Privacy notice

Go to the:

Travel Notification Service (TNS) Privacy Notice
Contact Tracing Privacy Notice
Contact Tracing - completing the online form
111 Privacy Notice
Ordering Lateral Flow Devices Online Privacy Notice
Lateral Flow Device Result Notification Online
Privacy notice - Lateral Flow Result Notification to end isolation
COVID-19 Vaccination Programme Privacy Notice

Travel Notification Service (TNS)

This statement is designed to help you understand how your personal data is processed by the Travel Notification Service (TNS), Cabinet Office (on behalf of the Chief Secretary), and why.

Personal data is data which relates to you when you can be identified from that data or from that data when combined with other information which is in the possession of or is likely to come into the possession of TNS. The definition of personal data includes any expression of opinion about you and any indication of the intentions of TNS or any other person in respect of you.

What personal data is processed and how is it used?

When you first register with the TNS using the online portal, you will be asked to provide identifier information such as your name and date of birth. These will be used to create a record for you in the CRM, which is the database used by TNS. You will also be asked if you are an Isle of Man resident because the border restrictions for Isle of Man and non-Isle of Man residents differ.

You will be asked to provide contact information such as your address, email address and telephone number and these will be used to keep in touch with you as necessary and to send you any Direction Notice that might need to be issued in relation to your travel. This Direction Notice will include a reference number which is held within the CRM and is evidence that you have permission to enter the Island.

If you are not an Isle of Man resident, information about the purpose of your visit to the Island will be requested so that a decision can be taken as to whether there is an exemption available under the Public Health Protection (Coronavirus) Regulations 2020 to admit you to the Island. Any further correspondence with TNS in this regard will also be retained.

Prior to travelling to the Isle of Man, you will be required to complete a landing card. You will be asked to provide the reference number referred to above and to confirm such information as your contact details and your address. You will be asked to provide details of your travel which includes the date and time of your intended arrival and how you plan to travel to the Island. This information is used in the reports that are generated by TNS to undertake access checks for each flight or sailing to the Island.

The landing card contains a declaration in relation to your health in respect of COVID-19 and the fact that you completed this declaration is recorded in the CRM. This is treated as special category data under the data protection requirements.

If you are an adult travelling with minors, you will be required to include information about those minors on your landing card. This information forms part of your record in the CRM and a separate record is not created for any minor.

Where is the data stored?

Your data will be held within the CRM system which is owned by the Cabinet Office of the Isle of Man Government. The database utilizes Microsoft Azure to apply a Microsoft Dataverse (Dynamics 365) solution. The database location is restricted to Microsoft’s Europe datacentres.

Information about your travel to the Island will appear in the report that the PAT use to meet the flight or sailing on which you are arriving. Information about your isolating address could appear in a report that the PAT use to undertake isolation checks on those who have travelled to the Island.

Who can see the information?

Your personal data will be accessible to TNS.

The IOM Constabulary can make requests to the CRT for information in the CRM. Where such requests are made, these are subject to strict disclosure protocols and information will only be released where it is considered that there are appropriate legal grounds to do so.

Will your data be used for marketing purposes?

Your data will not be used for marketing purposes nor will your data be provided to any third party so that they can market their products or services to you.

How long is the data kept for?

The length of time we keep your data depends on the reason(s) that we hold your data in the CRM and some of these reasons require your data to be held for longer than others. If you would like to find out more about the specific length of time your data will be held for, please contact the Cabinet Office Data Protection Officer using the contact information set out below.

Your rights

If you feel that for any reason you might not understand what information we might ask you for, why we need it and what we might do with it, please contact the Travel Notification Service via TNS@gov.im or +44 1624 687171. The team will be happy to discuss this document with you in person.

If you wish to see the data processed about you by the Travel Notification Service, please contact the Cabinet Office Data Protection Officer on:

Data Protection Officer
Cabinet Office
Government Offices
Bucks Road
Douglas
IM1 3PN
Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

You have additional rights under the Isle of Man’s data protection legislation such as the right to rectification of incomplete data, the right to object and the right of erasure of data.

If you wish to exercise those rights, or if you wish to make a complaint about how your data has been processed, please contact the Cabinet Office Data Protection Officer using the details above.

