Real-world effectiveness and safety of the Oxford/AstraZeneca covid-19 vaccine ***and investigation of the epidemiology of thrombotic thrombocytopenia and other adverse events of interest following COVID-19 vaccination*** in England: ORCHID linkage

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

The University of Oxford and AstraZeneca Limited UK requires access to NHS England data for the following purposes: ***PURPOSE PURPOSE 1***: The objective for processing the requested data is to support delivery of a real-world effectiveness study for COVID-19 vaccines in England. [4 paragraphs unchanged] Analysis for purpose 1 is complete, though further analysis may need to be completed for this purpose depending on the feedback received from regulators. PURPOSE 2: The objective for processing will also be to: *** PURPOSE 2: The objective for processing will also be to: [6 paragraphs unchanged] ***PURPOSE 3*** PURPOSE 3 [7 paragraphs unchanged] The requested datasets will be used to develop analysis code and algorithms for analyses in a smaller cohort to which they will be linked, prior to these analysis code (epidemiological models) and algorithms (ontological algorithms for case identification) being deployed in the national level data within the NHS England Trusted Research Environment (TRE) under data sharing agreement DARS-NIC-445543-W0D4N. The projects are now complete. The University of Oxford and AstraZeneca Limited UK would like to retain this Data to ensure reconstruction of the study analysis is possible if required. The requested datasets will feed as an extract into the Oxford-Royal College of General Practitioners Clinical Informatics Digital Hub’s (ORCHID) Trusted Research Environment (TRE). The University of Oxford team run the national primary care surveillance system – The Oxford-Royal College of General Practitioners Research and Surveillance Centre (RSC). This surveillance system is commissioned by UK Health Security Agency (UKHSA) and collaborates in reporting vaccine uptake and effectiveness, including of COVID-19 vaccine. ORCHID receives a refresh of GP data either daily or twice weekly and maintains a good level of data quality as a result. The team are also able to validate the analysis against the UKHSA data and other projects that include adverse events of interests associated to COVID-19 vaccines. Validation of the analyses would be beneficial to the team prior to commencing analyses within the NHS England TRE. Furthermore, the data within ORCHID is granular and the team have the ability to curate more variables in order to answer the research questions especially for adverse events of interests. No additional data will be requested from NHS England. *** It is important to note that this agreement also covers the use of data for other purposes that come under the UKHSA activities, subject to a valid data sharing agreement being in place. The data held under this agreement will not be used for any other purposes until this has been agreed and approved by NHS England under another data sharing agreement. Furthermore, the cohort held by NHS England under this agreement may be used in the future for studies that University of Oxford carry out. However, additions or deletions of patients following registration or de-registration with GP practices within the ORCHID network may apply to the cohort. All studies will be a subject to a separate data sharing agreement approved by NHS England and will be reviewed on a case-by-case basis.*** This Data Sharing Agreement (DSA) permits processing of the Data for the purpose of secure storage and back up. This DSA does not permit any further processing that involves analysis or linkage other than for the purpose of verifying findings in line with the original objectives of the study by repeating previous analyses described in this DSA. Following publication of the study findings, it is possible that the findings will be questioned or challenged by third parties through direct contact with AstraZeneca Limited UK or the University of Oxford, contact via the publishing journal or an open letter. In such circumstances, The University of Oxford and AstraZeneca Limited UK (also known as AstraZeneca Global) may repeat the previously analyses undertaken to verify that the published results were accurate and may write a response to be issued directly to the challenger or published. The University of Oxford and AstraZeneca Limited UK (also known as AstraZeneca Global) may not undertake different analyses to those undertaken during the original analysis. This DSA does not permit any onward sharing of the Data. This DSA permits the necessary processing of the Data for the purposes of permanently destroying, deleting or erasing the Data once it is no longer required for the purpose for which it was collected. Once destroyed/deleted or erased, The University of Oxford and AstraZeneca Limited UK (also known as AstraZeneca Global) must confirm destruction to NHS England. If any further data processing is required in addition to the above purposes or if the data needs to be moved to a different location/organisation [organisation] must submit an Amendment request to NHS England before Data is accessed. [1 paragraph unchanged] • Hospital Episode Statistics Admitted Patient Care • Civil Registrations of Death • Hospital Episode Statistics Critical Care • ***Hospital Episode Statistics Outpatients*** • ***Emergency Care Data Set*** • Civil Registration - Deaths (plus HES: Civil Registration (Deaths) bridge) [3 paragraphs unchanged] • COVID-19 Vaccination Adverse Reactions [1 paragraph unchanged] • ***COVID-19 Vaccination Adverse Reactions*** • Emergency Care Data Set • ***Secondary Uses Service Payment By Results Spells*** • Hospital Episode Statistics Admitted Patient Care • ***Secondary Uses Service Payment By Results Episodes*** • Hospital Episode Statistics Critical Care • Hospital Episode Statistics Outpatients • Secondary Uses Service Payment By Results Episodes • Secondary Uses Service Payment By Results Spells [9 paragraphs unchanged] DATA CONTROLLERS AND PROCESSORS [3 paragraphs unchanged] LEGAL BASIS [16 paragraphs unchanged]

