55 million patients' GP records — mental health, sexual health, substance abuse, everything — planned for extraction into a database accessible to pharmaceutical companies and researchers. Opt-out only, and most people had never heard of it. The backlash delayed it three times. Your doctor's notes, available to companies, unless you specifically said no to a scheme you probably never knew existed. The NHS gave Palantir — the company that helped ICE track immigrants and built predictive policing systems — a £330 million contract to handle patient data for 55 million Britons. Fast-tracked, minimal public consultation. The company that helps deport people now holds the health records of an entire nation. Your GP notes, in the hands of a US intelligence contractor.
What they claim: NHS App privacy policy states health data is used to provide direct care and improve NHS services
What we found: NHS Digital planned to extract GP records for 55 million patients into a centralised database (GPDPR) accessible to researchers, pharmaceutical companies, and third parties. After public outcry and media coverage, the scheme was delayed repeatedly. Patients had to actively opt out or their entire medical history — including mental health, sexual health, and substance abuse records — would be shared.
What they claim: NHS App was promoted as a healthcare management tool for booking appointments and viewing records
What we found: During COVID-19, the NHS App was repurposed as a vaccine passport (COVID Pass) required for large events, nightclubs, and travel. The app transformed from a voluntary health tool into a mandatory access control system. Privacy campaigners warned this created infrastructure for a permanent digital ID system. The government denied this but the COVID Pass infrastructure remained operational after restrictions ended.
What they claim: NHS App states it follows strict data protection standards under UK GDPR
What we found: Privacy researchers found the NHS App integrated Adobe Analytics, which transmitted usage patterns — including which health services users browsed — to Adobe's servers. The NHS login system also used third-party identity verification (involving Experian credit data), meaning accessing your GP records required sharing data with a credit reference agency.
What they claim: NHS describes health data as protected under NHS data governance frameworks
What we found: NHS England awarded Palantir a £330 million contract to build the Federated Data Platform, giving the controversial US intelligence contractor access to NHS patient data at an unprecedented scale. openDemocracy revealed the contract was fast-tracked without adequate public consultation. Palantir's history includes work with US intelligence agencies, ICE immigration enforcement, and predictive policing.