Skip to main content

NHS App privacy policy: online consultation services

Version 2, 21 April 2020

What are online consultation services?

Online consultations allow you to contact your GP practice without having to wait on the phone or take time to go into the practice in person especially if you are not sure you need a face to face consultation. Online consultations enable you to use a secure online system to ask questions, report symptoms and get advice.

Online consultations are not appropriate for emergencies. If you require urgent care you will be advised to go direct to:

  • NHS 111 - for patients who have an urgent medical problem and are not sure what to do
  • A&E department (also known as emergency department or casualty) - for genuine life-threatening emergencies or
  • call 999 - for a medical emergency when someone is seriously ill or injured and their life is at risk

An online consultation service usually includes asking a series of questions (called forms-based triage) to identify what you need and direct you to the right service. Online consultations can typically be used for:

  • asking for test results or a making a routine appointment
  • describing symptoms to their GP and getting advice (which may sometimes be that a face to face appointment is needed)

If your GP practice provides an online consultation service, this will be made clear on the GP practice website.

For NHS nationally funded online consultation services in England, your GP practice's online consultation service may also be available within the 'NHS App' and any requests which patients send to their GP practice will be securely sent from the NHS App to the GP practice system using the online consultation provider (as described in clause 1.2 of the NHS App terms of use).

The NHS App is provided by NHS Digital and supports health services such as enabling your GP practice to provide you with online access to sections of your health record. The NHS App can be downloaded from the App Store and Google Play.

Who is involved in providing online consultation services?

The following organisations are involved in providing online consultation services available through the NHS App. Their respective roles are described below. Refer to the section entitled 'The NHS App services and who we are' of the NHS App privacy policy for more information about them.

Your GP Practice

If an online consultation service is available at your GP practice, the GP practice (or the clinical commissioning group to which they belong) will have usually engaged one or more specialised online consultation supplier(s) to provide the service. The agreements in place with the supplier(s) ensure that your GP practice remains the 'Controller' of the patients' information and that patients' information is not used for any purpose other than the online consultation purpose. In relation to certain online consultation providers NHS England is also a joint data controller of your information alongside your GP practice, please see below.

Online Consultation Provider

An online consultation provider is a commercial organisation providing the online consultation service on behalf of your GP practice. Providers are usually contracted through an NHS England procurement framework, which involves scrutiny of their service including technical, clinical, privacy and security aspects.

An online consultation provider is a 'processor' for the GP practice which means it processes patients' personal information in accordance with instructions issued by the GP Practice and is not able to use the information for other purposes.

NHS Digital

NHS Digital will be a controller of personal data relating to your identify verification only if you decide to use the details already stored by NHS Digital (in NHS login) to also access the online consultation service. If you do not wish these details to be used, then NHS Digital is not a controller in respect of your use of an online consultation service. This is explained below:

NHS Digital connects the NHS App to the GP practice's online consultation service. For patients who use the NHS App, these patients will already have verified their identity for other confidentiality purposes e.g. to make sure a patient only sees their own confidential health record when using the NHS App to view the GP record.

Patients can, if they wish, use this verified identity information to access the online consultation service from within the NHS App. The benefits are that instead of having to exit the NHS App and re-identify themselves by manually logging into the consultation service and again going through identification checks, patients can save time using the details of their stored and verified identity. These details are name, age, NHS number, gender, email address. For more information about verified identities and the role of NHS login see the NHS login page.

Because NHS Digital provides the NHS login service it is therefore the controller for the personal information used to verify identities (but not for any health-related information). The patient decides whether to use the verified identity option to log into the consultation service or not. It is optional.

Regardless of your choice in respect of the verified identity option in all cases where you use an online consultation service through the NHS App, NHS Digital merely provides a connection within the NHS App to the online consultation service on behalf of the GP practice. This means that NHS Digital (and the online consultation provider(s)) are both processors i.e. they act under instruction from the GP practice that controls the patient information.

NHS England

In relation to certain online consultation providers NHS England is also a joint data controller with your GP practice, as NHS England has a role supporting the roll out of these services and ensuring appropriate information governance contracts are in place. Your GP will retain responsibility for managing your personal data and should be your primary point of contact. NHS England will be responsible for managing any system-wide incidents and national assurance of compliance with data protection legislation.

The online consultation providers to whom this applies are:

  • eConsult Health Limited

Who is my online consultation provider?

The online consultation services offered to you as a patient will depend upon which online consultation providers have been engaged by your GP practice or the Clinical Commissioning Group to which they belong.

The name of the provider is shown within the NHS App before any online consultation begins. It will also be named on the GP Practice website. If you are still unsure who your provider is, ask your GP practice.

If your GP practice does not offer online consultation services you will not see any options relating to online consultations within the NHS App.

Online consultation providers currently available through the NHS App

Links to privacy policies, and help and support, for online consultation providers
Name Online consultation services offered Privacy policy Help and support
eConsult Health Limited trading as eConsult or WebGP Forms-based triage for administrative tasks and symptom checking Your GP's Online Consultation Service Privacy Notice Help with online consultations

What personal data is processed for online consultation services and why?

The categories of personal data (as described in the section entitled 'What personal information do we use?' in the Privacy Policy) that are shared vary depending upon the online consultation provider, but generally:

  • Identity and contact information used to confirm who you are and that your requests are directed to your GP practice. This information comprises:
    • 'NHS login account information': Name, date of birth, NHS number
    • 'Information within your GP medical record': postal address
    • Manually entered: gender; email address; telephone number
  • 'Online consultation responses' - the answers you provide to questions asked by the online consultation service and the replies from your GP Practice are likely to contain sensitive medical information. Your requests and responses will be used to determine what the next appropriate steps should be, for example:
    • if urgent care is indicated, you will be advised to contact emergency services direct
    • your needs may be prioritised and
    • an appropriate response can be given which may be that a face-to-face appointment should be arranged or refer you to a more suitable service.

Your rights

Data Protection law provides a number of rights to you. You can exercise your rights by contacting the appropriate controller:

  • For your rights relating to NHS login account information (as described above) see the NHS App privacy policy
  • For your rights in relation to your online consultation responses (as described above), contact your GP practice for a copy of their privacy policy

Page last reviewed: 21 April 2020
Next review due: 21 April 2021