A controller is an organisation that determines the means and purposes of the processing of personal information.
We are The Common Services Agency for the Scottish Health Service, more commonly known as NHS National Services Scotland (“NHS NSS” or “us” or “we”). We designed the NVSS and administer the NVSS as a controller.
A processor is an organisation responsible for processing personal data on behalf of a controller. We use a number of processors for the purposes of NVSS, all under contracts with NHS NSS.
NHS NSS uses ServiceNow as a processor to provide software services. ServiceNow provides the IT platform on which information is stored but does not view or have routine access to your personal information.
In very exceptional and limited circumstances, ServiceNow may require indirect access to the databases or other parts of the system that hold personal data in order to provide technical support services to NHS NSS.
Microsoft Azure provides IT systems that we use to coordinate and manage vaccinations. Microsoft Azure Cloud Services are used to host the Platform from which the NVSS module sits on. Microsoft Azure does not have direct access to your personal information.
Gov.Uk Notify are used to send secure vaccination booking notifications back to you via email or text message, when you've re-scheduled your appointment via the portal or the National Vaccination Helpline.
The Notification Service has been built for the needs of government services. It has processes in place to protect your data (e.g. email and text messages encrypted). Staff have Security Check (SC) clearance from United Kingdom Security Vetting (UKSV).
Google Maps is used in the scheduling process to map your postcode to the nearest vaccination clinic. Google Maps will be provided with two postcodes (one of the home address and one of the clinic) through Service Now. Only the IP address of Service Now’s server will be visible to Google Maps.