Processing activities

Pseudonymised record-level data from the Civil Registrations of Death, HES CC, HES APC, HES OP, ECDS, COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2), COVID-19 Vaccination Adverse Reactions, Covid-19 UK Non-hospital Antibody Testing Results (Pillar 3), COVID-19 SGSS First Positives (Second Generation Surveillance System), COVID-19 Vaccination Status, and SUS is required to be linked to a cohort of approximately 25 million patients submitted to NHS England by the University of Oxford. No data will flow to NHS England for the purposes of this Data Sharing Agreement (DSA). METHODOLOGY The University of Oxford holds the relevant records from the Civil Registrations of Death, HES CC, HES APC, HES OP, ECDS, COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2), COVID-19 Vaccination Adverse Reactions, Covid-19 UK Non-hospital Antibody Testing Results (Pillar 3), COVID-19 SGSS First Positives (Second Generation Surveillance System), COVID-19 Vaccination Status, and SUS dataset. 1. Data are extracted from practices that are members of the Royal College of General Practitioners (RCGP RSC) Research and Surveillance Network by Wellbeing. The University of Oxford subcontracts with Wellbeing to do this as part its contractual responsibilities. The Data will contain no direct identifying data items but will contain a unique person ID which can be used to link the Data with other record level data already held by the recipient. 2. The University of Oxford will provide NHS England with a list of pseudonymised (hashed) NHS numbers for the cohort (estimated to be 25 million patients via Secure Electronic File Transfer Service (SEFT). Additions and deletions to this cohort will be submitted monthly. 3. NHS England data will link the relevant records from the HES, SUS, COVID-19, and deaths datasets to the cohort. 4. NHS England will remove identifiers and send pseudonymised linked data set files securely back to University of Oxford. [6 paragraphs unchanged] There is no onward sharing and or use of NHS England record-level data for other studies unless specified in the data sharing agreements with NHS England. No additional data will be disseminated by NHS England for the purposes of this DSA. This DSA permits processing of the Data for the purpose of secure storage and back up. This DSA does not permit any further processing that involves analysis or linkage other than for the purpose of verifying findings in line with the original objectives of the study by repeating previous analyses described in this DSA This DSA does not permit any onward sharing of the Data with the exception that the Data may be viewed for the purpose of an audit by a regulator such as the Medicines and Healthcare products Regulatory Agency (MHRA). [2 paragraphs unchanged] There is no onward sharing and or use of NHS Digital record-level data for other studies unless specified in the data sharing agreements with NHS Digital. [1 paragraph unchanged] This DSA is required for the following reasons: The raw datasets (and any associated datasets and syntax files) may need to be accessed for the purpose of audit; An audit may be required during the period of this DSA. This would involve a systematic and independent review of trial-related activities and documents, to determine whether data were recorded, analysed and accurately reported. Without all the raw datasets this cannot be done.

Expected output

[1 paragraph unchanged] The outputs will not contain NHS England Data and will only contain aggregated information with small numbers suppressed as appropriate in line with the relevant disclosure rules for the dataset from which the information was derived. [5 paragraphs unchanged] Research findings are aimed to be disseminated through peer review journals and scientific conferences. Results are aimed to be communicated transparently and to relevant audiences (researchers, clinicians, policy makers, general public) at interim and final analyses to ensure knowledge developed by the research can benefit the health system and the general public. The outputs will be communicated to relevant recipients through the following dissemination channels: Through peer review journals and scientific conferences. Results are aimed to be communicated transparently and to relevant audiences (researchers, clinicians, policy makers, general public) at interim and final analyses to ensure knowledge developed by the research can benefit the health system and the general public. [3 paragraphs unchanged]

Expected measurable benefits

[1 paragraph unchanged] ***Additionally, Additionally, a rare syndrome of thrombosis associated with low platelets has been reported [54 words unchanged] thrombotic thrombocytopenia or its relationship with prior COVID-19 infection or COVID-19 vaccination. This study will explore if there is a causal association of the syndrome with COVID-19 vaccination. The results will have an impact policies related vaccination.**** vaccination. The anticipated benefit expected from processing the data ***for for all three purposes*** purposes is to demonstrate the effectiveness of the COVID-19 vaccines and the UK [112 words unchanged] vaccine roll-out plan with regards to staggered age groups and vulnerable groups. [5 paragraphs unchanged]

Unchanged: Benefits reported.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Expected output

[8 paragraphs unchanged] ***Analysis of Purpose 1 has been completed. The regulatory report for Purpose 1 is due in Q1 2023. Analysis for Purpose 2 and 3 are due to be completed at the end of 2023*** Analysis for purpose 1 is complete. A study report was submitted to MHRA and European Medicines Agency (EMA) in March 2023. The study received a positive opinion from the Committee for Medicinal Products for Human Use (CHMP) in July 2023. *** The analysis for the vaccine effectiveness studies using the data extract provided into ORCHID is now complete. The study team are now in the process of writing the manuscript. The outputs of this analysis is currently being written up to submit to MHRA for regulatory purposes*** purposes. ORCHID manuscript activities are ongoing, and are expected to be completed in Q1 2024.

Unchanged: Objective for processing, Processing activities, Expected measurable benefits, Benefits reported.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Objective for processing

