Vaccination Privacy Policy

Croydon Health Services NHS Trust’s Privacy and Transparency notice for School Vaccinations

Our contact details

Patient Advice and Liaison Service (PALS)

Croydon Health Services NHS Trust,

530 London Road, Croydon, CR7 7YE

020 8401 3210

The type of personal information we collect

We (the Trust) currently collect and process the information that you provide to us, this includes:

  • Personal identifiers your name, postal address, email address and telephone contact details.
  • Your child(ren)’s name, their date of birth, gender, ethnicity, the name of the school they attend and their NHS number (if you have it available).
  • Your digital consent for your child(ren) to be vaccinated at their school as part of the school’s vaccination program.


How we get the personal information and why we have it

Most of the personal information we process and use is provided to us directly by you.

  • We will use your information to provide your child(ren) with access to vaccinations where you have agreed and consented for your child(ren) to be vaccinated.
  • We will record the vaccination your child receives and the date the vaccine was given in your child’s health record.
  • If you choose not to consent to vaccination your child’s health record will show that they did not receive the vaccination.

We may also receive personal information indirectly, from your child(ren)’s school if we are unable to obtain the information directly from you. We contact and work with your child(ren)’s school to ensure we have a complete record of all children who have been vaccinated and those children who have not been vaccinated. We want to make sure no child(ren) are missed or overlooked so that we can be fair to and include all children in the vaccination program.

  • We use the information that you have given us in order to contact you and answer any questions or concerns you may have about the vaccination program.

The Trust uses a data processor called Versone who are the organisation that provides this website and stores the information you have provided in a secure electronic location. Versone acts on instructions from the Trust under a contractual obligation as a ‘data processor’ to collect and store your information for the immunisation team at the Trust to use as described in this privacy notice.

Under the General Data Protection Regulation (GDPR), the lawful bases we rely on for processing this information are:

To perform a public task in the public interest in the area of public health and to provide health care and treatment.


How we store your personal information

Your information is securely stored encrypted in a secure location. Only a small number of staff in the Trust’s immunisation team have access to your information for the purpose of organising and carrying out school immunisation.

We keep the personal information you provide on the secure electronic storage location created for the website for no more than 12 months. The immunisation team will then dispose of your information by deleting it from this secure electronic storage location.

Meanwhile your child(ren)’s health record will be kept in accordance with the NHS retention schedule and code of practice for health records.

You can find out more about health records from the Trust’s main privacy policy available on the Trust’s website:


Your data protection rights

Under data protection law, you have rights including:

Your right of access - You have the right to ask us for copies of your personal information.

Your right to rectification - You have the right to ask us to rectify personal information you think is inaccurate. You also have the right to ask us to complete information you think is incomplete.

Your right to restriction of processing - You have the right to ask us to restrict the processing of your personal information.

Your right to object to processing - You have the the right to object to the processing of your personal information.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at: if you wish to make a request to access your information.


How to complain

If you have any questions, comments, concerns about your information rights or want to make a complaint about your health information you can contact the Data Protection Officer who has responsibility to ensure the protection of your information in accordance with your rights by email at: or by post at:

Data Protection Officer, Information Governance, Croydon Health Services, HQ  Woodcroft Wing, 530 London Road, Croydon CR7 7YE..

Alternatively you can contact PALS at

or write to the Caldicott Guardian at: Caldicott Guardian, Medical Director’s Office, Croydon Health Services, Trust HQ,  Woodcroft Wing, 530 London Road, Croydon CR7 7YE.

If after contacting us, you still have concerns about your personal information and want to make a complaint to the supervisory authority or find out about your information rights, contact the Information Commissioners Office at:

Information Commissioner’s Office

Wycliffe House

Water Lane





Helpline number: 0303 123 1113

ICO website: