Skip to main content Skip to footer

Vaccine Damage Payment Scheme privacy notice

The NHS Business Services Authority (NHSBSA) is responsible for the administration of the Vaccine Damage Payment Scheme (VDPS), while the Department of Health & Social Care (DHSC) is responsible for the policy.

DHSC and the NHSBSA are joint controllers of data related to the VDPS. This privacy notice explains what information we collect when you use this service. It also contains information about how we use, store, and transfer that information to build trust in the service and its operations.

Why we process your information

We will use the information you provide to:

  • assess, and process your application
  • pay you
  • check for fraud and errors
  • analyse general trends to support more effective planning of NHS services

By law, we must process this information to be able to provide this service.

We will ask you for:

  • information to identify you, and if necessary, your partner or any named individual provided on the claims form
  • your contact details
  • bank account or debit card details, which will be requested to process your payment if your claim is successful

We will collect information to support your claim which includes medical records, National Insurance number, and any supporting information you may wish to provide to support your claim.

Sharing your information

We may share your information with:

  • the Department of Health and Social Care (DHSC) for planning and information purposes
  • Centre for Health and Disability Assessments (CHDA) to assess your claim
  • Her Majesty’s Courts and Tribunals Service (HMCTS) to process any appeals

Your information may be shared with other organisations if they have a legal right to it.

Confidential patient information

When necessary, we’ll only share information that can identify you with those:

  • directly involved in reviewing and processing your claim
  • with a legal right to it
  • who you have given us permission to share with

Keeping your personal information

Your personal data will be retained for no longer than is necessary for the purpose for which it was obtained. The retention period is dependent upon the outcome of your application:

  • If your claim is successful – medical records will be retained for 6 years. Notice of payment will be retained for 50 years. 
  • If rejected based on criteria for assessment – the claims form will be retained for 6 years. Notice of claim made will be retained indefinitely.
  • All other rejected claims – retained for 50 years after your death. Notice of claim made will be retained indefinitely.

Your rights

The information you provided will be managed as required by Data Protection law.

You have the right to:

  • receive a copy of the information the NHSBSA hold about you
  • request your information be changed if you believe it was not correct at the time you provided it
  • request that your information be deleted if you believe the NHSBSA are processing it for longer than is necessary
  • withdraw consent at any time without any consequence to you
  • have access to your information restricted when you request your information be changed or use your right to be forgotten

Find out more about your rights and how we process information.