A search for information about Palantir and NHS data quickly produces a series of questions:
Does Palantir have access to your records?
Can you opt out?
Why is the NHS using Palantir?
And who actually controls the information?
Let's cover some of the biggest concerns surrounding the NHS Federated Data Platform (FDP).
1. Does Palantir have access to my NHS data?
Yes. Palantir Technologies UK is the technology supplier for the NHS Federated Data Platform. Under NHS arrangements, Palantir acts as a data processor, rather than the organisation deciding why NHS data is collected or how it is used.
NHS England says the NHS — rather than Palantir — remains in control of the data. Palantir can process personal data when necessary to operate and maintain the platform and must follow the instructions of the NHS organisation responsible for the particular data.
2. Why is the NHS using Palantir?
The Federated Data Platform is intended to connect information that is currently held in separate NHS systems.
The idea is that NHS staff can use the information to understand things such as:
- hospital waiting lists
- available beds
- staffing
- appointments
- operating-theatre capacity
- patient pathways
- hospital discharge
- availability of resources.
NHS England says the system is intended to help improve patient care and make the NHS operate more efficiently. The contract was awarded to a consortium led by Palantir following an open competitive procurement process in November 2023.
The potential contract value is £330 million over seven years, although NHS England describes the commitment as incremental rather than an automatic seven-year commitment.
3. Can Palantir sell or commercially exploit NHS data?
According to NHS England, no. The NHS says Palantir's contractual rights are limited to providing the Federated Data Platform services.
NHS England specifically states that Palantir cannot:
- commercialise or market NHS data, including anonymised NHS data
- use NHS data for its own purposes
- use NHS data to develop new supplier products
- train an AI model using NHS data.
That is an important distinction because "Palantir processes NHS data" and "Palantir owns NHS data" are not the same thing.
The NHS says it retains control of the information and that Palantir has no intellectual-property rights in NHS data under the contract.
4. Can I opt out of Palantir having my NHS data?
This is where the answer becomes considerably more complicated. There isn't simply a universal "Palantir opt-out" button.
The NHS has several different types of data use and several different opt-out mechanisms. Whether an opt-out applies depends on what information is being processed, where it came from and why it is being used.
For example, NHS England currently says that Type 1 opt-outs do not apply to the FDP's national instances, because those instances do not process confidential patient information originating from GP practices.
For local FDP products, GP information may be involved in some circumstances, but NHS England says it is currently used for individual care where the Type 1 opt-out does not apply.
5. What is a Type 1 opt-out?
A Type 1 opt-out is an older NHS choice that allows a patient in England to tell their GP practice not to share their confidential patient information for purposes beyond their individual care, such as certain planning, research or commissioning activities.
In simple terms:
Type 1 opt-out = "Don't allow my confidential information held in my GP record to be shared for certain secondary purposes."
There are some important limitations:
- It applies to information held in your GP record
- It generally concerns uses outside your direct care
- It does not mean that your NHS information can never be shared
Information can still be shared where there is a legal requirement or where it is necessary for your individual care.
It is different from the National Data Opt-Out, which applies to certain uses of confidential patient information across the health and care system. And this is particularly relevant to Palantir. This can be misleading if someone interprets that as a general "opt out of Palantir" form.
NHS England says Type 1 opt-outs don't apply to the national FDP, because those national instances don't process confidential patient information originating from GP practices.
So having a Type 1 opt-out doesn't necessarily prevent information about you from being processed through every NHS system or FDP product.
Likewise, the National Data Opt-Out does not automatically apply to every piece of information processed through the FDP.
Some FDP products use information for direct patient care, for example, and the National Data Opt-Out does not apply to such processing.
So the important question isn't simply:
"Can I opt out of Palantir?"
It is:
"What NHS data is being processed, for what purpose, and which legal and opt-out rules apply to that particular use?"
6. Does my NHS trust use Palantir?
It may. The FDP is designed to be used by NHS trusts and integrated care systems, but individual organisations decide which national and local FDP products they use.
NHS England says the programme provides funding for up to 240 NHS organisations. This means that asking whether "the NHS" uses Palantir can actually hide an important distinction.
There is a difference between:
NHS England's national FDP
and
an individual hospital trust or integrated care system using a local FDP product.
The data, purpose and applicable privacy arrangements can therefore differ.
7. Did Palantir get the NHS contract?
Yes. A consortium led by Palantir Technologies UK was awarded the Federated Data Platform and Associated Services contract in November 2023.
