UKHSA FluSurvey Privacy Notice
FluSurvey is an internet based study of influenza, colds and other acute respiratory illnesses in the UK.
It was established in the 2009 flu pandemic by the London School of Hygiene and Tropical Medicine (LSHTM) as means of monitoring infection in the community, particularly illnesses which don’t result in seeking medical care compared to those which do result in seeking medical care. It also collects symptoms information, vaccination status, and the impact of illness on wellbeing. FluSurvey is a partner study in the Influenzanet collaboration with public health institutions in other European countries.
About UKHSA
The running of FluSurvey transferred from being a research project at LSHTM to being an established disease surveillance system of Public Health England (PHE), continuing its UK-wide coverage. On 1 October 2021, the UK Health Security Agency (UKHSA) came into being. An executive agency of the Department of Health and Social Care (DHSC), UKHSA combines many of the health protection activities previously undertaken by PHE together with all of the activities of the NHS Test and Trace Programme and the Joint Biosecurity Centre (JBC). The processing activities previously undertaken by these organisations and their associated data processors have not changed with the establishment of UKHSA. Individual rights are not affected by this change.
UKHSA is responsible for planning, preventing and responding to external health threats, and providing intellectual, scientific and operational leadership at national and local level, as well as internationally. We collect and use personal information to fulfil our remit from the government.
UKHSA’s responsibilities include running the FluSurvey website. The purpose of the FluSurvey website is to collect information for the purpose of surveillance and monitoring of infectious disease trends in the UK, such as influenza, COVID-19 and other respiratory diseases. It accomplishes this by collecting demographic and symptoms data directly from the general population via a surveillance webtool, rather than traditional surveillance methods, such as hospitals or GPs.
This privacy notice explains what personal information we collect, use and may share for the FluSurvey website. It explains what your rights are if we hold your personal information, and how you can find out more or raise a concern.
DHSC is the data controller for the personal information we collect, store and use to fulfil our remit as set out in the DHSC-UKHSA framework agreement.
The information we collect
The information we collect is demographic, health and treatment information, so that we can provide near-real time trends of self-reported infectious diseases in UK.
The personal information we collect and use includes your:
- Demographic information – such as, sex, month and year of birth, partial postcode (first part) of your home and work address, occupation, highest level of formal education/qualification, data about your lifestyle and family composition.
- Health and treatment information – such as vaccination history, underlying medical conditions, smoking habits, regular medications, allergies, and – via our weekly symptoms questionnaire; respiratory symptoms, infectious disease test information, including result (such as Influenza or COVID-19).
- Other information – such as username (if it includes personal information), email address and computing IP address.
How we collect your information
This personal information comes directly from you, once you register via the FluSurvey website. Participation is voluntary and primary account holders must be 18+ and reside in the UK to register.
When you register, you'll be asked to fill in a profile survey asking general demographic and health questions about yourself and risk factors relevant to some diseases (for example, household size, age, and vaccination status).
Then each week, as a registered participant you will be sent a symptoms questionnaire to complete, which requests that you report any respiratory symptoms you have experienced since your last visit, or to submit a null return.
Registered participants can also complete information on behalf of other people, for example household members.
The purposes we use your information for
This information is used primarily to monitor self-reported respiratory symptoms, social contact patterns and health service usage in the general population in near-real time. This is a critical surveillance tool for monitoring infectious disease trends in the UK (for example, COVID-19 and Influenza), particularly to understand infection and illness in people who do not use healthcare services.
The purposes we use the information are:
- To enable us measure in real time, trends of self-reported acute respiratory illnesses (COVID- 19 and Influenza-like-illness (ILI)) related symptoms in the community, hence acts as a respiratory infectious disease symptom tracking tool.
- Establish the prevalence of symptomatic acute respiratory illnesses such as COVID-19 and ILI in the general population.
- Measure or determine epidemiological parameters, such as duration of illness, frequency of illness, common symptom sets, health-related quality of life during illness compared to baseline.
- Measure socio-demographic factors and other potential risk factors for illness/illness parameters, and examine their association with these. Factors include age, sex, occupational group and modes of commuting, clinical factors such as vaccination status, and participants social contact rates (non-household in-person contacts the previous day).
- The FluSurvey cohort can also be invited to contribute to biological sampling such as respiratory swabbing.
- Use the data collaboratively with sister surveys in Europe for international comparisons related to the above aims and objectives.
The results of this work are to help government health agencies understand infectious disease activity relating to COVID-19, influenza and other seasonal respiratory viruses. This includes:
- Undertaking scientific research and statistical analysis of the spread of influenza and COVID- 19 in the UK and Europe.
