Community Pharmacy Clinical Services Dataset: Transparency Notice

This transparency notice explains for the Community Pharmacy Clinical Services Dataset:

• why we collect information about you (we call this 'personal data')
• what we do with it, including who we share it with (we call this 'processing')
• how long we keep it for and where we store it
• our legal basis for using it
• what your data protection rights are

To read more about how NHS England uses personal data to improve health and care, see our privacy notice and Keeping data safe and benefitting the public.

Integrated care boards (ICBs) are NHS organisations responsible for planning and arranging health services in your local area, for example services provided by community pharmacies such as Pharmacy First, or Blood Pressure Check Service. This is called 'commissioning'. For more information see the NHS England Pharmacy Services webpage.

NHS England is responsible for making sure that the health services which ICBs commission are safe, effective, delivering value for money and are reducing health inequalities.

To do this, NHS England collects and analyses data about the care given to patients when they access community pharmacy services. For example:

• the type of consultation you had with the pharmacist, such as face to face or by telephone
• the reason for your visit to the pharmacy
• any medicines you were supplied
• if you were referred to another NHS service, such as to your GP, 111 or to A&E

This collection of data is called the Community Pharmacy Clinical Services Dataset.

The Community Pharmacy Clinical Services Dataset contains your:

• demographic information – such as your NHS number, date of birth, gender, home address including postcode and ethnicity
• health information – such as the type of community pharmacy service you accessed (to have your blood pressure checked for example), the outcome of your consultation, your test results (if relevant) and the medication(s) you were given (if any)

To protect your privacy, before the data is used it is transformed in such a way that removes or changes your personal information so that we cannot identify you as an individual without additional information. This additional information is held separately and securely. We call this process 'pseudonymisation' and data which is transformed in this way is called 'pseudonymised'.

NHS England will collect the data from the NHS Business Services Authority (NHS BSA).

We analyse your pseudonymised data to understand if community pharmacies are delivering the services as they should be and are meeting the requirements of the service specification for each pharmacy service. This includes looking at:

• the advice given to the patient
• what follow-ups or referrals for further treatment were made (for example where a blood pressure reading indicates this is required)

We will also look to see if different community pharmacies, and pharmacies in different ICBs are providing a service of the same quality.

We also analyse your pseudonymised data to:

• understand the impact these services have on the wider NHS - for example, are these services reducing the number of patients making an appointment with their GP practice
• understand how patients use different parts of the NHS for their care, and how their health is affected by this - this will help us to improve the quality and safety of services and reduce differences in health between different groups of people
• identify potential issues with data quality, fraudulent activity or patient safety issues
• tell us which other services could and should be provided in community pharmacies
• help us design healthcare that the people using it need and that this care is delivered by different organisations working well together
• assist NHS England to work closely with ICBs and support them to make sure community pharmacies are delivering high quality care within their region, check how they are doing compared to other ICBs, make decisions based on knowledge of how services are performing and reduce waste

We will also link Community Pharmacy Clinical Services Data to other datasets we hold to help us better understand how these services are helping patients and the wider NHS. For example, by linking to data about hospital admissions, we will be able to understand the impact community pharmacy services are having to reduce the number of people attending A&E and being re-admitted to hospital.

Data protection law requires NHS England to have a legal basis before we can process your personal data.

Our legal basis is:

Legal obligation - Article 6(1)(c) of UK GDPR. This is because the Secretary of State for Health and Social Care has issued us with a Direction to collect this dataset. This Direction is called the Delegation of NHS England Direct Commissioning Functions - Evaluation and Monitoring of Services Directions 2026 (Directions).

Substantial public interest - Article 9(2)(g) of UK GDPR, plus Schedule 1, Part 2, Paragraph 6 'statutory etc and government purposes' of the DPA 2018 in order to comply with the above Directions.

Under data protection law, NHS England is a ‘joint controller’ with the Department of Health and Social Care. This means that we have jointly decided what personal data to collect and how it will be processed in accordance with the above Directions.

