Privacy Notice (Easy Read)

What is this notice about?

This page will tell you how information about you is used when you use MyCare.scot.

This privacy notice will explain:

  • What information is used in MyCare.scot
  • How information is used
  • What organisations are involved
  • What your rights are

What is MyCare.scot?

MyCare.scot is an online service that helps you access your healthcare information. In future, you will also be able to access social care information as well. You can access MyCare.scot either using a web browser or by downloading the mobile app.

MyCare.scot is not a big storage area for all of your information. Instead, it speaks to other systems that already hold the information and only gets that information when you select that section in MyCare.scot.

For example, if you want to see your vaccinations the steps that happen are:

  • Sign in to MyCare.scot
  • You select the vaccinations section within MyCare.scot
  • MyCare.scot will speak to the system that holds your information and get a copy of the information that relates to you
  • MyCare.scot will then show you the information on screen
  • Once you’ve finished using MyCare.scot, that copy is securely deleted and not held in MyCare.scot long term

When a lot of people try and use MyCare.scot at the same time we may use a virtual waiting room which puts people in a queue before they get to MyCare.scot.

Who is responsible for your information and what organisations are involved?

MyCare.scot has been developed by Public Services Delivery Scotland (PSD Scotland) who work with the Scottish Government, Health Boards and the Convention of Scottish Local Authorities (COSLA).

Data Controllers are organisations that make decisions on how your information is used and sometimes they will instruct other organisations to act on their behalf, who are called Data Processors.

When your information is used in MyCare.scot, PSD Scotland are acting as a Data Processor. This includes support services that work in the background and also the National Contact Centre where people can phone if they have a problem. Your Health Board is the Data Controller for your healthcare information used in MyCare.scot.

In order to access MyCare.scot you must use a service called ScotAccount, which is run by the Scottish Government. ScotAccount allows people to use one account to access several public services and also has a secure mailbox these services can use to send messages securely. The Scottish Government are the Data Controller for ScotAccount and also for messages in the Digital Mailbox, however they are not able to see any of the content of the messages, meaning they can’t see any of your health and care information.

What information is used to sign up or sign in?

  • In order to use MyCare.scot you must verify your identity in ScotAccount if you haven’t done it already.
  • You need to agree to share your verified information from ScotAccount with MyCare.scot in order for us to find your healthcare information in our records.
  • Once we know who you are, then one of the services supporting MyCare.scot stores the unique identifying numbers that enables us to link your ScotAccount ID number with the number used to identify you in healthcare records, which is known as a CHI number (Community Health Index Number).
  • Your verified ScotAccount information is only used to find your CHI number and only your ScotAccount ID number is kept long term.
  • Once this is done, you’ll be able to sign in to MyCare.scot.

What information can you see in MyCare.scot?

The information you will be able to see in MyCare.scot is:

  • Demographic information – this means things like your CHI Number, Name, Date of Birth, Address and Health Board
  • Vaccinations – Information about flu and covid vaccinations you’ve had
  • Allergies and Medications – A list of allergies and medications as recorded by your GP
  • Appointments and Digital Communications – Currently only NHS Lanarkshire users who have dermatology hospital appointments can see this information in MyCare.scot. This will expand to more areas and services soon

We also collect some technical information about the device you use to access MyCare.scot such as IP address and device type to understand overall trends about how people are using MyCare.scot and also to help make sure things are working correctly.

Please read any explanation messages on the MyCare.scot pages carefully to understand the information being shown. As MyCare.scot is new and is still being developed, not all information is available to be shown at the moment, but each page you look at will explain any limits to the information available.

How long is your information kept?

MyCare.scot only holds information about you while you are using it.

The systems that hold the information long term will have their own rules for how long the data is kept. Their own privacy notices will have details of how long they keep it.

ScotAccount Privacy Notice

How is your information used lawfully?

Your Health Board is the Data Controller for your information used in MyCare.scot. Under the law they have a duty to provide health and care services (National Health Service (Scotland) Act 1978).

Organisations have to follow certain rules under data protection law, including highlighting the specific parts of the law that allows them to use personal information.

For using personal information about individuals, the relevant section is:

  • UK GDPR Article 6(1)(e) – an organisation acting in the public interest or that has specific powers to perform the tasks

Health information is more sensitive and has stricter rules around its use. The relevant sections of the law for using this information is:

  • UK GDPR Article 9(2)(h) – meaning the information is needed in order to provide health care or services
  • The Data Protection Act 2018 Schedule 1, Condition 2(2)(f) – the information is needed to manage health care or social care systems

Who is your information shared with?

Your information is only shared with organisations that need to see it in order to run the MyCare.scot service. When MyCare.scot requests information from other systems, it will share your CHI number or ScotAccount ID number, so the system knows what information to provide. For June 2026, those systems are managed by PSD Scotland or Scottish Government.

For users in NHS Lanarkshire, if you sign in to use MyCare.scot then some digital communications – such as appointment letters – will be sent to your Digital Mailbox. For June 2026, this is only for dermatology hospital appointments. More areas and services will be able to use this in future.

We share details about the device used to access MyCare.scot to the company who does statistics work for us. This is used to give overall themes of how people use MyCare.scot and is not used to track what each person does.

When people use the mobile app, we also share details about the device they use to companies who provide us services to make sure the app is working correctly and that the app and the device are both secure.

Is your information sent abroad?

MyCare.scot and the health systems that it deals with does not send healthcare information outside of the United Kingdom (UK) as part of this work.

Digital Mailbox uses companies who store data in the UK and areas in Europe where there are legal agreements to ensure your information is as safe as it is when in the UK (called the European Economic Area (EEA)). This is also the same for the website statistics work.

The IP address and details of the digital device you use to access MyCare.scot are also sent outside of the UK, but there are agreements and contracts in place to make sure they are handled securely.

How is your information kept safe?

MyCare.scot keeps your information safe by following the same rules and high standards that other healthcare systems use. All staff involved are trained and have to follow strict rules when dealing with information.

Your rights

Under data protection law, you have certain rights regarding your information. You can ask to see your data, correct it, ask for it to be deleted, limit how it’s used or complain. Not all these rights apply all the time. More information about your rights can be found on the Information Commissioner’s Office (ICO) website.

You can either contact the data protection officer for your Health Board or phone the National Contact Centre if you want to use any of these rights.

A list of contact details for Health Board data protection officers can be found on NHS Inform.

You can contact the National Contact Centre on 0800 030 8014, who will direct your query to your health board.

Your right to complain

You have the right to complain to an organisation if you think they have not handled your information properly. You should contact the data protection officer for your Health Board or phone the National Contact Centre on 0800 030 8014.

If you are still not happy you have the right to complain to the Information Commissioner’s Office (ICO): Make a complaint | ICO