*** This amendment to the agreement (V1.3) will cover 3 study objectives:*** The University of Oxford requires access to NHS England data for the following purposes: [5 paragraphs unchanged] Analysis for purpose 1 is complete, though further analysis may need to be completed for this purpose depending on the feedback received from regulators. [14 paragraphs unchanged] These amendments have been made objectives are in response to new developments during the COVID pandemic, which include new variants of COVID-19, the introduction of booster vaccines in late 2021 and 2022 for groups most as risk of the disease, and currently administered to everyone 16 years and over who had the 2nd dose two doses of the COVID-19 vaccine at least 3 months ago, vaccine, and the increasing number of people being affected by long COVID. Finally, an economic analysis is urgently needed because little is known about the health-economic impact of the COVID-19 vaccination. At present, the primary interest of this study is of those aged 16 and above, as this was what the initial study was developed to do. However, given the current wide age range of recipients of vaccines the study team are keen to look at younger age ranges after the initial proposed analyses is completed. This will be undertaken at a later date and incur a further amendment to this agreement and update to ethical approvals.***** The requested datasets will be used to develop analysis code and algorithms for analyses in a smaller cohort to which they will be linked, prior to these analysis code (epidemiological models) and algorithms (ontological algorithms for case identification) being deployed in the national level data within the NHS England Trusted Research Environment (TRE) under data sharing agreement DARS-NIC-445543-W0D4N. The requested datasets will be used to develop analysis code and algorithms for analyses in a smaller cohort to which they will be linked, prior to these analysis code (epidemiological models) and algorithms (ontological algorithms for case identification) being deployed in the national level data within the NHS Digital Trusted Research Environment (TRE) under data sharing agreement DARS-NIC-445543-W0D4N. The requested datasets will feed as an extract into the Oxford-Royal College of General Practitioners Clinical Informatics Digital Hub’s (ORCHID) Trusted Research Environment (TRE). The University of Oxford team run the national primary care surveillance system – The Oxford-Royal College of General Practitioners Research and Surveillance Centre (RSC). This surveillance system is commissioned by UK Health Security Agency (UKHSA) and collaborates in reporting vaccine uptake and effectiveness, including of COVID-19 vaccine. ORCHID receives a refresh of GP data either daily or twice weekly and maintains a good level of data quality as a result. The team are also able to validate the analysis against the UKHSA data and other projects that include adverse events of interests associated to COVID-19 vaccines. Validation of the analyses would be beneficial to the team prior to commencing analyses within the NHS England TRE. Furthermore, the data within ORCHID is granular and the team have the ability to curate more variables in order to answer the research questions especially for adverse events of interests. The requested datasets will feed as an extract into the Oxford-Royal College of General Practitioners Clinical Informatics Digital Hub’s (ORCHID) Trusted Research Environment (TRE). The University of Oxford team run the national primary care surveillance system – The Oxford-Royal College of General Practitioners Research and Surveillance Centre (RSC). This surveillance system is sponsored by Public Health England (PHE) and collaborates in reporting vaccine uptake and effectiveness, including of COVID-19 vaccine. It obtains a refresh of data either daily or twice weekly and maintains a good level of data quality as a result. The team are also able to validate the analysis against the PHE data and other projects that include adverse events of interests associated to COVID-19 vaccines. Validation of the analyses would be beneficial to the team prior to commencing analyses within the NHS Digital TRE. Furthermore, the data within ORCHID is granular and the team have the ability to curate more variables in order to answer the research questions especially for adverse events of interests. *** It is important to note that this agreement also covers the use of data for other purposes that come under the UKHSA activities, subject to a valid data sharing agreement being in place. The data held under this agreement will not be used for any other purposes until this has been agreed and approved by NHS England under another data sharing agreement. Furthermore, the cohort held by NHS England under this agreement may be used in the future for studies that University of Oxford carry out. However, additions or deletions of patients following registration or de-registration with GP practices within the ORCHID network may apply to the cohort. All studies will be a subject to a separate data sharing agreement approved by NHS England and will be reviewed on a case-by-case basis.*** The following NHS England data will be accessed: • Hospital Episode Statistics Admitted Patient Care • Hospital Episode Statistics Critical Care • ***Hospital Episode Statistics Outpatients*** • ***Emergency Care Data Set*** • Civil Registration - Deaths (plus HES: Civil Registration (Deaths) bridge) • COVID-19 Second Generation Surveillance System • COVID-19 UK Non-hospital Antibody Testing Results (Pillar 3) • COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2) • COVID-19 Vaccination Status • ***COVID-19 Vaccination Adverse Reactions*** • ***Secondary Uses Service Payment By Results Spells*** • ***Secondary Uses Service Payment By Results Episodes*** All the above requested data sets will enable the assessment of hospitalisation, ICU admission, and death as the primary outcomes of the study. Analyses could include the association of the vaccine to hospitalisation. Moreover, the additional datasets requested will be required for the health economics analysis (included in purpose 3) to be carried out during the course of the project. The level of the data will be: • Pseudonymised The data will be minimised as follows: • Limited to data for a study cohort identified by the University of Oxford – approximately 25 million patients. • Maternity-related variable excluded • Psychiatry-related variable excluded • Limited to data between 2019/20 – latest available [1 paragraph unchanged] The requested datasets are as follows: Hospital Episode Statistics Admitted Patient Care Hospital Episode Statistics Critical Care ***Hospital Episode Statistics Outpatients*** ***Emergency Care Data Set*** Civil Registration - Deaths (plus HES: Civil Registration (Deaths) bridge) COVID-19 Second Generation Surveillance System COVID-19 UK Non-hospital Antibody Testing Results (Pillar 3) COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2) COVID-19 Vaccination Status ***COVID-19 Vaccination Adverse Reactions*** ***Secondary Uses Service Payment By Results Spells*** ***Secondary Uses Service Payment By Results Episodes*** All the above requested data sets will enable the assessment of hospitalisation, ICU admission, and death as the primary outcomes of the study. Analyses could include the association of the vaccine to hospitalisation. Moreover, the additional datasets requested will be required for the health economics analysis (included in purpose 3) to be carried out during the course of the project. Under the original version of the agreement, the data requested was 3 drops of pseudonymised recorded-level extracts from the above data sets for the period April 2019 through to most recent period available for each dataset (at time of each data drop) linked to a cohort of approximately 25 million patients submitted (on three occasions) to NHS Digital by the University of Oxford. One drop was upon the agreement being signed off, in October/ November 2021 