As the CRM uses automatic matching for LFD reporting and the outcome of that could be that your details are included in a report to TNS for further investigation, you have the right to obtain additional information about the matching process and to ask for an individual to review any automatic decision made about you. If you wish to exercise this right, please contact the Cabinet Office Data Protection Officer using the details above.

You also have the right to request the Information Commissioner undertake an assessment as to whether the processing of your personal data has been carried out in accordance with the provisions of the Data Protection Act 2018. You can contact the Information Commissioner on +44 1624 693260 or by emailing ask@inforights.im

Contact Tracing

This statement is designed to help you understand how your personal data is processed by Contact Tracing and why.

Personal data is data which relates to you when you can be identified from that data or from that data when combined with other information which is in the possession of or is likely to come into the possession of Contact Tracing. The definition of personal data includes any expression of opinion about you and any indication of the intentions of Contact Tracing or any other person in respect of you.

What personal data is processed and how is it used?

Contact tracing will contact you either because you have tested positive for COVID-19 or because you are a close contact of someone who has tested positive. If you have tested positive for COVID-19 you are referred to as a confirmed case.

You are a confirmed COVID-19 case

If you are a confirmed case, there will already be information in the CRM about you from when you contacted 111, a test was booked for you by another means or you booked a PCR test online. Your contact details, which form part of that information, will be used to make contact with you for contact tracing purposes. Your record will be updated with a case number which is used to link you to your close contacts within the CRM.

Contact Tracing will ask you a series of questions to establish whether any additional preventative measures need to be taken in any location where you might have been. These questions will cover information, as applicable, about your workplace, any educational setting you may have attended, any healthcare setting you may have attended, any PPE that you may have used in any setting, any other location that you may have attended, how you travelled to any location, information about your household and information about any off Island travel.

To assist in understanding any risk to you and any further measures that may be necessary in that regard, Contact Tracing will ask whether you have any symptoms, what those symptoms are and other questions related to your general wellbeing. Some of this information is prescribed by the World Health Organisation (the WHO) and is used for the collection of statistical information which is reported in an anonymised way to the WHO.

You are a close contact

If you are a close contact, it is likely that your name and contact details will be provided to Contact Tracing by the confirmed case. You may, however, be contacting Contact Tracing yourself as a result of a request from the confirmed case or in response to a public information notice from the Isle of Man Government.

If a record does not already exist for you in the CRM, a record will be created capturing your name, date of birth and contact information. Your date of birth is a helpful unique identifier should there be someone else in the CRM that has the same name as you.

Where is the data stored?

Your data will be held within the CRM system which is owned by the Cabinet Office of the Isle of Man Government and which is hosted on servers located in the Isle of Man.

Who can see the information?

Your personal data will be accessible to the CRT which includes the 111 service, and Contact Tracing.

Any isolation information that is held about you forms part of a view in the CRM called the isolation database for the period of time that you are required to be in isolation. The Emergency Services Joint Control Room (the ESJCR) has access to this database on behalf of the emergency services and if you require the emergency services during your period of isolation, the ESJCR will share with the relevant service that you are in isolation in order that appropriate protective measures can be taken.

Will your data be used for marketing purposes?

Your data will not be used for marketing purposes nor will your data be provided to any third party so that they can market their products or services to you.

How long is the data kept for?

Your rights

If you wish to see the data processed about you by the 111 team, please contact the Cabinet Office Data Protection Officer on:

Data Protection Officer
Cabinet Office
Government Offices
Bucks Road
Douglas
IM1 3PN

Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

You have additional rights under the Isle of Man’s data protection legislation such as the right to rectification of incomplete data, the right to object and the right of erasure of data.

If you wish to exercise those rights, or if you wish to make a complaint about how your data has been processed, please contact the Cabinet Office Data Protection Officer the details above.

Contact tracing – completing the online form

This statement is designed to help you understand how your personal data is processed by Contact Tracing and why.

Personal data is data which relates to you when you can be identified from that data or from that data when combined with other information which is in the possession of or is likely to come into the possession of Contact Tracing. The definition of personal data includes any expression of opinion about you and any indication of the intentions of Contact Tracing or any other person in respect of you.

