Privacy notice for schools

Please read our privacy notice below to find out how we’ll use and protect your child’s personal information. We will only process this personal information in compliance with Data Protection Legislation.

This Privacy Notice explains how the personal data will be used (collected, stored, used and destroyed), as part of this programme.

The testing is being taken forward jointly by several organisations and means at different points in the process, different organisations will be processing your personal data. All processing of personal data is being done in compliance with data protection legislation. Each organisation will require a different level of information about you but all will use the minimum necessary to do what they are required to deliver their part of the Programme.

The organisations taking part are:

  • The NHS (including University Hospital Southampton NHS Foundation Trust Southampton Primary Care Limited, Southampton City Clinical Commissioning Group)
  • NHS Test and Trace and the local Health Protection Team
  • Southampton city council
  • A nominated person from your child’s school

What personal data is being collected?

The details we may collect and process for you are:

  • first and last name
  • address, including postcode
  • mobile phone number
  • email address
  • date of birth
  • sex as registered at your GP
  • your test results (forming part of your medical record, by authorised NHS staff, including your GP, the NHS Track and Trace service and the local Health Protection Team to initiate contact tracing)
  • your GP surgery
  • your NHS Number
  • For staff, your employee / Payroll Number
  • your school

How will your child’s personal data be used?

The data will be used to:

  • register your child to participation in the Programme
  • match your child’s contact details with health data stored by the NHS
  • deliver test packs to your child at school or at your home address, if necessary
  • communicate with you and your child about the Programme
  • contact you and your child with test results by text message
  • contact you and your child relating to a positive or inconclusive result and to collect other medical information about your child’s health relating to COVID-19
  • contacting School to inform them of a positive result.
  • contact you to resolve any questions you might have about the Programme
  • Contact you if you consent to being asked about your experiences on the programme
  • Contact you to gather feedback to inform improvements that could be made to a full end-to-end testing process


Webchat allows you to speak to our customer advisors in real time using 'web chat' functionality to provide online support to citizens.

If you engage with our webchat on behalf of your child, we may collect:

  • Your name and the name of your child
  • Your email address
  • Chat transcripts
  • Completed surveys
  • Automatic information, such as IP address, operating system and type of browser and the geographical location

Data from each 'chat' will be held for six months and may be used when looking into your enquiry and for quality purposes. You may be asked to complete a short survey on completion of your webchat. All answers for the survey are anonymised and will be used for service improvement.

How long will my personal data be kept?

The information processed by the NHS is kept for as long as it is required to provide you with direct care and to support NHS initiatives to fight COVID-19. Information held for direct care purposes are stored in line with the Records Management Code of Practice for Health and Social Care 2016. This means such information will be held for up to 8 years before it is deleted.

Any personal data gathered as part of this Programme for other purposes will be deleted at the end of the Programme.

What are my rights?

By law, you have a number of rights under data protection legislation, this testing programme does not take away or reduce these rights. You have the right to contact the us to ask for the following:

  • to be informed about the data held about your child
  • to access the data held about your child
  • to have the data held about your child edited or updated where it is inaccurate or incomplete
  • to request that data held about your child be erased
  • to request that the use of your child’s data be restricted
  • to object to the use of your child’s data

Further information about your data protection rights appears on the Information Commissioner’s website

Why our use of your personal data is lawful

In order for the use of your personal data to be lawful, we need to meet one (or more) conditions in the data protection legislation. For the purposes of this programme, the relevant conditions are:

For processing personal data:

  • Article 6(1)(e) to perform a public task carried out as part of our official authority.

For processing special category data by the NHS

  • Article 9(2)(i) – the processing is necessary for reasons of public interest in the area of public health
  • Data Protection Act 2018 – Schedule 1, Part 1, (2) (2) (f) – health or social care purposes
  • Regulations 3(1) and (4) of the Health Service (Control of Patient Information) Regulations 2002 (COPI) – the processing is necessary for a COVID-19 purpose

For processing special category data by the School/College:

  • Article 9(2)(g) and Schedule 1, part 2, para 6 Data Protection Act 2018 – the processing of special category data is necessary to fulfil a statutory purpose.

For processing staff personal data by the School/College:

  • Article 6(1)(f) – the processing is necessary for the purposes of the legitimate interest of the controller

How can I find out more information or raise a complaint?

If you would like to raise a complaint about how your personal data is used as part of the Programme, you can contact the customer services team. Depending on your query, it will be forwarded to the Data Controller to resolve your issue.

If you have any data protection issues, please contact

You may also complain to the Information Commissioner’s Office (ICO) if you believe that your personal data is handled in a way that is not lawful.