Cinnamon Digital Applications Limited has been appointed by Oxford Health NHS Foundation Trust (the Customer) to support the delivery of the school age vaccination programme.

Cinnamon Digital Applications Limited acts as a Data Processor in relation to this agreement. All data collected and processed by Cinnamon is owned by the customer. All Subject Access Requests should be directed to the customer.

Data is processed for the purposes of providing the school age immunisation programme only. It is not used for any purpose.

All data processed resides in the UK only. No data is shared with any company or third-party organisation except NHS Digital for tracing against the NHS PDS (the Spine) to validate the Child NHS Number and the NHS Child Health Information System.

Data is retained for the duration of the programme unless specified by the customer. Typically, this is up to school leaving age. At which time all data is deleted from company servers and returned to the customer securely using approved data transfer protocols. No data is retained by Cinnamon.