The NHS Business Services Authority (NHSBSA) is responsible for this service. The Data Hub system is provided to facilitate effective monitoring, management and optimisation of NHS and wider Government-commissioned services. The Data Hub includes datasets that are openly available to anyone without a Data Hub Account. This Privacy Notice covers the processing of personal data of those using the Data Hub system.
Data Hub privacy notice (Word: 24KB)
Why we process your information
We collect your information to ensure colleagues and related parties have access to relevant data according to their needs and genuine access grounds.
This information allows relevant access to Prescriptions (ePACT2), Dental (eDEN) and Ophthalmic (eOPS) data based on what insights and underlying data the users are allowed to see.
By law, we must process this information on behalf of the NHS.
Information that identifies you will not be transferred outside the UK or European Economic Area.
What information we collect
We collect the following information for verification of access:
- First name of user
- Last name of user
- Job Role
- Organisation name
- Email address (also to register user access and further essential communication)
- Practice Name and code (for ePACT2 GP practice access)
- PCN Name and code (for ePACT2 PCN access)
- Provider/Trust Name and code (for ePACT2 Provider/Trust Prescriber and Financial access)
- ICB Name and code (for ePACT2 ICB prescriber, sub-location, and financial access, eDEN Commissioner access, and eOPS Commissioner access.)
- Region Name (for EPACT2 Regional Financial access
- Provider Number (for eDEN Provider access)
Sharing your personal information
We do not share your data with any third parties outside of NHSBSA. We may share your data with anyone:
- with a legal right to it
- who you have given us permission to share with
Keeping your personal information
Audits will be carried out incrementally by NHSBSA on Data Hub user accounts to identify and remove inactive accounts.
Accounts that have not been used for a period of 6 months will be restricted and/or removed.
We will keep user information for 12 months after an account is closed to ensure that all transactions can be fully audited. We do not disclose this information to third party organisations.
Your rights
The information you provided will be managed as required by Data Protection law.
You have the right to:
- receive a copy of the information the NHSBSA hold about you
- request your information be changed if you believe it was not correct at the time you provided it
- that your information be deleted if you believe we are keeping it for longer than necessary
Find out more about your rights and how we process information.
Find out more about the cookies we use when you use our online service.