Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, which organisation (a) developed and (b) owns the copyright for the facial recognition software for the NHS App; what steps his Department has taken to ensure that the NHS App was tested on a diverse range of faces; and if he will set out under what circumstances data collected by that App will leave (i) the device, (ii) the NHS and (iii) the UK.

The facial verification software for the NHS App was developed by iProov who also own the copyright. iProov have developed their services using datasets which are highly diverse across age, ethnicity and gender and their services are continually performance-tested to ensure a high-level coverage across all face types.

NHS login and NHS App store and process personal data within the United Kingdom and European Economic Area. NHS Digital use two approved identity verification suppliers to check the user submitted photographic identity document. This data is processed outside of the device but remains within the control of NHS Digital as the data controller and within the UK. Data leaving the UK is heavily restricted. There are two data processors engaged by NHS Digital to support delivery of the NHS App who process data outside the UK.