What personal data is processed and how is it used?

If you have tested positive for COVID-19 you are referred to as a confirmed case. If you are a close contact of a confirmed case, you are referred to as a close contact.

You are a confirmed COVID-19 case

If you are a confirmed case, a unique case reference (UCR) will be sent to you with your positive test result as well as the link to an online contact tracing form. If you complete the form, you will be asked for your UCR along with your name and date of birth so that your completion of the form as a confirmed case can be validated. This assists in preventing the malicious completion of the form by someone who is not a confirmed case.

One purpose of the form is to assist in the understanding of the transmission of COVID-19 on the Island. The form will ask you a series of questions to establish whether any additional preventative measures need to be taken in any location where you might have been. These questions will cover information, as applicable, about your workplace, any educational setting you may have attended, any PPE that you may have used in a healthcare setting, any travel to the Island, any venue or event that you might have attended and whether you have been a close contact of a confirmed case.

The next purpose of the form is to assist in understanding how COVID-19 manifests itself so you will be asked to indicate whether you have or have had any of the classic symptoms of COVID-19 and you will also be asked when those symptoms started or when you had a positive LFD or PCR test.

The final purpose of the form is to enable contact details for your close contacts to be obtained so as advice can be provided to them about the steps that they should take as a close contact of a confirmed case. It is important to note that your identity as a confirmed case will not be shared with any of your close contacts.

You are a close contact

If you are a close contact, your name and contact details will have been provided to Contact Tracing by the confirmed case through the online form. This information is used to send you advice as to steps that you should consider in relation to COVID-19 given that you are a close contact of a confirmed case.

The confirmed case will also have provided information about the date of their contact with you and where that was as well as about your age range. This information is used to assist in understanding the transmission of the virus and in deciding on any preventative measures that may be required.

If a record does not already exist for you in the CRM, a record will be created to enable your record to be updated if you subsequently become a confirmed case.

You are completing the form on behalf of someone else

At the end of the form, there is a question as to whether the form has been completed by the confirmed case or by someone else (a proxy). If you are completing the form as a proxy, you will be asked for your name and phone number. This information will only be used to contact you in the event that there is a query in respect of the form or additional information is needed.

Where is the data stored?

Who can see the information?

Your personal data will be accessible to the COVID response team (CRT) which includes the 111 service and Contact Tracing.

Will your data be used for marketing purposes?

Your data will not be used for marketing purposes nor will your data be provided to any third party so that they can market their products or services to you.

How long is the data kept for?

Your rights

If you wish to see the data processed about you in respect of contact tracing, please contact the Cabinet Office Data Protection Officer on;

Data Protection Officer
Cabinet Office
Government Offices
Bucks Road
Douglas
IM1 3PN
Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

You have additional rights under the Isle of Man’s data protection legislation such as the right to rectification of incomplete data, the right to object and the right of erasure of data.

If you wish to exercise those rights, or if you wish to make a complaint about how your data has been processed, please contact the Cabinet Office Data Protection Officer the details above.

111

This statement is designed to help you understand how your personal data is processed by the 111 team and why.

Personal data is data which relates to you when you can be identified from that data or from that data when combined with other information which is in the possession of or is likely to come into the possession of the 111 team. The definition of personal data includes any expression of opinion about you and any indication of the intentions of the 111 team or any other person in respect of you.

If you feel that for any reason you might not understand what information we might ask you for, why we need it and what we might do with it, please contact the 111 team. The team will be happy to discuss this document with you in person.

What personal data is processed and how is it used?

Calling 111

When you contact the 111 team by phone, you will be asked for your full name as well as your date of birth. This is to enable the team to create a unique record for you within the CRM system or to update an existing record. You might have an existing record if you have already been in touch with 111, have been contacted previously by Contact Tracing or have used the Travel Notification Service. You will also be asked for your email address and telephone number if these are not already held and these will be used to keep in touch with you if necessary.

If you are contacting 111 to discuss symptoms, some basic information will be collected from you as to the nature of those symptoms and you will then be transferred to one of the clinicians for a medical based discussion. When you speak to the clinician, details from that call will be recorded on your patient notes on the system that is maintained by Manx Care and not within CRM. View Manx Care’s Privacy Notice. Your hospital number will be recorded in CRM to evidence that symptoms have been discussed and that there is further information in the Manx Care system.