and one in December 2021 / January 2022. *** Under this amendment (version 1), 5 further bi-monthly drops of data are requested of pseudonymised recorded-level extracts from the above data sets for the period April 2019 through to most recent period available for each dataset (at time of each data drop) linked to a cohort of approximately 25 million patients submitted (on three occasions) to NHS Digital by the University of Oxford. *** For the purpose of this study, although the study team are requesting data from individuals of all ages, the analyses will consider all individuals 16 years and over. The purpose of requesting data from individuals under 16 years of age is due to the ascertain household transmission and population levels of the disease. The data held by Oxford already incudes a household key which is pseudonymised and held with the cohort data. *** In order to be able to understand real-world vaccine effectiveness, five further extracts of the requested data is required. One as soon as the amendment (version 1) is active, one in February/March 2022, one in April/May 2022, one in June/July 2022, one in August/Sept 2022 and one in October/November 2022. This is so that detailed analyses around the effects of single and/or double doses can continue to be established. *** The study team's primary age of interest are people 16 years or older who are currently scheduled to receive the vaccine. Age for the purpose of this study is their age on 31st March 2021 - the index data selected in the UK by the Joint Committee for Vaccination and Immunisation (JCVI). However the study also wish to look at data for all ages reasons for this are detailed below: • Vaccination may occur before an individual’s 16th birthday. Additionally, the study team require baseline data and all the available medial history for vaccines, but also for to examine their comparability among comparison groups. The study team hence required their lifelong medical data. This may date from before their vaccination date. • Also, levels of community infection impacts of vaccine effectiveness. The study team need to have some indication of the extent to which vaccines have been exposed to community infection. • Vaccination age has been extended to children and young people age 12 to 15 years old with comorbidities, or for all children and young adults age 12 to 17 years old. Childhood vaccination is taking place internationally and is now authorised in Europe and the United States – generally from ages 12 to 17 years old. • Models of vaccine effectiveness need to include information about household size and population levels of disease. Larger households have a higher risk of infection and high levels of childhood infection in a locality are associated with a population-wide increased number of cases. This project minimises the data requested by: (i) Limiting it to the years requested. (ii) Excluding all maternity-related variables; (iii) Excluding all psychiatry-related variables. This project requires only record-level pseudonymised data and no data fields which NHS Digital's dataset Information Asset Owners deems to be identifiable. The analysis will follow patients across different NHS Digital products using solely the pseudonymised codes provided by NHS Digital for this purpose. [1 paragraph unchanged] The University of Oxford are Joint Data Controllers with and AstraZeneca Limited UK (also known as AstraZeneca Global). The Global) are joint data controllers as both organisations are jointly responsible for ensuring that the data will only be processed by University of Oxford and by Momentum Data. University of Oxford have subcontracted a part of for the analysis to Momentum Data who will be acting as data processors on the instructions from University of Oxford and AstraZeneca UK Limited. purpose described above. The Royal College of General Practitioners (RCGP) hold a contract with University [55 words unchanged] the means by which the data are processed for any research programmes. The RCGP are therefore will not a controller on this agreement. carry out any data controllership activities. The data will only be processed by University of Oxford and by Momentum Data. Momentum Data are a data processor for a part of the analysis acting under the instructions of University of Oxford and AstraZeneca UK Limited. Momentum Data’s role regards processing the data and aggregating/suppressing output data for the purpose of COVID-19 vaccine pharmacovigilance and quality improvement. [1 paragraph unchanged] The lawful basis for processing data under GDPR has been reviewed and been assessed as acceptable. The University of Oxford process data under Article 6(1)(e): "processing is necessary for the performance of a task in the public interest or in the exercise of official authority vested in the controller" as they are a Public Authority. The lawful basis for processing personal data under the UK GDPR is: AstraZeneca UK Limited process data under Article 6(1)(f): “Legitimate interests: the processing is necessary for your legitimate interests or the legitimate interests of a third party, unless there is a good reason to protect the individual’s personal data which overrides those legitimate interests. (This cannot apply if you are a public authority processing data to perform your official tasks.)” For University of Oxford: Additionally, the University of Oxford and AstraZeneca UK Limited process the Special Category Health Data under Article 9(2)(j): "processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject" as the data are required for research purposes in the public interest. The data are required for research purposes in the public interest - meeting the conditions in the DPA 2018 Schedule 1 Part 1 (4) - which GDPR Recital 52(2) determines is an appropriate derogation from the prohibition on processing special categories of personal data. In accordance with GDPR Article 89(1) processing is subject to appropriate safeguards. These include: Article 6(1)(e) - processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller; i. The data will be pseudonymised prior to dissemination by NHS Digital to the data recipient, For AstraZeneca: ii. The data recipient’s technical and organisational measures to safeguard the data have been assessed and meet NHS Digital’s acceptance criteria; Article 6(1)(f) - processing is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data, in particular where the data subject is a child. AstraZeneca has determined the processing is necessary for its legitimate interests in being able to provide evidence that helps to grow public confidence in vaccine effectiveness which is highly important to minimize vaccine hesitancy and increase uptake of vaccine to help bring an end to the COVID-19 pandemic. The lawful basis for processing special category data under the UK GDPR is: For University of Oxford and AstraZeneca: Article 9(2)(j) - processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject. The data are required for research purposes in the public interest - meeting the conditions in the DPA 2018 Schedule 1 Part 1 (4) - which GDPR Recital 52(2) determines is an appropriate derogation from the prohibition on processing special categories of personal data. In accordance with GDPR Article 89(1) processing is subject to appropriate safeguards. These include: i. The data will be pseudonymised prior to dissemination by NHS England to the data recipient, ii. The data recipient’s technical and organisational measures to safeguard the data have been assessed and meet NHS England’s acceptance criteria; [3 paragraphs unchanged] COMMERCIAL PURPOSE The funding is provided by AstraZeneca. AstraZeneca is a co-partner with the University of Oxford in the development, manufacture and supply of the Oxford AstraZeneca COVID-19 Vaccine. The primary focus will be on developing a further understanding of the efficacy and safety of the vaccines being administered globally. Results of the studies will improve the confidence of the vaccines and increase uptake of the vaccine.

