Skip to main content Skip to footer

Provisional Replacement Certificate (PRC) privacy notice

The NHS Business Services Authority (NHSBSA) and the Department of Health and Social Care are jointly responsible for this service.

Why we process your information

We’ll use the information you have given us to:

  • process and verify your application for a Provisional Replacement Certificate (PRC)
  • help plan and make improvements to NHS services, and/or direct patient care

If you have an NHS pension and we do not have up-to-date details for you, we may use your information to update our records. This is so we can meet our legal obligation to send you information about your NHS pension benefits.

By law, we must process this information to be able to provide this service.

We will ask you for:

  • information to identify you, and if appropriate your dependant(s)
  • your address so we can confirm your residency
  • details of the treatment facility you are attending so we can email your PRC to the facility

Your information will not be transferred outside the European Economic Area and Switzerland.

Sharing your personal information

To validate PRC applications, we will share your information with:

  • Third Party Data Providers who will provide a residency check to indicate whether you are resident in the UK.

To ensure you receive treatment under the terms of the PRC, we will share your personal information with the healthcare provider which is providing your treatment.

We may also share your information with the following agencies, to validate the information you have provided:

  • The Department for Work and Pensions
  • HM Revenue and Customs
  • Department of Health and Social Care – International Division

To prevent, detect and investigate fraud and errors, we may also share your information with:

  • NHS Counter Fraud Authority
  • Department of Health and Social Care – International Division
  • NHS commissioners and service providers

Keeping your personal information

We will delete your personal data from our systems and files no later than 7 years from the date of expiry of your PRC. This is to allow for treatment cost claims made to be processed.

Your rights

The information you provided will be managed as required by Data Protection law.

You have the right to:

  • receive a copy of the information the NHSBSA hold about you
  • request your information be changed if you believe it was not correct at the time you provided it
  • request that your information be deleted if you believe the NHSBSA are keeping it for longer than necessary

Find out more about your rights and how we process information.