UKHSA FluSurvey Privacy Notice (Updated in October 2026)

FluSurvey is a UK-wide online survey run by the UK Health Security Agency (UKHSA). It helps monitor influenza, COVID-19 and other respiratory illnesses by collecting information directly from participants about their symptoms, vaccination status and the impact of illness on their wellbeing.

FluSurvey is part of Influenzanet, a collaboration between public health organisations across Europe that monitors disease trends using information provided by participants.

About UKHSA

The UK Health Security Agency (UKHSA) is an executive agency of the Department of Health and Social Care (DHSC). UKHSA is responsible for planning, preventing and responding to health threats. We collect and use personal information to fulfil our remit from the government.

UKHSA’s responsibilities include running the FluSurvey. The FluSurvey monitors infectious disease trends in the UK, such as influenza, COVID-19 and other respiratory diseases. It accomplishes this by collecting demographic and symptoms data directly from the general population via a surveillance webtool, rather than traditional surveillance methods, such as hospitals or GPs.

This privacy notice explains what personal information we collect, use and may share if you participate in the FluSurvey. It explains what your rights are if we hold your personal information, and how you can find out more or raise a concern.

DHSC is the data controller for the personal information we collect, store and use to fulfil our remit as set out in the DHSC-UKHSA framework agreement.

The information we collect

We collect information about you, your health and your experiences of illness, so that we can provide near-real time trends of self-reported infectious diseases in the UK.

The personal information we collect and use includes your:

  • Demographic information – such as, sex, month and year of birth, country, partial postcode (first part) of your home address, occupation, highest level of formal education/qualification, data about your lifestyle and family composition.
  • Health and treatment information – such as vaccination history, underlying medical conditions, smoking habits, allergies, and – via our weekly symptoms questionnaire; respiratory symptoms, infectious disease test information, including result (such as Influenza or COVID-19).
  • Other information – such as username (if it includes personal information), email address and computing IP address.

How we collect your information

We collect this personal information directly from you when you register via the FluSurvey website. Participation is voluntary and primary account holders must be 18+ and reside in the UK to register.

When you register, you will be asked to complete a profile questionnaire asking general demographic and health questions about yourself and risk factors relevant to some respiratory viral diseases (for example, household size, age, and vaccination status).

Then each week, we will invite you to complete a symptoms questionnaire, which requests that you report any respiratory symptoms you have experienced since your last visit, or to submit a null return.

You may also provide information on behalf of other people, for example household members.

The purposes we use your information for

We use your information to monitor infectious disease trends in the UK and understand how illnesses (such as COVID-19 and influenza) affect the population, including among people who do not use healthcare services.

The purposes we use the information are:

  • Monitor levels of respiratory illness in the community.
  • Understand how illnesses spread and affect different groups of people.
  • Identify factors that may increase or reduce the risk of illness.
  • Invite participants to take part in related activities, such as respiratory swabbing.
  • Use the data collaboratively with sister surveys in Europe for international comparisons related to the above aims and objectives.

The results of this work help government health agencies understand infectious disease activity relating to COVID-19, influenza and other seasonal respiratory viruses. This includes:

  • Undertaking scientific research and statistical analysis of the spread of influenza and COVID- 19 in the UK and Europe.
  • Publishing statistical analysis, graphical representations of the results, but only in ways that do not identify individuals – for example, information from the FluSurvey is published weekly in the National Influenza and COVID-19 surveillance reports that UKHSA produces, as well as on the Results section of the FluSurvey website.
  • Providing you with personalised information on the results of the survey, in ways that do not identify individuals, for instance, how many registered users have symptoms related to Influenza/COVID-19 and other respiratory infections.

How we protect your information

We take appropriate technical and organisational measures to protect your personal information.