The consortium includes Palantir, Accenture, PwC, Carnall Farrar and NECS.
NHS England says the procurement was conducted through an open competitive process and that suppliers were assessed on areas including technical capability, information governance, security and commercial compliance.
The contract formally began in March 2024.
8. Who Else Is Behind the NHS Data Platform?
When people hear about the NHS Federated Data Platform (FDP), one company name tends to dominate the discussion: Palantir.
But Palantir isn't working alone.
When the NHS awarded the FDP and Associated Services contract in November 2023, it went to a consortium led by Palantir Technologies UK, with Accenture, PwC, Carnall Farrar and NECS. A separate contract for the platform's Privacy Enhancing Technology (PET) was awarded to IQVIA.
That raises a broader question:
Who are all these companies, what do they do, and does their involvement mean they can access NHS patient information?
The answer is more complicated than simply listing the companies.
Accenture — the global technology consultancy
Accenture is one of the world's largest technology and consulting companies. Accenture has extensive experience implementing large-scale technology systems for governments and healthcare organisations.
Being part of the contract consortium does not automatically mean that every consortium member has unrestricted access to NHS patient records.
NHS England says companies involved in the FDP cannot access health and care data without explicit NHS permission. Access is governed by contractual arrangements, data-processing agreements, security controls and the particular work being undertaken.
PwC — consultancy, auditing and data expertise
PwC (PricewaterhouseCoopers) is another major global professional-services company. PwC operates across areas including: consulting, technology, data analytics, risk, cybersecurity, financial and organisational transformation.
Its involvement illustrates something important about the FDP. This isn't simply a software purchase. The NHS is buying a combination of technology, implementation, engineering, consultancy and associated services.
Carnall Farrar — the healthcare specialist
Carnall Farrar is perhaps the least familiar name on the list. It is a UK healthcare consultancy specialising in areas including healthcare strategy, analytics, transformation and data.
Its healthcare focus makes its involvement particularly interesting. Unlike a company whose principal business is general technology consulting, Carnall Farrar is specifically focused on health and care systems.
The company was included in the Palantir-led consortium when the FDP contract was awarded. However, there is an important point for anyone investigating NHS data: being part of the consortium doesn't, by itself, establish that Carnall Farrar has access to an individual's NHS medical record.
The NHS's current privacy documentation identifies Palantir Technologies UK as the Data Platform contractor and IQVIA as the PET contractor. Other consortium members should therefore not automatically be assumed to have the same technical access as Palantir.
NECS — NHS-related technical expertise
NECS is another member of the consortium. NECS stands for North of England Commissioning Support Unit, an NHS organisation providing services including digital, analytical, commissioning and operational support.
Its inclusion gives the consortium something quite different from the commercial technology companies. It brings experience of working within the NHS itself.
IQVIA — the separate privacy technology company
IQVIA is particularly interesting because it isn't simply another member of the Palantir consortium. The NHS awarded IQVIA a separate contract for Privacy Enhancing Technology (PET).
The idea is to provide an additional layer between data and its eventual use.
According to NHS England, PET can:
- register data flows
- record what types of data are being used
- record the purposes for which data is being used
- help de-identify personal information
- provide transparency and audit capabilities
This separation was deliberate. The NHS says the platform contractor and PET contractor were deliberately made different suppliers so that treatment of data could be separated from storage of data.
So who actually gets the data?
This is probably the most important question. It would be misleading to imagine that the six organisations simply sit around a giant database containing everyone's NHS records.
The FDP is designed as a collection of separate instances, including national and local instances. NHS England says each organisation using an instance controls access to its own data.
Access is supposed to be:
role-based → purpose-based → limited → monitored → audited.
The platform also keeps audit logs showing access and activity. And there is another important safeguard: the FDP isn't intended to replace the NHS's primary clinical record systems.
The platform connects information from existing systems rather than becoming a single replacement medical-record database.
But there is an important grey area
This is where the story becomes more interesting. The NHS repeatedly says:
"The NHS remains in control of the data."
That is an important contractual and legal distinction. But control isn't the same thing as access. Someone can operate, maintain or support a system without owning the information inside it.
And NHS England's own documentation demonstrates that supplier personnel can, under certain circumstances, have access to personal information.
For example, NHS England currently says that three Palantir engineers provide 24/7 technical support for the National Data Integration Tenant and have administrative-level access, while a further 33 engineers from various suppliers had more limited, project-specific access as of 15 June 2026.
Those people are subject to restrictions, security requirements, monitoring and NHS instructions.
