OpenSAFELY Privacy Notice

NHS England has been directed by the government to establish and operate the OpenSAFELY COVID-19 Service and the OpenSAFELY Data Analytics Service. These services provide a secure environment that supports research, clinical audit, service evaluation and health surveillance for COVID-19 and other purposes.

Each GP practice remains the controller of its own GP patient data but is required to let approved users run queries on pseudonymised patient data. This means identifiers are removed and replaced with a pseudonym.

Only approved users are allowed to run these queries, and they will not be able to access information that directly or indirectly identifies individuals.

Patients who do not wish for their data to be used as part of this process can register type 1 opt out with their GP.

Find additional information about OpenSAFELY

Record of Processing Activities

• The creation and maintenance of a pseudonymised GP dataset (only coded patient data), held within Optum, made available to NHS England–approved studies via the OpenSAFELY platform
• The GP data remains under practice control and is retained for the duration of the DPN, with only study-specific cohorts and results transferring to NHS England control
• The DPN establishes a legal obligation (UK GDPR Article 6(1)(c)) on practices, with purposes and safeguards set out in the DPN