• Reference Number: HEY970/2026
• Departments: Diabetic Eye Screening
• Last Updated: 28 October 2026

Why we use your personal information

NHS England and local screening services use personal information from medical records to invite you or your child for screening.

Screening helps find health problems early, before someone feels unwell.

We also use personal information to:

• check that screening services are safe
• make sure people are invited at the right time
• understand how well screening programmes are working
• find ways to improve them

Everyone should get the same high-quality screening service wherever they live. This is why, in addition to your local screening clinical services, NHS England runs a dedicated Screening Quality Assurance Service (SQAS) team, made up of quality assurance staff and health professionals working to make everyone’s screening journey the best it can be.

The role of the NHS SQAS team is to measure the quality of the screening service to ensure that it is effective and maintaining a high quality. To do this our quality assurance service teams:

• bring together and review information from across the screening service to see what’s working well, and where we can offer support to improve things
• visit local screening sites to see if they are meeting our high-quality standards
• investigate any issues we find during our reviews and visits or are reported to SQAS, to understand and address problems with how the service is running

Most of the time, we use information in a way that does not show who you are.

Your personal information is protected by law. This law gives you rights over how your personal information is used.

Who is responsible for your personal information?

Local screening services and NHS England are responsible for looking after your personal information.

This means they must:

• keep it safe
• only use it for the right reasons
• follow the law

NHS England is responsible for personal information used to:

• run screening programmes
• check they are safe and working properly
• look at numbers and patterns to improve services

What sort of information does the NHS Diabetic Eye Screening Programme hold about me?

Your GP provides your information to the programme because they have a duty to make sure you receive an invitation for eye screening as part of your diabetes care. The information is used to send screening invitations and reminders.

The information the programme has about you is:

• your name
• date of birth
• contact details (address and phone number)
• NHS number
• ethnicity
• details of your GP
• information to help establish your preferred language and contact method
• whether you might need large print documents

The programme might also hold information that allows your invitation to be based on clinical need. This includes the date you were identified as having diabetes.

This information usually comes from NHS records such as GP or hospital systems.  If you use the NHS App, you may get screening invitations or results through the App. Local screening services may also send reminder messages. You can ask them to stop at any time.

Sometimes, screening services need a bit more personal information to help people get the right care. For example, if someone has a disability, staff may need to allow more time in an appointment. Only information that is needed for screening is shared.

Who will see information about me?

• staff involved in the administration of the programme
• staff who carry out the screening process – including administering eye drops, checking vision, taking your history, taking photographs of your eyes and grading the photographs

Screening staff in the Humber Diabetic Eye Screening Programme are employed by Hull University Teaching Hospitals NHS Trust. You should let programme staff know if you have any concerns about a particular individual. If you are referred to hospital for further assessment, we will forward information about you to the hospital, so they know as much about your history as possible.

Clinical auditors and others involved in quality assurance assess the work of the screening programme to make sure the programme is operating effectively. To do this they may need access to your data.

Fully anonymised data may be used nationally to carry out research to try to improve the way diabetes is managed in the long term. Any request to use identifiable information for research purposes requires the involvement of the programme’s confidentiality advisory group to make sure all necessary agreements are obtained.

Problems may occasionally occur in the software which supports the programme. The software suppliers do not normally need to see any information identified to a specific individual. But if there are problems with the software the suppliers may need to receive some basic patient identifiable information to ensure the correct information is maintained by the programme securely. Software suppliers who work with the NHS are bound by requirements of confidentiality and should be supervised by NHS staff if they need to look at information linked to a named individual.

Your results and screening information will be sent to your GP.

Keeping your personal information safe

We take keeping your personal information safe very seriously.

Your information is:

• stored on secure computer systems
• only seen by trained staff who are allowed to use it
• always held securely

We will never:

• sell or rent your personal information
• use it for advertising or marketing purposes

Using information to make sure screening is safe and works well

NHS England uses information to:

• check people are invited correctly
• see how well screening services are working
• look into problems if something goes wrong

Most of the time, we use information that:

• has names removed, or
• is grouped together with lots of other people’s information

Sometimes, we may need to use information that shows who someone is, to understand what happened and fix a problem.

We never publish information that could identify you or your child.

Using Information to learn and improve services

NHS England looks at screening information to:

• understand how many people are taking part
• see where services could be improved
• help reduce health inequalities
• plan better services in the future
• design and evaluate pilot projects.

For this work, we use information that does not directly identify people.

Sometimes we may need to use information that identifies someone (for example, to check that everyone was followed up properly and to make sure no one was missed). Access is limited to trained staff, and we do not publish anything that could identify you.

We may also ask people if they would like to help by giving feedback or taking part in user research. This is always optional.

Testing new computer systems

NHS England sometimes builds new computer systems to improve screening services. Before these systems are used for real, they must be tested. To do this:

• we may use information already held by the NHS
• access is limited to a small number of trained staff
• information is deleted when testing is finished

Most of the data will not identify individuals, but where we need to use personal information, it will be treated confidentially.

Using your information for research

Sometimes, you or your child’s personal information from screening programmes is used for research.

Research helps doctors and scientists learn how to:

• improve screening
• improve treatments
• help people stay healthy

This only happens when:

• the research is approved by experts, and
• special legal permission is given

You can choose not to have your information used for research if you want. You can find out more or register your choices to opt out of your data being used for research purposes at: www.nhs.uk/your-nhs-data-matters

National health registers

Some information from screening programmes is shared with national health registers.

These registers help the NHS:

• understand how common certain illnesses are
• see how well screening programmes are working
• improve care for future patients

You can choose not to be included in these registers. See information at: www.digital.nhs.uk/ndrs/patients/opting-out

How long information is kept

The law allows the NHS to use personal information:

• to invite people for screening
• to keep screening services safe and effective

You can find out more at: www.england.nhs.uk/contact-us/privcy-notice/nhs-england-privacy-notice

In some cases, we will have a legal obligation to use your information for a particular purpose. For example, when we are directed by the Secretary of State for Health and Social Care.

Your rights and getting help

You have rights over your personal information.

These include the right to:

• ask what information the NHS holds about you
• ask for a copy

If you want to access your screening results, contact your GP or local screening service. If you are a parent and would like to see your child’s results, please contact your GP.

To find out more about how your information is used, you can visit the NHS England Privacy Notice at: www.england.nhs.uk/contact-us/privacy-notice. This explains your rights and how to make a request.

If you are worried about how your information is used, you can contact NHS England: www.england.nhs.uk/contact-us or the Information Commissioner’s Office: www.ico.org.uk/global/contact-us

Your choices

Screening is your choice. You can:

• choose to take part in screening
• choose not to take part
• opt out of invitations and opt back in later

If you take part in screening, information about you will still be used to make sure services are safe and working properly. This helps everyone who is screened.

Opting out is specific to each screening programme. This means you can opt out of one programme and still be invited for another programme if you become eligible. You can opt back in later if you change your mind.

You can choose not to have your information used for research. This is explained later in the document.

How can I opt out of my data being transferred to the screening programme?

If you do not want your GP to provide information about you to your local diabetic eye screening programme you should contact your GP.

You should be aware that local programmes are unable to invite patients for screening who withdraw their consent to the transfer of their patient information. This is because it is not possible for local programmes to provide a safe and reliable method of invitation if they do not have reliable information from GPs.

Your GP may ask you to sign a form confirming that you wish to opt out of screening. They will need to inform the local programme that you have withdrawn your consent. They will only do this once so that you do not receive any further screening invitations.

GP2DRS IT system

GP2DRS is a system for automating the sharing of patient information between general practices and local diabetic eye screening programmes.

GPs are responsible for referring eligible patients with diabetes for diabetic eye screening, by communicating each patient’s contact details to their local programme.

Local programmes collate the information received from GPs and other health professionals to maintain an up-to-date list of eligible patients in order to invite them for screening. To support this, the GP2DRS system enables GPs to share patient information with local programmes in an accurate and timely fashion so patients can be invited for screening.

GP2DRS uses the General Practice Extraction Service (GPES) provided by NHS Digital to obtain the information of eligible patients from computer systems used by GPs. GP2DRS stores this information and provides local programmes with secure access to their patients so they can ensure their records are kept up to date.

Patient records are shared on the basis:

• that it is necessary for a medical purpose
• of implied consent

Consent is implied from patients being made aware that their information needs to be shared in order for them to receive direct care. When a patient is diagnosed with diabetes, clinicians will normally explain that they will be invited for diabetic eye screening. The patient will also be made aware that their details will be passed to a local programme. Patient information is not provided by GP computer systems where a patient has withheld their consent to the transfer of their data.

What information GP2DRS uses and why

GP2DRS obtains relevant patient information for eligible patients on a monthly basis from GP practices in England that are signed up to the GP2DRS system.

It identifies patients who are:

• diagnosed with diabetes
• aged 12 or over
• registered with a GP in England
• not withholding their consent to the transfer of their information

GP2DRS obtains and uses the following information about each eligible patient so they can be identified and invited for screening:

• name
• address
• sex
• date of birth
• GP practice
• NHS number and first language
• diagnosis of diabetes
• consent status to the transfer of information

GP2DRS obtains and uses the date on which any change is recorded to a patient’s diabetes status. This enables the system to calculate whether a patient has a current diagnosis of diabetes. However, GP2DRS does not obtain or provide a patient’s diagnosis date because this clinical information is not required to identify those patients who should be invited for screening.

Screening providers cannot infer the earliest date for a patient’s ‘diagnosis date’ from their ‘recorded status change date’.

GP2DRS obtains and uses other demographic information, including the patient’s ethnicity, their previous screening attendance dates, preferred language and if they need an interpreter.

GP2DRS compares the information received each month with the data received previously in order to highlight:

• patients who are new to the local programme (such as those who are newly diagnosed with diabetes or newly moved into the geographical area of the local programme)
• patients with changes to their details (including changed names or moved house)
• patients who are no longer within the screening cohort (such as those who have moved outside the geographical area of the local programme or have withdrawn their consent to the transfer of their information)

This allows local programmes to update their patient records more easily and systematically.

GP2DRS stores patient information on an ongoing basis to ensure local programmes can access up-to-date patient records. PHE itself does not access patient records and does not directly contact patients.

How GP2DRS protects the information it uses

The information GP2DRS collects is securely transmitted from general practices (via NHS Digital) to the GP2DRS database. The GP2DRS database complies with all national guidance on the secure storage of patient information. Local programme access to information on the GP2DRS database is restricted and protected with firewalls and secure user authentication in line with national guidance that ensures only authorised users can access information from designated computers.

PHE and local programme staff are bound by clear legal and professional obligations to protect the confidentiality of the information they collect and use. As well as limiting the amount of personal information we hold, we make sure local programme staff can only see the information that relates to their programme and which is essential for them to do their job.

Who GP2DRS shares information with and why

GP2DRS shares patient information with local programmes so patients can be invited for diabetic eye screening using accurate and up-to-date information. This information is shared through a secure web portal which allows local programmes to update their patient records systematically. If GP2DRS identifies that an individual is no longer within the list of patients, it previously provided to a local programme then it shares this fact with that programme.

Local programmes are unable to invite patients for screening who withdraw their consent to the transfer of their patient information. This is because it is not possible for local programmes to provide a safe and reliable method outside GP2DRS to transfer patient information from general practices.

Your personal information and your rights

By explaining the important reasons why, we use personal information, and the careful steps we take to protect confidentiality, we hope patients will be content for their data to be processed in this way. However, if they do not wish to have their information transferred via this system they should contact your GP.

Find out how PHE and the NHS use and protect your screening information at www.gov.uk/phe/screening-data

For the young person and adult screening programmes, we also include a clear statement about opting out of future invitations:

To opt out of screening, see www.gov.uk/phe/screening-opt-out

Where we have identified any third-party copyright information you will need to obtain permission from the copyright holders concerned.

General Advice and Consent

Most of your questions should have been answered by this leaflet, but remember that this is only a starting point for discussion with the healthcare team.

Consent to treatment

Before any doctor, nurse or therapist examines or treats you, they must seek your consent or permission. In order to make a decision, you need to have information from health professionals about the treatment or investigation which is being offered to you. You should always ask them more questions if you do not understand or if you want more information.

The information you receive should be about your condition, the alternatives available to you, and whether it carries risks as well as the benefits. What is important is that your consent is genuine or valid. That means:

• you must be able to give your consent
• you must be given enough information to enable you to make a decision
• you must be acting under your own free will and not under the strong influence of another person

Information about you

We collect and use your information to provide you with care and treatment. As part of your care, information about you will be shared between members of a healthcare team, some of whom you may not meet. Your information may also be used to help train staff, to check the quality of our care, to manage and plan the health service, and to help with research. Wherever possible we use anonymous data.

We may pass on relevant information to other health organisations that provide you with care. All information is treated as strictly confidential and is not given to anyone who does not need it. If you have any concerns please ask your doctor, or the person caring for you.

Under the General Data Protection Regulation and the Data Protection Act 2018 we are responsible for maintaining the confidentiality of any information we hold about you. For further information visit the following page: Confidential Information about You.

If you or your carer needs information about your health and wellbeing and about your care and treatment in a different format, such as large print, braille or audio, due to disability, impairment or sensory loss, please advise a member of staff and this can be arranged.