LAMP COVID-19 Testing - Joint Privacy Notice

The Department of Health and Social Care has appointed Lancashire Teaching Hospitals NHS Foundation Trust (‘the Trust’) as hosts of the Lancashire and South Cumbria Pathology Collaborative, to establish a regional COVID-19 LAMP saliva testing hub to enable the carrying out of LAMP saliva testing for staff in participating NHS and non-NHS organisations across Lancashire and South Cumbria.

The Healthier Lancashire and South Cumbria Integrated Care System (ICS) are supporting the COVID-19 response in providing a system to support the COVID-19 LAMP saliva testing, this is known as the HiPRES digital application. Further information about the ICS can be found on the website Healthier Lancashire and South Cumbria. 

This Privacy Notice explains how personal data (information about you) collected as part of this testing programme will be processed (collected, stored, used and destroyed).

There are multiple organisations involved in the testing and this means that different organisations will be processing your personal data at different points in the process. Data Protection Impact Assessments have been completed to ensure all processing of your personal data is in compliance with data protection legislation. Each organisation will require a different level of information about you, but in each case the minimum amount of data necessary for each part of the programme will be used.

This includes data processors, for example companies providing and maintaining the digital application and Covid-19 Hub technical infrastructure and who are acting as Data Processors on behalf of, and under contract with, the COVID 19 LAMP Project.

The type of personal information we collect

We currently collect and process the following personal and special category data:

  • First name, Family name

  • Date of birth
  • Gender
  • Address, including postcode
  • NHS Number
  • Email address
  • Mobile phone number
  • Your test and test results (special category data)

How we get the personal information and why we have it

Most of the personal information we process is provided to us directly by you for one of the following reasons:

  • Register you for participation in the Programme and to download the HiPRES digital application

  • Validate and retrieve your NHS number
  • Receiving and processing the LAMP Covid-19 tests
  • Returning the results about your tests to you
  • Communicate with you to provide support / information about testing and further testing required if your test result is positive
  • Communicate with you about the Programme
  • Sharing results with users within your organisation who have a legitimate need including:
  1. Occupational Health Team (to provide advice, support and further actions for staff whose test result is positive) (in some cases this may be an out-sourced function)
  2. Line managers to support their team members and for operational and management purposes (not during initial phase)
  3. Other managers for analysis and to enable the organisation with planning and its response to the Covid emergency (aggregate - this information will not identify you )
  • Sharing results with Public Health England to meet statutory requirements
  • Sharing results with your GP if you receive a positive test result
  • To invite you to participate in research

To enable you to register and use the digital App for testing you will require a user name and password. For most users this will be the same user name and password you use in your employment (there is a look up to a system used in your organisation to manage access to the network, this is called Active Directory). In some cases, for example, non-NHS organisations an Active Directory account will need to be created for you.

Legal basis for processing your information

Under the UK General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

  • Processing Personal Data - Article 6

6(1)(e) Necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller

  • Processing Sensitive Personal Data – Article 9

9(2)(h) Necessary for the reasons of preventative or occupational medicine, for assessing the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or management of health or social care systems and services on the basis of Union or Member State law or a contract with a health professional
9(2)(i) Necessary for the reason of public interest in the area of public health, such as protecting against serious cross border threats to health or ensuring high standards of healthcare and of medicinal products or medical devices.

  • Purpose (vi) – Public Health England is met by:

Processing is necessary for notification of Covid-19 infectious disease as required by Public Health (Control of Disease) Act 1984 and Health Protection (Notification) Regulations 2010.

  • Purposes (vi) – Public Health England / Research (vii) via Covid-19 Data Hub is met by:

The common law duty of confidentiality is met by the public interest (to respond to and support the public emergency). The legal gateway is the COPI Notice.
The COPI Notice, under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 - COPI Notice 20 March 2020:

Delivering services to patients, clinicians, the health services and adult social care services workforce and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of health care and adult social care services.

How we store your personal information

We have a legal duty to keep your information secure and confidential. Strict rules apply to ensure we keep your information secure and to comply with the Data Protection Act 2018 and the UK General Data Protection Regulation.

Your information is stored securely within data centres (including cloud hosted solutions) located within the UK.

Your information will be retained in line with the NHS Records Management Code of Practice for Health and Social Care 2016 retention schedules.

Your data protection rights

Under data protection law, you have rights including:

  • Your right of access - You have the right to ask for copies of your personal information.
  • Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.
  • Your right to erasure - You have the right to ask us to erase your personal information in certain circumstances.
  • Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information in certain circumstances.
  • Your right to object to processing - You have the the right to object to the processing of your personal information in certain circumstances.
  • Your right to data portability - You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.


Contact details

If you wish to make a request, please contact us at:

HiPRES-Enquiries (Healthier Lancashire and South Cumbria) -

If you would like to find out more information about how your personal data is processed or have any concerns about our use of your personal information, you can make an enquiry or complaint to us at

HiPRES-Enquiries (Healthier Lancashire and South Cumbria) -

Depending on your query, it may be forwarded to the relevant Data Controller to resolve your issue.

You can also complain to the ICO if you are unhappy with how we have used your data. The ICO’s address:
Information Commissioner’s Office
Wycliffe House
Water Lane

Helpline number: 0303 123 1113

ICO website (opens in a new window)

Changes to this privacy notice
This privacy notice will be reviewed and updated periodically to reflect any feedback or changes to the processing.

LAMP COVID-19 Testing - Joint Privacy Notice (PDF)

Accessibility tools

Return to header