The NHS Business Services Authority (NHSBSA) and the Department of Health and Social Care are jointly responsible for this service.
Why we process your information
We’ll use the information you have given us to:
- process and verify your application
- help plan and make improvements to NHS services, and/or direct patient care
If you have an NHS pension and we do not have up-to-date details for you, we may use your information to update our records. This is so we can meet our legal obligation to send you information about your NHS pension benefits.
By law, we must process this information to be able to provide this service.
We will ask you for:
- your address so we can confirm your residency
- information to identify you
If appropriate, we will ask you for:
- information to identify your dependant(s)
- details of the treatment facility you are attending
- information about your income
Your information will not be transferred outside the UK, or the European Economic Area and Switzerland.
Sharing your personal information
To verify applications you make, where applicable, we will share your information with:
- third party data providers who will provide a residency check to indicate whether you are resident in the UK
- the Department for Work and Pension to validate your pension information
- countries within the European Economic Area and Switzerland to validate your pension information
We will share your personal information with the treatment facility caring for you and the country you choose to live in, to allow them to reclaim any cost treating you from the UK.
We may also share your information with the following to confirm any other information you have provided:
- the Department for Work and Pensions
- HM Revenue and Customs
- Department of Health and Social Care
To prevent, detect and investigate fraud and errors, we may share your information with:
- NHSBSA Fraud Team
- international healthcare providers and administrators providing treatment to you
- NHS Counter Fraud Authority
- Department of Health and Social Care – International Division and Anti-Fraud Unit
Keeping your personal information
We will delete your personal data from our systems and files no later than:
- 24 months after the expiry of your EHIC - to allow for treatment cost claims made near the end of your card expiry to be processed
- 7 years from the date your PRC was processed - to allow for treatment cost claims made to be processed
- 7 years from the date the NHSBSA are told you are no longer entitled to your S1
The information you provided will be managed as required by Data Protection law.
You have the right to:
- receive a copy of the information the NHSBSA hold about you
- request your information be changed if you believe it was not correct at the time you provided it
- request that your information be deleted if you believe the NHSBSA are keeping it for longer than necessary
Find out more about your rights and how we process information.