Version 3, 30 March 2023
This minor update covers organisational changes in the NHS. You can find more details in the NHS App privacy policy .
The NHS App privacy policy provides details of how we use, and process, any personal information you give us. It also has details of who to contact should you need to speak to the relevant data protection officer.
The information below describes how we use your information when you use online consultation services within the NHS App (whether accessed in the mobile app or logged in to the NHS website in a web browser).
What are online consultation services?
Online consultations allow you to contact your GP surgery without having to wait on the phone or take time to visit the surgery in person. They may be especially helpful if you are not sure you need a face to face consultation. Online consultations enable you to use a secure online system to ask questions, report symptoms and get advice.
Online consultations are not appropriate for emergencies. If you require urgent care you will be advised to use NHS 111, visit A&E or call 999.
An online consultation service usually includes asking a series of questions (called forms-based triage) to identify what you need and direct you to the right service. Online consultations can typically be used for:
- asking for test results or a making a routine appointment
- describing symptoms to your GP and getting advice (which may sometimes be that a face to face appointment is needed)
If your GP surgery provides an online consultation service, this will be made clear on the GP surgery website.
For NHS nationally funded online consultation services in England, your GP practice's online consultation service may also be available within your NHS App and any requests which patients send to their GP practice will be securely sent from their NHS App to the GP practice system using the online consultation provider (as described in the NHS App terms of use).
Your NHS App is provided by NHS England and supports health services such as enabling your GP surgery to provide you with online access to sections of your health record. The NHS App can be downloaded from the App Store and Google Play. You can also log in to your account using the NHS website.
Who is involved in providing online consultation services?
The following organisations are involved in providing online consultation services available through your NHS App. Their respective roles are described below.
Your GP surgery
If an online consultation service is available at your GP surgery, then the GP surgery or the integrated care board (ICB) to which they belong will have usually engaged one or more specialised online consultation supplier(s) to provide the service. The agreements in place with the supplier(s) ensure that your GP surgery remains the 'controller' of the patients' information and that patients' information is not used for any purpose other than the online consultation purpose. In relation to certain online consultation providers NHS England is also a joint data controller of your information alongside your GP surgery, as described below.
Online consultation provider
An online consultation provider is a commercial organisation providing the online consultation service on behalf of your GP surgery. Providers are usually contracted through an NHS England procurement framework, which involves scrutiny of their service including technical, clinical, privacy and security aspects.
An online consultation provider is a 'processor' for the GP surgery which means it processes patients' personal information in accordance with instructions issued by the GP practice and is not able to use the information for other purposes.
NHS England
NHS England will be a controller of personal data relating to your journey through your NHS App (for example that you accessed an online consultation service at a certain time). This is because as NHS England connects your NHS App to the GP surgery's online consultation service.
Because NHS England provides the NHS login service, NHS England is a controller of verified identity information used to access your NHS App and online consultations services used within NHS login. These details are name, age, NHS number, gender, email address. Find out more about verified identities and the role of NHS login.
NHS England is not (except as set out below) a controller in respect of your use of an online consultation service, or any health related information you input.
NHS England provides a connection within your NHS App to the online consultation service on behalf of the GP surgery.
In relation to certain online consultation providers, NHS England is also a joint data controller with your GP surgery, as NHS England has a role supporting the roll out of these services and ensuring appropriate information governance contracts are in place. Your GP will retain responsibility for managing your personal data and should be your primary point of contact. NHS England will be responsible for managing any system-wide incidents and national assurance of compliance with data protection legislation. For more information in relation to NHS England's role as a joint controller with your GP surgery see NHS England's privacy notice. The online consultation provider to whom this applies is eConsult Health Limited – for more information see eConsult's GP online consultation service privacy notice.
Who is my online consultation provider?
The online consultation services offered to you as a patient will depend upon which online consultation providers have been engaged by your GP surgery or the integrated care board (ICB) to which they belong.
The name of the provider is shown within your NHS App before any online consultation begins. It will also be named on the GP surgery website. If you are still unsure who your provider is, ask your GP surgery.
If your GP surgery does not offer online consultation services you will not see any options relating to online consultations within your NHS App.
Online consultation providers currently available through your NHS App
Below, you can find links to privacy policies, and help and support, for online consultation providers. Our help page about online consultations has information about using this feature.
Accurx Limited
Accurx allows you to answer questions online and get a response from your GP surgery. You can view the Accurx privacy policy.
eConsult Health Limited
eConsult also trades as WebGP. You can answer questions online and get a response from your GP surgery. You may be able to get advice for your child if it's available at your surgery. You can view the eConsult GP online consultations privacy notice.
Engage Health Systems Limited
Engage allows you to answer questions online and get a response from your GP surgery, and to view your online consultations and any responses from your GP surgery. You can view the Engage privacy policy.
Spectra Analytics (trading as PATCHS)
PATCHS allows you to answer questions online and get a response from your GP surgery. You can view responses, check your past requests and send a new request. You can view the PATCHS Patient End User License Agreement.
What personal data is processed for online consultation services and why?
The personal data processed when you use an online consultation service varies depending upon the provider. Generally, it includes the following.
Identity and contact information
Your identity and contact information is used to confirm who you are and that your requests are directed to your GP surgery. This information comprises:
- NHS login account information: name, date of birth, NHS number
- information within your GP medical record: postal address
- manually entered information: gender, email address, telephone number
Online consultation responses
The answers you provide to questions asked by the online consultation service and the replies from your GP surgery are likely to contain sensitive medical information. Your requests and responses will be used to determine what the next appropriate steps should be.
For example:
- if a need for urgent care is indicated, you will be advised to contact emergency services direct
- your needs may be prioritised based on the information you have given
- an appropriate response can be given which may be that a face-to-face appointment should be arranged or refer you to a more suitable service
Your rights
Data protection law provides a number of rights to you. You can exercise your rights by contacting the appropriate controller:
- For your rights relating to NHS login account information (as described above) see the NHS App privacy policy
- For your rights in relation to your online consultation responses (as described above), contact your GP surgery for a copy of their privacy policy
- For your rights in relation to NHS England's role as a joint controller with your GP practice see NHS England's privacy notice for providing online consultation services
- For your rights in relation to any data privacy objections or complaints, see the NHS App privacy policy for details of how to contact our Data Protection Office