If you need to isolate as a result of your call to 111, the CRM will record this as your isolation pathway. Your address will be requested and recorded, if not already held, in order that there is a record of where you will be isolating. The start and end dates of your isolation will form part of your isolation record.

If 111 book a PCR test for you, information about this test will be held on your record in the CRM. This will include administrative data about your test such as when and where it took place as well as the test result.

Your hospital number and information about your test are treated as special category data in accordance with the data protection requirements.

Requesting a PCR test online

If you complete the online form to request a PCR test, you will be asked for your name and some contact information so that your test time can be sent to you. Your date of birth will also be requested. This is to enable the 111 team to create a unique record for you within the CRM system or to update an existing record. You might have an existing record if you have already been in touch with 111, have been contacted previously by Contact Tracing or have used the Travel Notification Service.

Your reason for requesting a PCR test will be recorded so that the CRM system can properly record the relevant isolation pathway for you. If you are requesting a PCR test for international travel purposes you will be required to confirm your preferred PCR test date; this is so 111 can allocate you a suitable appointment date and then contact you to arrange payment.

When a PCR test is booked for you, information about this test will be held on your record in the CRM. This will include administrative data about your test such as when and where it took place as well as the test result.

Your reason for requesting a PCR test and information about your test are treated as special category data in accordance with the data protection requirements.

Requesting a private PCR test for international travel

If you phone 111 to book a private PCR test for international travel, information to identify you will be collected as set out in the ‘Calling 111’ section above. To pay for your test, payment information will be taken from you such as your credit or debit card details. These are not retained and are only used for the purposes of the payment.

The result of your private PCR test will include the date and time of your test to enable you to evidence that for travel purposes. It will also include your passport number if you have asked 111 for the letter to be amended to include that information. Your passport number will not be collected as a matter of course and if you provide it to 111, it will not be recorded in the CRM or used for anything other than to amend your results letter to include it.

Where is the data stored?

Your data will be held within the CRM system which is owned by the Cabinet Office of the Isle of Man Government and which is hosted on servers located in the Isle of Man. Calls that you make to 111 are recorded on a proprietary system of the Isle of Man Government and these are retained on servers located in the Isle of Man.

Who can see the information?

Your personal data will be accessible to the 111 team which includes any clinician that you speak to. It is also available to the wider COVID response team which includes the Travel Notification Service, the Ports Access Team and Contact Tracing.

If you need to attend for a PCR test, the swabbing team will access the CRM to identify you as someone who has booked a test and to update your record to show that the test has been undertaken. If you do not attend for the test, your record will be updated to reflect that.

The IOM Constabulary can make requests to the 111 team for information in the CRM. Where such requests are made, these are subject to strict disclosure protocols and information will only be released where it is considered that there are appropriate legal grounds to do so.

Will your data be used for marketing purposes?

Your data will not be used for marketing purposes nor will your data be provided to any third party so that they can market their products or services to you.

How long is the data kept for?

Recorded calls to 111 are retained for six months from the date of the call.

Your rights

If you wish to see the data processed about you by the 111 team, please contact the Cabinet Office Data Protection Officer on:

Data Protection Officer
Cabinet Office
Government Offices
Bucks Road
Douglas
IM1 3PN
Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

You have additional rights under the Isle of Man’s data protection legislation such as the right to rectification of incomplete data, the right to object and the right of erasure of data.

Where you have provided us with information about your sex at birth and you no longer wish for that data to be processed, you have the right to withdraw your consent which means that we cannot continue to process or retain that data.

If you wish to exercise any of your rights, or if you wish to make a complaint about how your data has been processed, please contact the Cabinet Office Data Protection Officer the details above.

Ordering Lateral Flow Devices Online

This statement is designed to help you understand how your personal data is processed by the Cabinet Office when you order a lateral flow device (LFD) test kit online for delivery to your home.

Personal data is data which relates to you when you can be identified from that data or from that data when combined with other information which is in the possession of or is likely to come into the possession of the Cabinet Office. The definition of personal data includes any expression of opinion about you and any indication of the intentions of the Cabinet Office or any other person in respect of you.

