Question to the Department of Health and Social Care:

To ask the Secretary of State for Health and Social Care, which companies or organisations will process the analytics of the (a) inferred and (b) other data gathered by the NHS covid-19 contact tracing app; and whether that data will be held and processed in the UK under UK legislation.

Amazon Web Services, the engineering firm VMWare Tanzu, Google and Microsoft are all providing services necessary for the proper functioning of the app. Data may also be shared with NHS England and NHS Improvement. Where data is held outside of the United Kingdom it will be held within the European Economic Area. The contracts governing the arrangements with data processors contain standard clauses requiring compliance with the General Data Protection Regulation.

The data that app users have chosen to share with the National Health Service may be retained for research in the public interest, or by the NHS for planning and delivering services, in line with the law and on the basis of the necessary approvals required by law.

Data will be stored securely and processed in the UK. Information that does not, and cannot, identify you may be stored and processed outside of the UK (for example, information purely about the number of proximity alerts issued, or the number of outcomes from tests).