Your information is stored on secure systems that are regularly tested and maintained. Access is restricted to authorised staff who need it to carry out their work and who have received data protection training. Whenever possible, we only use your information in a form that does not directly identify you. For example, your questionnaire responses are associated with a unique identifier and stored separately from your contact details. Access to the unique identifier is restricted to authorised UKHSA staff. This means questionnaire responses are not routinely identifiable to UKHSA staff and cannot readily be linked to your contact details. We do this to help protect your confidentiality.

No information that could identify you or others is ever published by UKHSA or other organisations.

Where we store your information

Personal information collected through FluSurvey is stored in the UK on secure UKHSA systems.

Your information stays in the UK, except in one circumstance. FluSurvey uses SendGrid to send emails about your FluSurvey participation. As part of this service, your email address is processed in the European Union (EU). The UK government recognises EU countries as providing an adequate level of data protection, meaning your information remains protected in line with UK data protection law. If you delete your FluSurvey account, your email address will no longer be processed by SendGrid.

Who we share your information with

FluSurvey is part of Influenzanet, a collaboration project between public health organisations across Europe that monitors self-reported disease trends. To support international monitoring of acute respiratory illness, FluSurvey may share information that does not identify you with Influenzanet. This information is stored on a secure database hosted in Italy.

We share information with researchers, but only in a form that does not identify you and is therefore not personal information. The researchers use this information to carry out scientific research and statistical analysis into infectious disease trends in the UK and Europe.

If we do share your personal information, it will only be in exceptional circumstances, where the law allows, and we only share the minimum necessary amount of information.

How long we keep your information

The personal information used by the FluSurvey will only be kept for as long as necessary, to ensure validity of the study and for long-term trend analysis. This will also be the case if you withdraw from the study before its completion. It will be reviewed regularly to determine whether it is still necessary to store this information.

Your rights over your information

Under data protection law, you have a number of rights over your personal information. You have the right to:

  • Ask for a copy of any information we hold about you.
  • Ask for any information we hold about you to be changed if it is inaccurate.
  • Ask us to consider restricting our use of your information, although this is not an absolute right and we may need to continue to use your information in the interests of public health – we will tell you why if this is the case.
  • Object to us using any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case.
  • Delete any information we hold about you, although this is not an absolute right and we may need to continue to use your information – we will tell you why if this is the case.
  • Ask us, in appropriate circumstances, to transfer your personal information to a recognised health authority both in the UK and in other countries, but also to you or your private health provider in a machine-readable format.

As explained in the "How we protect your information" section, questionnaire responses are associated with a unique identifier, stored separately from contact details and are not routinely identifiable to UKHSA staff. As a result, we may not be able to readily identify which questionnaire responses relate to a particular participant when responding to a rights request. In some cases, we may need additional information from you and may be unable to fulfil certain requests where we cannot reliably identify the relevant records. Where this applies, we will explain the reasons for our decision

You can exercise any of your rights by contacting us at:

InformationRights@UKHSA.gov.uk or by calling us on 020 7654 8000.

You will be asked to provide proof of your identity so that we can be sure we only provide you with your personal information. You will not be asked to pay a charge for exercising your rights. If you make a request, we will respond to you within one month.

Our legal basis to use your information

  • We process your personal information under the UK General Data Protection Regulation (UK GDPR) lawful bases that relate to public interest and public health: Article 6(1)(e) and Article 9(2)(i).
  • Separately, we obtain your common law consent to meet the legal and ethical requirements for processing your confidential patient information, in line with the common law duty of confidentiality.

How to find out more or raise a concern

If you would like to find out more about FluSurvey you can contact us at flusurvey@ukhsa.gov.uk

If you have any concerns about how personal information is used and protected by UKHSA, you can contact our Data Protection Officer at complaint@UKHSA.gov.uk or by writing to:

Data Protection Officer c/o Complaints Team UK Health Security Agency 10 South Colonnade London E14 4PU

You also have the right to contact the Information Commissioner’s Office if you have any concerns about how UKHSA uses and protects any personal information it holds about you. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO’s website at ico.org.uk or by writing to:

Customer Contact
Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF