Coronavirus (COVID 19) Supplementary Privacy Notice

Scope and Overview

This privacy notice explains how Acacium Group and all its group companies collect, use, hold and process the personal data of our agency workers and candidates in response to the Coronavirus (COVID-19) pandemic. The information is collected for the purpose of health, safety and well-being throughout the UK, in compliance with the legislative requirements of each country.

This supplementary privacy notice explains the personal information we collect, use and share for this purpose. It explains what your rights are if we hold your personal information.

When we mention "we", "us" or "our" in this privacy notice, we are referring to Acacium Group and all its group companies.

The collection of personal information and personal data will be limited to what is proportionate and necessary, taking into account latest guidance issued by the Government and health professionals. The information collected will enable Acacium Group and all its affiliated Companies to monitor, take steps for safety, put contingency plans in place, respond to client needs to safeguard those who are vulnerable and to aid business continuity as far as is possible to do so.

Please contact us if you have any questions about this privacy notice or personal data, we use about you:

  • by email to:; or
  • by writing to: Data Protection Officer, Acacium Group, Turnford Place, Great Cambridge Road, Turnford, Broxbourne EN10 6NH

If you have any concerns about the personal data we use about you, you have the right to make a complaint at any time to the Information Commissioner’s Office (ICO), the UK supervisory authority for data protection issues, by contacting them at We would, however, appreciate the chance to deal with your concerns before you approach the ICO, so please feel free to contact us in the first instance. We regularly review this privacy notice and will update it where necessary. We will notify you of any significant changes.  This privacy notice was last updated on 01/12/2021.


When will this privacy notice apply?

This privacy notice will apply when you work for us and to personal data that we collect from you relating to COVID 19 vaccinations, exemption and positive test results and should be read alongside our standard privacy notice.

We are committed to ensuring that your privacy is protected.

What personal data is being collected?

The personal data is necessary to enable us to help control and prevent the spread of Coronavirus.

We may ask you to provide or confirm the following information:

  • COVID 19 Vaccination dates
  • COVID 19 Make of Vaccine
  • Government approved evidence of vaccine
  • COVID 19 Exemption status
  • Government approved exemption evidence
  • Approved evidence of vaccine or exemption status
  • Data to enable us to risk assess your COVID Age Risk:
    • Current health diagnosis
    • Health risk factors
  • Positive COVID test result
    • Isolation start and end dates

Vaccine and exemption data will be collected in order to safeguard the health and safety of workers and patients. The data will be considered in relation to the deployment of workers in direct care roles, or environments where COVID 19 risk is identified.

What is our lawful basis to use and process your personal data?

The law on protecting personal information, known as the General Data Protection Regulation (GDPR) and the Data Protection Act 2018, allows us to use your personal information to help control and prevent the spread of Coronavirus. We process both personal data and special categories of personal data, particularly data about your health and ethnic group, for this purpose. The lawful basis for processing is –

  • Article 6 (UK GDPR) –Processing is necessary for the performance of a public task carried out in the public interest or in the exercise of official authority vested in the controller - by processing your data we are able to provide the public task of health promotion and disease prevention under the Social Care Act 2012 OR
  • Article 6 (UK GDPR) – Processing is necessary for compliance with a legal obligation to which the controller is subject
  • Article 9 (GDPR) – Employment law obligation (Para 1(1)(a) of the UK DPA 2018) and public health purposes (Paras 2 or 3 UK DPA 2018)

The data referred to in this privacy notice is special category data, we will only process this data for as long as is necessary for the purpose identified in this privacy notice.

COVID positive test data – will be retained as identifiable data for 28 days post the end of your isolation period, unless this needs to be retained for longer as part of your personnel absence record.

Vaccine and exemption data will be retained for as long as is necessary for this purpose or for as long as the data is valid and in date. Government guidance is awaited on the length of validity for Vaccines, and related evidence. We will retain this data in line with this guidance and update this privacy notice to reflect this as soon as this guidance is available.

Will we share this data with third parties?

Your data may be shared with the following to confirm your vaccine status where it is necessary for offers of work, or to inform as guided by test and trace if you test positive for COVID 19:

  • Public Health England NHS Trusts
  • Clinical Commissioning Groups
  • Local Authorities/Social Service Departments
  • CQC Registered Care homes
  • Private Providers of health and social care
  • External Occupational Health Provider – Healthier Business