If you feel that for any reason you might not understand what information we might ask you for, why we need it and what we might do with it, please contact the Cabinet Office Data Protection Officer using the contact details below. The team will be happy to discuss this document with you in person.

What personal data is processed and how is it used?

When you complete the online form to order an LFD test kit, you will be asked for your name and address. This information will be used to create a unique record for you within the CRM system. The data will also be used in order to determine if excessive requests are being received for the same postal address to prevent malicious use of the service. Only one request per week per person and postal address will be processed. Duplicate requests will be marked as duplicate in the system and no further action will be taken with them.

Each day at 16:00 a file containing all requests received since 16:00 the previous day will be sent via a secure Microsoft One Drive folder to Manx Independent Carriers who will take the name and address data provided to make postal labels and post the LFD packs to you.

Where is the data stored?

Who can see the information?

The information that you provide will be accessible to the Cabinet Office. The information will also be provided to Manx Independent Carriers so that a test kit can be delivered to you.

Will your data be used for marketing purposes?

Your data will not be used for marketing purposes nor will your data be provided to any third party so that they can market their products or services to you.

How long is the data kept for?

The record created for you when you complete the online order form will be kept by the Cabinet Office for six months and will then be automatically deleted. This is to assist with identifying duplicate and excessive requests and to ensure we can answer any queries about non-receipt of requested LFD kits.

The data held in the Microsoft OneDrive folder will routinely and automatically be deleted after 7 days.

Manx Independent Carriers will retain your data for 7 days from receipt and it will then be deleted. This means that if you have a query in relation to the delivery of your test kit, Manx Independent Carriers may not be able to assist us with that query if you ordered your test kit more than seven days ago.

Your rights

If you wish to see the data processed about you by the Cabinet Office, please contact the Cabinet Office Data Protection Officer on;

Data Protection Officer
Cabinet Office
Government Offices
Bucks Road
Douglas
IM1 3PN
Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

You have additional rights under the Isle of Man’s data protection legislation such as the right to rectification of incomplete data, the right to object and the right of erasure of data.

If you wish to exercise those rights, or if you wish to make a complaint about how your data has been processed, please contact the Cabinet Office Data Protection Officer the details above.

Lateral Flow Device Result Notification Online

This statement is designed to help you understand how your personal data is processed by the Cabinet Office when you report a lateral flow device (LFD) result online following your arrival into the Isle of Man.

Personal data is data which relates to you when you can be identified from that data or from that data when combined with other information which is in the possession of or is likely to come into the possession of the Cabinet Office. The definition of personal data includes any expression of opinion about you and any indication of the intentions of the Cabinet Office or any other person in respect of you.

If you feel that for any reason you might not understand what information we might ask you for, why we need it and what we might do with it, please contact the Cabinet Office Travel Notification Service. The team will be happy to discuss this document with you in person.

What personal data is processed and how is it used?

If you are reporting your LFD result following your arrival into the Isle of Man you will be required to provide your LFD result as well as identifier information, your date of arrival and your Landing Card Reference. You will also be asked for your LFD batch number and the date you completed your LFD test.

Your LFD result will be used to provide you with additional information, if applicable, as to the next steps you need to take. The batch number is recorded to help to ensure that a valid LFD test has been used.

When you upload your result, your identifier information, your date of arrival, the date of your test and your landing card reference will be used by the CRM system to automatically match your result notification to your landing card to confirm that you have notified the result of your LFD test in accordance with the Public Health Protection (Coronavirus) Regulations 2020. If the auto matching fails for any reason, your details will be included in a report which will be available to the Travel Notification Service (TNS). This report will be used by TNS to manually match the details you provide to your landing card. If you are reporting your LFD result for any other reason you will only be required to provide your LFD result and you will not be asked for any identifier information.

Where is the data stored?

Who can see the information?

The information that you provide will be accessible to the Cabinet Office which includes the TNS team. TNS will not have access to your test result.

The IOM Constabulary can make requests to the Cabinet Office for information in the CRM. Where such requests are made, these are subject to strict disclosure protocols and information will only be released where it is considered that there are appropriate legal grounds to do so.

Will your data be used for marketing purposes?