Processing activities

Data requested will be five further drops of pseudonymised recorded-level extracts from the above data sets for the period April 2019 through to most recent period available for each dataset (at time of each data drop) linked to a cohort of approximately 25 million patients submitted (on five occasions) to NHS Digital by the University of Oxford. Pseudonymised record-level data from the Civil Registrations of Death, HES CC, HES APC, HES OP, ECDS, COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2), COVID-19 Vaccination Adverse Reactions, Covid-19 UK Non-hospital Antibody Testing Results (Pillar 3), COVID-19 SGSS First Positives (Second Generation Surveillance System), COVID-19 Vaccination Status, and SUS is required to be linked to a cohort of approximately 25 million patients submitted to NHS England by the University of Oxford. FREQUENCY - One as soon as the amendment (version 1) is active, one in April/May 2022, one in June/July 2022, one in August/Sept 2022 and one in October/November 2022. On receipt of each new data drop, once validated the old data must be securely destroyed and a certificate of destruction provided to NHS Digital in line with data destruction guidelines. [2 paragraphs unchanged] 2. The University of Oxford will provide NHS Digital England with a list of pseudonymised (hashed) NHS numbers for the cohort (estimated to be 25 million patients via Secure Electronic File Transfer Service (SEFT). Additions and deletions to this cohort will be submitted monthly. 3. NHS Digital England data will link the cohort relevant records from the HES, SUS, COVID-19, and deaths datasets to the requested datasets. cohort. 4. NHS Digital England will remove identifiers and send pseudonymised linked data set files securely back to University of Oxford via SEFT. Oxford. 5. University of Oxford will download and store the data on their secure network. No identifiable data items will be passed out of NHS England. 6. University of Oxford and Momentum Data will process the data and aggregate/suppress output data for the purpose of COVID-19 vaccine pharmacovigilance and quality improvement. Access is restricted to employees or agents of University of Oxford and Momentum Data. No identifiable data items will be passed out of NHS Digital. For University of Oxford employees, data will only be accessed by those who have authorisation to have access to the main database, on which the NHS England data is stored in addition to all the primary care data ORCHID holds. SALTING METHODLOGY: All personnel accessing the data have been appropriately trained in data protection and confidentiality. The University of Oxford will follow a salting method in a manner that all the data will be non-identifiable. Salting is a concept that typically pertains to password or data hashing. Essentially, it’ is a unique value that can be added to the end of a password or data to create a different hash value. In this case it's a unique value added to the NHS Number. This adds a layer of security to the hashing process. When salting, the additional value is referred to as a “salt.” The data will be linked to the ORCHID database. The developers create separate databases for individual projects within the main database (i.e., a restricted view), only including the required variables for the required time interval. The salting process is as follows: NHS England record-level data will not be linked to other datasets unless specified in this Data Sharing Agreement. 1. An encryption salt is held by a designated staff member of the University of Oxford Medical Science Division who is not a member of the ORCHID staff. There is no onward sharing and or use of NHS England record-level data for other studies unless specified in the data sharing agreements with NHS England. 2. When a data linkage is required, the encryption salt holder sends the encryption salt to the data provider (NHS Digital). There will be no requirement nor attempt to re-identify individuals from the data. 3. The data provider will hash personal identifiers (in the data requested by ORCHID) using a hashing algorithm. Analysts from the University of Oxford and Momentum Data will analyse the data for the purposes described above. 5. To make this key unique, an encryption salt is added at the end of the NHS number (e.g. NHS number= 12345678 ; SALT (held by someone other than ORCHID staff) = bob. So, hashing would take place using the hashing algorithm by 12345678bob = return pseudonymised data). There is no onward sharing and or use of NHS Digital record-level data for other studies unless specified in the data sharing agreements with NHS Digital. The data received from NHS Digital is processed by study team members who are substantive employees of the University of Oxford. Additionally, For the purpose of this study, given the tight turnaround and the urgency in providing these analyses in the interest of public health, University of Oxford have subcontracted a part of the analysis to Momentum data who will solely be acting as data processors on the instructions from University of Oxford and AstraZeneca (joint data controllers). Analysts from Momentum data will first have to complete the IG training in order to get access to the ORCHID secure environment. Although acting as data processors, all the analysis and processing will take place within the secure environment at University of Oxford. For COVID-19 Second Generation Surveillance System (SGSS), COVID-19 UK Non-hospital Antibody Testing Results (Pillar 3), COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2) and Vaccination data - As standard, all disseminations for this data set will adhere to the business rules agreed with NHS England and normal exclusion criteria. University of Oxford staff are mandated to complete information governance training. The team work from secure workstations or secure laptops with encrypted drives within the group’s secure network. Data will only be accessed by individuals within the University of Oxford who have authorisation. The authorisation process includes: (1) Contractual requirement to follow IG principles; (2) Using the email registered with Human Resources to complete IG training and to return the certificate; (3) Staff email is authorised by the IT department for one year to access the secure network and staff computers are configured to allow this; (4) At any point the project managers or Head can have access to the secure network turned off. There is special authorisation to have access to the main database. Only three developers and one senior project manager can access the main database. All computational work on the data can only be performed within this secure network, there is no ability to copy or move source data out of the service. End users are only able to access the necessary remote desktop resources they have been granted permission for, and this access is provided for the shortest period of time possible. End users must access the system using a Multi-Factor Authentication (MFA) service, without which access cannot be obtained. Access is available only to registered users, with access via the University VPN service or a separate OpenVPN service via separate username or certificate based authentication. No direct access to the remote desktops is possible without using the VPN connection. The developers create separate databases for individual projects only including the required variables, for the required time interval. The additional linkages will be added to the data that the University of Oxford already receives from the RCGP RSC network practices and PHE reference laboratories. This process for previous projects linking different sets of data, and the linkage has been successful, provided both parties use the same pseudonymisation algorithm (SHA-512). The steps below indicate the process that is followed in order to obtain data from NHS Digital. 1. The agreed study protocol includes the list of all the variables required for completing the analysis to satisfy the primary and secondary objectives of the study. 2. In parallel, the senior SQL database administrator prepares the cohort (including the pseudonymised NHS numbers) and uploads to the NHS Digital SEFT environment using a log-in details that is specifically provided to that individual by NHS Digital. 3. NHS Digital perform necessary checks, link the necessary datasets to the cohort and send back the cohort information/datasets via the SEFT system to the SQL administrator. 4. The administrator at University of Oxford then securely transfer the linked datasets within the ORCHID database which is then prepared by the SQL developers for further analysis. There is no onward sharing and or use of NHS Digital record-level data for other studies unless specified in the data sharing agreements with NHS Digital. There will be no requirement nor attempt to re-identify individuals from the data. Additionally, NHS Digital record-level data will not be linked to other datasets held by the Data Controllers or Data Processors unless specified in this Data Sharing Agreement. The data will not be made available to any third parties other than those specified except in the form of aggregated outputs with small numbers suppressed in line with the HES Analysis Guide. Record-level data is not permitted to be transferred outside of the UK. DISCLOSURE CONTROL RULES AND SMALL NUMBER SUPPRESSION For HES and Mortality data - In order to protect patient confidentiality, when presenting results calculated from HES record level data, outputs will contain only aggregate level data with small numbers suppressed in line with HES Analysis Guide. When publishing HES data, you must make sure that: · cell values from 1 to 7 are suppressed at a sub-national level to prevent possible identification of individuals from small counts within the table. · Zeros (0) do not need to be suppressed. · All other counts will be rounded to the nearest 5. Data will not be made available to any third parties other than those specified except in the form of aggregated outputs with small numbers suppressed in line with the HES Analysis Guide. For COVID-19 Second Generation Surveillance System (SGSS), COVID-19 UK Non-hospital Antibody Testing Results (Pillar 3), COVID-19 UK Non-hospital Antigen Testing Results (Pillar 2) and Vaccination data - As standard, all disseminations for this data set will adhere to the following business rules, as agreed with the NHS Digital, on top of normal exclusion criteria: 1. Always filter the extract to be England only. This should be applied using the subjects home postcode, or country (if derived from subjects home postcode)** 2. Exclude any record that includes Organisation type = PRI – Prison will be excluded [Cant be applied to sgss] 3. Exclude any record that includes “justice” in the email address (emailaddress and/or MPSemailaddress) 4. Exclude any record that has “mpsgpcode” or “gpcode” = “A91” [Military GP code] [Cant be applied to sgss] 5. Exclude any record that has a British armed forces postcode, these start with BF (postcode and/or MPSpostcode] 6. Exclude contact details (P2_Landline / LandlineNumber, P2_mobile / MobileNumber and/or MPSMobileNumber, P2_email / EmailAddress and/or MPSEmailAddress) where the following criteria apply: a. TestCentreID = “CHO” or “PRI” OR OrganisationType = “CHO” or “PRI” AND OrganisationRole = “resident” [Cant be applied to sgss] Or b. care_home = xxxxx [Cant be applied to npex] 7. ODS location code - Filter out the following site codes: 'XUL', 'XXA', 'XBN', 'XYL', 'YIM', 'XPJ' ; Exclude the following test centre postcodes - 'G84 8HL', 'PO1 3NH', 'GL7 5RD' [Cant be applied to npex]

Expected output

Algorithms for creation of required variables and outcomes for the study protocol [21 words unchanged] used to facilitate analysis of the full national dataset in the NHS Digital England Trusted Research Environment (TRE) under data sharing agreement DARS-NIC-445543-W0D4N. [6 paragraphs unchanged] Reporting of results will be done in a transparent manner and analytical [15 words unchanged] analytical methods used. No unnecessary suppression of results in reporting would be applied applied. All outputs from this research will be published (not just positive outcomes [17 words unchanged] given equal prominence and widespread dissemination, given the other vaccines being studied. ***Analysis Target date: First quarter of 2022 - the study team are planning to disseminate findings immediately after conducting the analysis, Therefore, the analysis target date will be dependent on the date data is supplied by NHS Digital. *** ***Analysis of Purpose 1 has been completed. The regulatory report for Purpose 1 is due in Q1 2023. Analysis for Purpose 2 and 3 are due to be completed at the end of 2023*** *** The analysis for the vaccine effectiveness studies using the data extract provided into ORCHID is now complete. The study team are now in the process of writing the manuscript. The outputs of this analysis is currently being written up to submit to MHRA for regulatory purposes***

Benefits reported

They study has only received NHS Digital data up to 30th September (received on 14th of November). Whilst this period is important because it includes the time when the COVID-19 Delta variant was circulating as well as the first stage of vaccinations beginning, there is no overall Yielded Benefit at this stage in the data analysis. The analysis related to vaccine effectiveness is complete. The study has determined the effectiveness of the AstraZeneca and the Pfizer COVID-19 vaccines in the general population as well as within higher risk groups such as individuals with high eFI, immunocompromised groups, effectiveness of the two vaccines in individuals with prior COVID infections against our outcomes of hospitalisation, ICU admission and death. All the secondary care data used for this analyses was obtained from NHS England under this agreement. A manuscript is currently being prepared, highlighting this. Vaccine effectiveness within the sentinel network has been determined, as well as within the national population. The results clearly showed the protection of COVID related hospitalisation, ICU admissions and mortality when individuals are vaccinated with one or two doses of the AstraZeneca and Pfizer COVID-19 vaccine. Vaccine effectiveness in individuals with two different doses of the two vaccines has also investigated, i.e., dose 1 (AZ) dose 2 (Pfizer), as well as the effectiveness of the booster dose (third dose) COVID -19 vaccine. These results reinforce the benefits of vaccination to the public.

Unchanged: Expected measurable benefits.

Text removed is struck through; text added is underlined. Unchanged paragraphs are summarised rather than repeated.