- Publishing statistical analysis, graphical representations of the results, but only in ways that do not identify individuals – for example, information from the FluSurvey is published weekly in the National Influenza and COVID-19 surveillance reports that UKHSA produces, as well as on the Results section of the FluSurvey website.
- Providing you with personalized information on the results of the survey, in ways that do not identify individuals, for instance, how many registered users have symptoms related to Influenza/COVID-19 and other respiratory infections.
How we protect your information
The personal information used by FluSurvey is protected in several ways.
It is stored on computer systems that have been tested to make sure they are secure and which are kept up-to-date to protect them from viruses and hacking. Where we share your personal information with other organisations (refer to the ‘who we share your information with’ section below), we only ever do so using secure computer systems or encrypted email.
Your information used by us can only be seen by staff who have been specifically trained to protect your privacy. Strong controls are in place to make sure all these staff can only see the minimum amount of personal information they need to do their job.
Whenever possible, we only use your information in a form that does not directly identify you. For example, your questionnaire replies are associated with a unique identifying number that is only accessible to authorised UKHSA staff and cannot be traced back to your contact details, which are stored separately. We do this to help protect your confidentiality.
No information that could identify you or others is ever published by UKHSA or other organisations.
Where we store your information
All personal information used by the FluSurvey website is held in the UK, on secure UKHSA servers.
Influenzanet is a Europe-wide funded project, to monitor self-reported disease trends. UKHSA (the FluSurvey) is a partner study, along with public health institutions in numerous European countries (for example, Italy, France, Netherlands). As a partner study, FluSurvey may share information that does not identify you, with Influenzanet for the purpose of monitoring reported illness across countries. In these circumstances, such information will be stored on a secure Influenzanet Centralised Database, hosted in Italy.
Where information is stored outside of the UK, we ensure it fully complies with data protection law. Italy has an adequacy agreement in place with the UK, along with other countries of the European Economic Area (EEA). This means they are formally recognised by the UK government as providing legal protections over privacy at least equivalent to those that apply here in the UK.
Who we share your information with
We share information with researchers, but only in a form that does not identify you and is therefore not personal information. The researchers use this information to carry out scientific research and statistical analysis into infectious disease trends in the UK and Europe.
If we do share your personal information, it will only be in exceptional circumstances, where the law allows, and we only share the minimum necessary amount of information.
How long we keep your information
The personal information used by the FluSurvey will only be kept for as long as necessary, to ensure validity of the study and for long-term trend analysis. This will also be the case if you withdraw from the study before its completion. It will be reviewed regularly to determine whether it is still necessary to store this information.
Your rights over your information
Under data protection law, you have a number of rights over your personal information. You have the right to:
- Ask for a copy of any information we hold about you.
- Ask for any information we hold about you that you think is inaccurate to be changed.
- Ask us to restrict our use of your information, for example, where you think the information we are using is inaccurate.
- Object to us using any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case.
- Delete any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case.
- Ask us not to use your information to make automated decisions about you without the involvement of one of our staff – however please note the FluSurvey does not involve any automated decision making.
You can exercise any of your rights by contacting us at:
InformationRights@UKHSA.gov.uk or by calling us on 020 7654 8000.
You will be asked to provide proof of your identity so that we can be sure we only provide you with your personal information. You will not be asked to pay a charge for exercising your rights. If you make a request, we will respond to you within one month.
Our legal basis to use your information
The law on protecting personal information, known as the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018 (DPA), allows UKHSA to use the personal information collected via the FluSurvey website. The sections of the UK GDPR and the DPA that apply where we use personal information for the FluSurvey are:
- UK GDPR Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest’
- UK GDPR Article 9(2)(i) ‘processing is necessary for reasons of public interest in the area of public health’
- Data Protection Act 2018 Schedule 1 Part 1 (3) ‘public health’
How to find out more or raise a concern
If you would like to find out more about the FluSurvey you can contact us at flusurvey@ukhsa.gov.uk
If you have any concerns about how personal information is used and protected by UKHSA, you can contact the Department of Health and Social Care’s Data Protection Officer at data_protection@dhsc.gov.uk or by writing to:
Office of the Data Protection Officer
Department of Health and Social Care
1st Floor North
39 Victoria Street
London
SW1H 0EU
You also have the right to contact the Information Commissioner’s Office if you have any concerns about how UKHSA uses and protects any personal information it holds about you. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO’s website at ico.org.uk or by writing to:
Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5A