Your data will not be used for marketing purposes nor will your data be provided to any third party so that they can market their products or services to you.

How long is the data kept for?

Your rights

If you wish to see the data processed about you by the Cabinet Office, please contact the Cabinet Office Data Protection Officer on;

Data Protection Officer
Cabinet Office
Government Offices
Bucks Road
Douglas
IM1 3PN
Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

You have additional rights under the Isle of Man’s data protection legislation such as the right to rectification of incomplete data, the right to object and the right of erasure of data.

If you wish to exercise those rights, or if you wish to make a complaint about how your data has been processed, please contact the Cabinet Office Data Protection Officer using the details above.

As the CRM uses automatic matching and the outcome of that could be that your details are included in a report to TNS for further investigation, you have the right to obtain additional information about the matching process and to ask for an individual to review any automatic decision made about you. If you wish to exercise this right, please contact the Cabinet Office Data Protection Officer using the details above.

Privacy notice - Lateral Flow Result Notification to end isolation

This statement is designed to help you understand how your personal data is processed by the Cabinet Office when you report a lateral flow device (LFD) result for the purposes of ending isolation earlier than the usual ten day isolation period.

Personal data is data which relates to you when you can be identified from that data or from that data when combined with other information which is in the possession of or is likely to come into the possession of the Cabinet Office. The definition of personal data includes any expression of opinion about you and any indication of the intentions of the Cabinet Office or any other person in respect of you.

If you feel that for any reason you might not understand what information we might ask you for, why we need it and what we might do with it, please contact the 111 team who will be happy to discuss this document with you in person.

What personal data is processed and how is it used?

When you use the form, you will be asked for your name, address and date of birth in order to identify you.

You will also be asked for your email address if you are completing the form online. If you are calling 111, you will be asked for an email address or a residential address if you don’t have an email address. Your email address or your residential address will be used initially to send you information about the ten day isolation period that you are required to observe. It will also be used to acknowledge your first negative LFD result and to advise you about the end of your isolation period when you report your second negative LFD result.

You will be required to enter your LFD result and the reason why you are notifying the result.

If you are notifying the result because you have tested positive, a positive case record will be created for you in the CRM using the identifier information referred to above and you will be asked for your NHS number so that any future negative LFD results can be matched to your positive case record in order to end your isolation early. The CRM will automatically record the dates and times of your notifications to calculate when your ten day isolation should end, when your second negative LFD result can be accepted and to validate whether the date of the second negative LFD result can be accepted.

If you are using the form because you are currently in isolation due to testing positive prior to 22 December 2021, you will be asked for the Unique Case Reference number included in your email notification from 111. This will be used along with your identifier information to locate your existing record on the CRM and to match any future negative LFD results to that record.

If you are using the form to notify positive or negative results for travel purposes, it is important that you review the Privacy Notice from the Travel Notification service so that you understand how your data will be used for travel related reasons.

Where is the data stored?

Your data will be held within the CRM system which is owned by the Cabinet Office of the Isle of Man Government. The database utilises Microsoft Azure to apply a Microsoft Dataverse (Dynamics 365) solution. The database location is restricted to Microsoft’s Europe datacentres.

Calls that you make to 111 are recorded on a proprietary system of the Isle of Man Government and these are retained on servers located in the Isle of Man.

Who can see the information?

The information that you provide will be accessible to 111, Contact Tracing and Public Health.

The IOM Constabulary can make requests to the 111 or contact tracing teams for information in the CRM. Where such requests are made, these are subject to strict disclosure protocols and information will only be released where it is considered that there are appropriate legal grounds to do so.

Will your data be used for marketing purposes?

Your data will not be used for marketing purposes nor will your data be provided to any third party so that they can market their products or services to you.

How long is the data kept for?

The positive case record and the negative result notifications will be retained for a maximum of six months from the date of the second negative result notification. This is to assist with any investigation into a breach of the isolation requirement.

Your rights

If you wish to see the data processed about you by the 111 team, please contact the Cabinet Office Data Protection Officer on;

Data Protection Officer
Cabinet Office
Government Offices
Bucks Road
Douglas
IM1 3PN
Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

You have additional rights under the Isle of Man’s data protection legislation such as the right to rectification of incomplete data, the right to object and the right of erasure of data.