Datasets: + COVID-19 Vaccination Adverse Reactions; + Emergency Care Data Set (ECDS); + HES-ID to MPS-ID HES Critical Care; + HES:Civil Registration (Deaths) bridge; + Hospital Episode Statistics Outpatients (HES OP); + Secondary Uses Service Payment By Results Episodes; + Secondary Uses Service Payment By Results Spells

Objective for processing

The objective for processing the requested data is to support delivery of a real-world effectiveness study for COVID-19 vaccines in England. The primary objective of this study is the assess the real world effectiveness of the Oxford/AstraZeneca COVID-19 vaccine among people who receive one dose of the vaccine, overall and by age group and time period after 1 dose. The secondary objective of the study would be to: a) assess the vaccine effectiveness in people who have received the two doses; the timing after the 1st and 2nd dose , interval between the two doses and comorbidity status b) replicate the above analyses in people receiving the Pfizer COVID-19 vaccine as opposed to the Oxford/AstraZeneca vaccine. *** This amendment to the agreement (V1.3) will cover 3 study objectives:*** ***PURPOSE 1***: The objective for processing the requested data is to support delivery of a real-world effectiveness study for COVID-19 vaccines in England. The primary objective of this study is to assess the real world effectiveness of the Oxford/AstraZeneca COVID-19 vaccine among people who receive one dose of the vaccine, overall and by age group and time period after 1 dose. The secondary objective of the study would be to: a) assess the vaccine effectiveness in people who have received the two doses; the timing after the 1st and 2nd dose , interval between the two doses and comorbidity status b) replicate the above analyses in people receiving the Pfizer COVID-19 vaccine as opposed to the Oxford/AstraZeneca vaccine. *** PURPOSE 2: The objective for processing will also be to: 1) Estimate occurrence of thrombotic thrombocytopenia, thromboembolism, and thrombocytopenia (definitions including sub-setting for specific diagnostic units described in the Case definitions section), overall and split by age, sex and known risk factors. 2) Estimate occurrence of thrombotic thrombocytopenia, thromboembolism, and thrombocytopenia within a pre-defined time interval of receiving ChAdOx1 COVID 19 vaccination overall and split by age, sex and known risk factors. 3) Estimate occurrence of thrombotic thrombocytopenia, thromboembolism, and thrombocytopenia within a pre-defined time interval of receiving Pfizer-BioNTech COVID 19 vaccination overall and split by age, sex and known risk factors. 4) Describe demographic characteristics and medical history of patients with thrombotic thrombocytopenia, thromboembolism, and thrombocytopenia. 5) Evaluate associations of thrombotic thrombocytopenia and pre-defined risk factors. 6) Conduct exploratory assessment of case definitions and disease aetiology using artificial intelligence (AI)-based approaches. **** ***PURPOSE 3*** The additional analyses in light of the rapidly changing nature of the COVID-19 pandemic. Five key adjustments are proposed: 1) To perform an analysis of vaccine effectiveness on different COVID-19 variants. This data will be acquired through the COVID-19 Genomics UK Consortium (COG-UK). 2) To describe groups at most risk of COVID-19, either due to suboptimal vaccine response or ineligibility for vaccination. People who are immunocompromised are the primary population of interest. 3) To conduct an analysis of health care resource utilisation and health care costs for the whole population and for risk groups identified as having a suboptimal vaccine response. 4) To report the vaccine effectiveness of booster doses (3rd dose) of COVID-19 vaccine (these analyses may include other MHRA-approved vaccines other than Pfizer-BioNTech and ChAdOx1). 5) To estimate the impact of vaccination on long COVID (defined as new or ongoing symptoms 4 weeks or more after the start of acute COVID-19 and including initial COVID-19 disease severity). These amendments have been made in response to new developments during the COVID pandemic, which include new variants of COVID-19, the introduction of booster vaccines in late 2021 for groups most as risk of the disease, and currently administered to everyone 16 years and over who had the 2nd dose of the COVID-19 vaccine at least 3 months ago, and the increasing number of people being affected by long COVID. Finally, an economic analysis is urgently needed because little is known about the health-economic impact of the COVID-19 vaccination. At present, the primary interest of this study is of those aged 16 and above, as this was what the initial study was developed to do. However, given the current wide age range of recipients of vaccines the study team are keen to look at younger age ranges after the initial proposed analyses is completed. This will be undertaken at a later date and incur a further amendment to this agreement and update to ethical approvals.***** [6 paragraphs unchanged] Civil Registration - Deaths ***Hospital Episode Statistics Outpatients*** ***Emergency Care Data Set*** Civil Registration - Deaths (plus HES: Civil Registration (Deaths) bridge) [4 paragraphs unchanged] All the above requested data sets will enable the assessment of hospitalisation, ICU admission, and death as the primary outcomes of the study. Analyses could include the association of the vaccine to hospitalisation. ***COVID-19 Vaccination Adverse Reactions*** Data requested will be three drops of pseudonymised recorded-level extracts from the above data sets for the period April 2019 through to most recent period available for each dataset (at time of each data drop) linked to a cohort of approximately 25 million patients submitted (on three occasions) to NHS Digital by the University of Oxford. ***Secondary Uses Service Payment By Results Spells*** ***Secondary Uses Service Payment By Results Episodes*** All the above requested data sets will enable the assessment of hospitalisation, ICU admission, and death as the primary outcomes of the study. Analyses could include the association of the vaccine to hospitalisation. Moreover, the additional datasets requested will be required for the health economics analysis (included in purpose 3) to be carried out during the course of the project. Under the original version of the agreement, the data requested was 3 drops of pseudonymised recorded-level extracts from the above data sets for the period April 2019 through to most recent period available for each dataset (at time of each data drop) linked to a cohort of approximately 25 million patients submitted (on three occasions) to NHS Digital by the University of Oxford. One drop was upon the agreement being signed off, in October/ November 2021 and one in December 2021 / January 2022. *** Under this amendment (version 1), 5 further bi-monthly drops of data are requested of pseudonymised recorded-level extracts from the above data sets for the period April 2019 through to most recent period available for each dataset (at time of each data drop) linked to a cohort of approximately 25 million patients submitted (on three occasions) to NHS Digital by the University of Oxford. *** [1 paragraph unchanged] *** In order to be able to understand real-world vaccine effectiveness, three five further extracts of the requested data is required. One as soon as the agreement amendment (version 1) is active, one in October/ November 2021 February/March 2022, one in April/May 2022, one in June/July 2022, one in August/Sept 2022 and one in December 2021 / January October/November 2022. This is so that detailed analyses around the effects of single and/or double doses can continue to be established. *** [5 paragraphs unchanged] This project minimises the data requested by: (i) Limiting it to the years requested. (ii) Excluding all maternity-related variables; (iii) Excluding all psychiatry-related variables. This project requires only record-level pseudonymised data and no data fields which NHS Digital's dataset Information Asset Owners deems to be identifiable. The analysis will follow patients across different NHS Digital products using solely the pseudonymised codes provided by NHS Digital for this purpose. [6 paragraphs unchanged] Additionally, the University of Oxford and AstraZeneca UK Limited process the Special [72 words unchanged] as the data are required for research purposes in the public interest. The data are required for research purposes in the public interest - meeting the conditions in the DPA 2018 Schedule 1 Part 1 (4) - which GDPR Recital 52(2) determines is an appropriate derogation from the prohibition on processing special categories of personal data. In accordance with GDPR Article 89(1) processing is subject to appropriate safeguards. These include: i. The data will be pseudonymised prior to dissemination by NHS Digital to the data recipient, ii. The data recipient’s technical and organisational measures to safeguard the data have been assessed and meet NHS Digital’s acceptance criteria; iii. The requested data has been assessed as proportionate to the aim pursued; iv. Controls, data retention and processing activities have been assessed to ensure respect to the essence of the right to data protection; v. Measures to protect the rights and freedoms of data subjects have been assessed including transparency (fair processing) publishing subject’s rights to withdraw consent and/or have their data erased or rectified, etc. [2 paragraphs unchanged] The studies are not conducted with the intention of generating profit. The primary focus will be on developing a further understanding of the [14 words unchanged] improve the confidence of the vaccines and increase uptake of the vaccine.