Nevertheless, it demonstrates an important point:
"The supplier doesn't own the data" doesn't mean "no supplier employee can ever see or process personal data."
Those are two very different statements.
What about commercial use?
This is another area where the official position is quite clear. NHS England says the FDP contract prevents Palantir from:
- commercialising NHS data
- marketing NHS data
- using NHS data for its own purposes
- using NHS data to develop new supplier products
- training AI models using NHS data.
The same restrictions and contractual controls apply to processors operating on behalf of NHS organisations.
So there is currently no evidence in the NHS's published documentation that these companies are simply free to take NHS patient data and commercially exploit it.
That claim would go considerably beyond the available evidence.
Then why are people concerned?
There are legitimate questions that remain even if the NHS's safeguards work exactly as described.
1. Concentration of technology
A major part of NHS data infrastructure is being provided by private companies.
2. Supplier dependency
Once a system becomes deeply embedded in an organisation as large as the NHS, replacing it could be difficult even when contractual exit provisions exist.
NHS England says the contract contains measures intended to reduce vendor lock-in, including data export, migration provisions and a maximum seven-year term.
3. Supplier access
Technical maintenance sometimes requires privileged access.
The public therefore needs to understand who can access what, under what circumstances and with what auditing.
4. Complexity
The system involves multiple organisations, multiple instances and different types of data.
That makes the simple question "Does Palantir have my data?" surprisingly difficult to answer with a single yes or no.
5. Changing technology
The FDP is not a static database. It is an evolving digital infrastructure that can support new products and applications over time.
That makes future governance just as important as today's rules.
The bigger picture
The NHS FDP isn't really a story about one company getting everyone's medical records. It's a story about the NHS building a new digital infrastructure involving:
NHS England → NHS trusts and ICBs → Palantir → Accenture → PwC → Carnall Farrar → NECS → IQVIA
with different organisations performing different roles.
And that's arguably the more interesting story.
The critical questions are:
Who controls the data?
Who can access it?
What information can they access?
For what purpose?
Who audits them?
What happens when the contract ends?
And can the public verify that the safeguards are actually working?
The NHS has published substantial information addressing these questions, including its privacy notices and contractual safeguards. But understanding the system requires looking beyond the headline "Palantir gets NHS data" narrative.
Should people be concerned?
There are two separate questions here.
What does the NHS say?
The NHS position is that:
- NHS organisations remain responsible for the data
- Palantir is a processor, not the owner of NHS data
- Access is controlled according to roles and purposes
- Palantir cannot commercially exploit NHS data
- NHS data processed through the FDP remains under NHS control
- Data processing is subject to UK data-protection law.
Why does controversy remain?
Because putting a private technology company at the centre of infrastructure capable of processing extremely sensitive health information inevitably raises questions about privacy, transparency, security, accountability and long-term dependency on a supplier.
Those concerns shouldn't automatically be interpreted as evidence that Palantir is secretly selling NHS records. There is currently no basis for making that claim from the NHS's published contractual information.
But equally, "Palantir cannot sell the data" does not mean there are no legitimate questions to ask.
For example:
- Which NHS organisations are using which FDP products?
- What categories of patient information are involved?
- Who can access particular datasets?
- What auditing takes place?
- How are future FDP products approved?
- What happens when the contract eventually ends?
- How easy would it actually be for the NHS to replace the technology?
- Which opt-outs apply to each individual use of data?
These are reasonable questions in a system involving some of the most sensitive information held about the public.
Interestingly, an NHS England public panel meeting in June 2026 specifically recorded Palantir as the biggest source of concern among panel members, alongside concerns about vendor lock-in, the historical procurement process and the clarity of opt-out information.
The debate isn't really as simple as "Palantir has your medical records" versus "Palantir has nothing to do with your medical records."
The reality is somewhere in between.
Palantir is a major technology supplier operating infrastructure that can process NHS information. But the NHS says it remains the data controller, while Palantir acts as a processor operating under NHS instructions.
The crucial issue for the public is therefore not simply who built the software, but what information is being processed, who can access it, what it can legally be used for, and what choices patients actually have.
Those details are much more revealing than a simple yes-or-no answer.
When private technology companies become part of public infrastructure, the important question isn't necessarily whether they "own" the data.
It's whether the public can clearly see who controls it, how it is used, and what safeguards exist when that control is exercised.
Read more on:
Pharmaceuticals in Britain's rivers
Nanoplastics: how they get into your body
Acrylamide: are gummies poisoning you?
Comments
Post a Comment