If you wish to exercise those rights, or if you wish to make a complaint about how your data has been processed, please contact the Cabinet Office Data Protection Officer using the details above.

COVID-19 Vaccination Programme Privacy Notice

You are either an Isle of Man resident expressing an interest in receiving a COVID-19 vaccination and then booking that vaccination, an Isle of Man resident booking a vaccination for a vulnerable young person or an Isle of Man resident who is eligible for a booster vaccination. This statement is designed to help you understand how your personal data or the personal data of the young person is processed by the 111 team and why.

Personal data is data which relates to you when you can be identified from that data or from that data when combined with other information which is in the possession of or is likely to come into the possession of the 111 team. The definition of personal data includes any expression of opinion about you and any indication of the intentions of the 111 team or any other person in respect of you.

If you feel that for any reason you might not understand what information we might ask you for, why we need it and what we might do with it, please contact the 111 team and select Option Two. The team will be happy to discuss this document with you in person.

What personal data is processed and how is it used?

Please note that you will only be able to book an appointment for yourself unless you are booking an appointment for a vulnerable young person.

Booking your appointment over the phone

When you phone the 111 team, you will be asked for your full name (your forenames and surname) as well as your date of birth. This is to enable the team to create a unique record for you within the CRM system that is used to hold information about the fact that you wish to receive the vaccination and subsequently the vaccination appointments you have booked.

You will be given the option to provide a landline phone number or a mobile number so as contact can be made with you when a vaccine becomes available. This number will also be used if you need to be subsequently contacted about your appointment or the 111 team need to make contact with you if you did not attend an appointment.

When you initially phone the 111 team to express an interest in receiving the vaccine, the time of your call will be recorded. This will be used to prioritise contact with you when a vaccine becomes available as appointments will be offered on a ‘first come, first served’ basis to those who have expressed an interest.

When the 111 team make contact with you to book your appointments, you will normally be given the option to provide a residential address or an email address which will be used to provide you with confirmation of your appointments. You will be required to provide your residential address if you cannot attend the vaccination site and a vaccination in your home needs to be arranged or you can attend the vaccination site but you would like transport to be arranged for you to get there.

Your appointment dates and the location of your appointment will be retained within the CRM as will the fact that you have received the two vaccinations required. This collection of data, as well as the data about your vaccination priority group, will be treated as part of your health data for the time that it is retained within the CRM system and the strictest standards of confidentiality will be applied to it.

Booking your appointment online

When you complete the online registration form, you will be asked for your title, your full name and your date of birth. This information will automatically create a unique record for you within the CRM system that is used to hold information about the fact that you wish to receive the vaccination and subsequently the vaccination appointments you have booked.

You will be asked for your phone number which will be used by 111 to contact you and discuss possible vaccination dates.

You will be given the option of having your vaccination appointments confirmed by email or by post. If you choose ‘email’, you will be asked to provide your email address. If you choose ‘post’, you will be asked to provide a correspondence address. You will not be prevented from providing your email address and your correspondence address if you wish to.

You will be asked whether you have experienced anaphylaxis in the past and if this is the case, your form will not be processed any further. No copy of your response to this questions which would constitute your health data, will be retained.

When you submit your registration form, the time and date of the submission will be recorded. This will be used to prioritise contact with you when a vaccine becomes available as appointments will be offered on a ‘first come, first served’ basis to those who have expressed an interest.

Booking an appointment for a vulnerable young person

When you phone the 111 team to book a vaccination appointment for a vulnerable young person, the same information as is set out above under ‘booking your appointment over the phone’ will be requested. Some of that information will be in respect of the young person (name and date of birth) and some of it will be in respect of the person making the call (contact information).

The 111 team will also ask for some additional information in respect of the young person to ensure that an appropriate standard of care can be provided at the vaccination site. This includes information about any previous reaction to vaccines as well as any particular access, communication or other requirements in respect of the young person.

If you are pregnant

If you are pregnant and you wish to receive the vaccination after your baby is born, you will be asked for your baby’s due date. This will be recorded and will be used to ensure that you are contacted after the birth of your baby to arrange vaccination dates for you.