Processing activities

Data requested will be three five further drops of pseudonymised recorded-level extracts from the above data sets for the [17 words unchanged] drop) linked to a cohort of approximately 25 million patients submitted (on three five occasions) to NHS Digital by the University of Oxford. FREQUENCY - One drop of data as soon as the agreement amendment (version 1) is active, one in October/ November 2021 April/May 2022, one in June/July 2022, one in August/Sept 2022 and one in December 2021 / January October/November 2022. On receipt of each new data drop, once validated the old [8 words unchanged] of destruction provided to NHS Digital in line with data destruction guidelines. [29 paragraphs unchanged] There is no onward sharing and linking or use of the NHS Digital record-level data for other studies unless specified in the data sharing agreements with NHS Digital. There will be no requirement nor attempt to re-identify individuals from the data. Additionally, NHS Digital record-level data will not be linked to other datasets held by the Data Controllers or Data Processors unless specified in this Data Sharing Agreement. Additionally, there will be no requirement nor attempt to re-identify individuals from the data. [3 paragraphs unchanged] · cell values from 1 to 7 are suppressed at a local sub-national level to prevent possible identification of individuals from small counts within the table. [14 paragraphs unchanged]

Expected output

[8 paragraphs unchanged] Analysis ***Analysis Target date: Summer 2021 First quarter of 2022 - the study team are planning to disseminate findings immediately after conducting [7 words unchanged] will be dependent on the date data is supplied by NHS Digital. ***

Expected measurable benefits

[1 paragraph unchanged] The anticipated benefit expected from processing the data is to demonstrate the effectiveness of the COVID-19 vaccines and the UK vaccine roll-out in the adult population in England. Understanding of this effectiveness is greatly hoped to benefit citizens, healthcare professionals (HCPs), government and policy makers, vaccine manufacturers and researchers. AstraZeneca and University of Oxford specifically would get confirmation of the effectiveness of the Oxford-AstraZeneca vaccine which they hope will grow confidence in the product and support strategic decision-making in the future. Citizens and HCPs are hoped to benefit from evidence that will grow confidence in the vaccines, supporting vaccine uptake, and identifying sub groups of patients in whom the vaccines show greatest effect. Government and Policy makers are hoped to gain benefit from the evidence which will demonstrate the effectiveness of the vaccine roll-out plan with regards to staggered age groups and vulnerable groups. ***Additionally, a rare syndrome of thrombosis associated with low platelets has been reported in a few cases of recent exposure to COVID-19 vaccine. No causal association with COVID-19 vaccination has yet been established. This syndrome seems to be affecting patients of all ages and both sexes; at present there is no clear signal of risk factors. However, there is little data regarding occurrence and risk factors of thrombotic thrombocytopenia or its relationship with prior COVID-19 infection or COVID-19 vaccination. This study will explore if there is a causal association of the syndrome with COVID-19 vaccination. The results will have an impact policies related vaccination.**** The anticipated benefit expected from processing the data ***for all three purposes*** is to demonstrate the effectiveness of the COVID-19 vaccines and the UK vaccine roll-out in the adult population in England. Understanding of this effectiveness is greatly hoped to benefit citizens, healthcare professionals (HCPs), government and policy makers, vaccine manufacturers and researchers. AstraZeneca and University of Oxford specifically would get confirmation of the effectiveness of the Oxford-AstraZeneca vaccine which they hope will grow confidence in the product and support strategic decision-making in the future. Citizens and HCPs are hoped to benefit from evidence that will grow confidence in the vaccines, supporting vaccine uptake, and identifying sub groups of patients in whom the vaccines show greatest effect. Government and Policy makers are hoped to gain benefit from the evidence which will demonstrate the effectiveness of the vaccine roll-out plan with regards to staggered age groups and vulnerable groups. [5 paragraphs unchanged]

Benefits reported

Yielded Benefits is not a requirement for new applications. They study has only received NHS Digital data up to 30th September (received on 14th of November). Whilst this period is important because it includes the time when the COVID-19 Delta variant was circulating as well as the first stage of vaccinations beginning, there is no overall Yielded Benefit at this stage in the data analysis.