically be displayed and can be expanded if further details are needed to show full details of the data subject’s vaccine type etc. as defined by international standards.

For domestic use, scanning a 2D barcode generated for domestic use and events, will only generate a green-for-go (valid) or “expired”/”not recognised” screen of the NHS COVID Pass user. There is no further opportunity to see any further details as a result of that scan.

The COVID Pass verifier is to be released by the programme and the method will vary depending on which type of device it is being downloaded to - Apple Play Store for iOS and Google Play for Android devices.

The NHS COVID Pass Verifier reads 2D barcodes that are presented to it, and allows the Verifier operator to check the validity of the 2D barcode. However, no personal information is processed by the NHS Pass Verifier from the NHS COVID Pass Verifier app.

In terms of architecture, the Verifier mobile scanner application utilises "Visual Studio App Centre" to log metrics of all different builds and versions of the scanner application. The anonymous analytics of app operation are securely sent to Azure App Insights. No personal data is processed.

The Personal Data we collect and how it is used

Persona data Use Justification
No Personal data is processed
Special category (health) data Used in COVID Pass Verifier
No data is processed

How will my information be shared?

No onward sharing is available from the NHS COVID Pass Verifier app.

The lawful basis for processing your personal data

There is no processing of data within the NHS COVID Pass Verifier, thus UK GDPR does not apply.

This privacy notice has been drafted in line with UK GDPR. Although personal data is not being processed this privacy notice has been drafted to ensure transparency and to maximise the public’s confidence in the app.

Guidance on UK GDPR is available from the ICO web site.

How long do we keep your personal data?

Personal data is not retained.

Personal data storage

Personal data is not retained.

Your rights as a data subject

Personal data is not processed within the NHS COVID Pass Verifier: UK GDPR Rights are not engaged.

Data security

No data is held, or retained, within the NHS COVID Pass Verifier, data security does not engage.

Changes to this privacy notice

We keep our privacy notice under regular review, and we will make new versions available on our privacy notice page on the NHSX website. This privacy notice was last updated on 17 June 2021.

Data controller

The data controller for the NHS COVID-19 Pass Verifier app is the Department of Health and Social Care (DHSC). Please contact the Data Protection Officer as below in the event that you require further information or wish to bring something to our attention.

In writing:

DPO

Department of Health and Social Care

1st Floor North

39 Victoria Street

London SW1H 0EU

By email: data_protection@dhsc.gov.uk

Formal complaint about the processing

If, after contacting the DPO as above, you wish to make a formal complaint about the processing of you personal data, please contact the Information Commissioner at:

Information Commissioner's Office (ICO)

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Telephone: 0303 123 1113

Fax: 01625 524510

Visit the ICO website.