If you are eligible for a booster vaccination

If you are eligible for a booster vaccination,

you can register online. You will be asked whether you have an appointment already and want to register for a short notice appointment or whether you are registering for a booster vaccination for the first time.

If you are registering for a short notice appointment, you will be asked for your name, date of birth and NHS number. This is to identify you and to validate that you are eligible for a booster vaccination against the vaccination data which has been provided to the 111 team by Manx Care. You will also be asked for some contact information so that you can be advised of available appointments. This may be by text message if you have provided your mobile number.

If you are registering for a booster vaccination for the first time, you will be asked whether you have experienced anaphylaxis in the past and if this is the case, your form will not be processed any further. No copy of your response to this questions which would constitute your health data, will be retained.

If you have not experienced anaphylaxis in the past, you will be asked for your Isle of Man postcode to validate that you are an Isle of Man resident. You will then be asked to select a date for your appointment and you will be asked whether you wish to register for short notice appointments. You will be asked for your name, date of birth and NHS number. This is to identify you and to validate that you are eligible for a booster vaccination against the vaccination data which has been provided to the 111 team by Manx Care. You will also be asked for some contact information so that you can be advised of the time of your appointment. If you have indicated that you wish to be advised of short notice appointments, this may be by text if you provide your mobile number.

What is my data used for if I want transport to be arranged to get to the vaccination site?

If you advise 111 that you want transport to be arranged to get to the vaccination site because you cannot get there yourself, your name and address will be provided to the Transport Services Team within the Department of Infrastructure (the DOI) so as arrangements can be made to pick you up. The 111 team will use your contact information to confirm the dates of your vaccination to you when confirmation has been received from Transport Services that they can pick you up. Your name, address and date of pick up will be provided to the driver who will use these on the day that they are due to take you to your appointment. If you do not wish to travel on that day, this will be advised to the 111 team by Transport Services.

When you book online, you are given the option of contacting the Transport Services Team yourself.

Where is the data stored?

Who can see the information?

Your personal data will be accessible to the 111 team and to the vaccinator who is administering the vaccine or the booster vaccination to you. The vaccinator will only be able to see the information that is required to verify your appointment and to update your record on the CRM system. If you cannot attend the vaccination site and you need to have a vaccination or a booster vaccination at home, the vaccinator will be able to see your contact information and your residential address in order that they can attend to provide you with the vaccine. If you need transport to the vaccination site, some limited data will be made available to Transport Services and the driver on the day.

If the vaccination is for a vulnerable young person, the vaccination shift team leader will have access to the additional information obtained in respect of that young person in order to arrange an appropriate standard of care at the vaccination site.

If you have registered to be advised of short notice appointments, your mobile phone number will be shared with Sure Isle of Man in order that you can be advised of such things as walk in clinics. Only your mobile number will be shared with Sure and no other identifier information. There is also a specific agreement in place with Sure which makes clear that this information is not to be used for any other purpose such as marketing products and services to you.

Will your data be used for marketing purposes?

Your data will not be used for marketing purposes nor will your data be provided to any third party so that they can market their products or services to you.

How long is the data kept for?

Personal data will be deleted from the CRM system within 48 hours of your record being updated to reflect that you have received both vaccinations or your booster vaccination. Some anonymised data will be retained to assist with statistical reporting. If you use Transport Services, the limited data about you will be held by the DOI for six months to assist with contact tracing if required.

Sure Isle of Man will delete your mobile number within three months of receiving it. During that three months, you may receive a number of updates in relation to walk in clinics or short notice appointments. If you want to opt out of receiving these updates, please contact the Data Protection Officer using the contact details below.

Your rights

If you wish to see the data processed about you by the 111 team, please contact the Cabinet Office Data Protection Officer on:

Data Protection Officer
Cabinet Office
Government Offices
Bucks Road
Douglas
IM1 3PN
Email: DPO-CabOff@gov.im
Phone: +44 1624 686779

You have additional rights under the Isle of Man’s data protection legislation such as the right to rectification of incomplete data, the right to object and the right of erasure of data.

If you wish to exercise those rights, or if you wish to make a complaint about how your data has been processed, please contact the Cabinet Office Data Protection Officer the details above.

05 January 2022