We share pseudonymised data with:

1. ICBs: to help ICBs to perform their delegated functions relating to the commissioning of pharmacy services. Each ICB will be able to use data for the community pharmacies they hold a contract with. Also, where potential patient safety, or other issues are identified for a pharmacy or pharmacies, we will share the list of pharmacies and the issues identified (including transaction ID) with the relevant ICB so that they can take the correct steps.
2. NHS BSA: where potential issues with data quality or fraud are identified for a pharmacy or pharmacies, we will share the list of pharmacies and the issues identified (including transaction ID) with the NHS BSA to resolve the issues and to allow them to perform their statutory functions as set out in the Pharmaceutical and Local Pharmaceutical Services (Prescriptions, Payments and Listings) Directions 2013.

Data Access Request Service

Data from this collection may be shared with organisations for planning, commissioning and research purposes where there is a benefit to health and social care. It may also be shared with organisations where it is necessary for them to meet their statutory responsibilities.

Organisations will need to apply and gain approval through our Data Access Request Service (DARS), and if approved, they must sign a Data Sharing Framework Contract and a Data Sharing Agreement.

Each application is assessed very carefully to make sure that: 

• the applicant organisation has a legal basis to access the data and NHS England has a legal basis to share the data
• the applicant organisation will use the data only for the reasons they have agreed with NHS England 
• only the minimum amount of personal data is shared in accordance with data protection principles and the National Data Guardian’s Caldicott Principles - data which identifies an individual (identifiable patient data) is only shared where it is absolutely necessary and where there is a legal basis to do so
• the applicant organisation will handle and store the data securely

Where a DARS application is approved, data may be shared for analysis through the NHS England Secure Data Environments, in line with NHS policy on Secure Data Environments.

We publish the details of approved DARS applications on our website. See the Data Uses Register.

Processors

We use Microsoft Azure and Amazon Web services (AWS) to provide secure cloud hosting services under a contract known as a ‘Data Processing Agreement’. They can only use, store and keep the data as set out in our instructions and cannot use the data for any other purposes.

Your data will be held for as long as we have a legal basis and purpose to retain your data under the above Directions.

We keep your data in accordance with the Records Management Code of Practice 2021.

We securely store your data on servers in the United Kingdom (UK).

Under data protection law, you have the following rights over your data for this data collection:

Your right to be informed – You have the right to be told how and why we are using your personal data. We have published this transparency notice to provide you with this information.

Your right to get copies of your data – You have the right to ask us for copies of your personal data (right of access). For more information, see how to make a subject access request.

Your right to get your data corrected – You have the right to ask us to correct (rectify) your personal data if you think it is inaccurate or incomplete.

Your right to limit how we use your data – You have the right to ask us to limit the way we use your personal data (restrict processing) in certain circumstances.

To make a rights request, email us at [email protected].

When NHS England collects the Community Pharmacy Clinical Services data from NHS BSA

If you have registered a National Data Opt-Out, NHS England can still collect your data under the Delegation of NHS England Direct Commissioning Functions - Evaluation and Monitoring of Services Directions 2026. This is because the National Data Opt-Out does not apply where NHS England has a legal obligation to collect the data (see section 6.4 of the National Data Opt-Out Operational Policy Guidance for more information).

When NHS England shares Community Pharmacy Clinical Services data

For any data we share with other organisations through our Data Access Request Service, we will apply the national data opt-out in line with the National Data Opt-Out Operational Policy Guidance.

You can find out more about and register a national data opt-out, or change your choice, on the NHS website - Choose if data from your health records is shared for research and planning.

We take our responsibility to look after your data very seriously. If you have any questions or concerns about how NHS England uses your data, contact our Data Protection Officer at [email protected].

If you are not happy with our response, you have the right to make a complaint about how we are using your data to the Information Commissioner’s Office by calling 0303 123 1113 or through their website at Make a complaint - ICO.

We may make changes to this notice. If we do, the 'last edited' date on this page will also change. Any changes to this notice will apply immediately from the date of any change.