The UK Department of Health (DoH) has released a redacted copy of its contract giving Amazon access to data on the NHS Direct website, following a Freedom of Information request from civil rights group Privacy International.
The Master Content License Agreement provides Amazon with "a non-exclusive, worldwide, perpetual, irrevocable and royalty-free license to use, distribute, reproduce, display, transmit, perform, excerpt, reformat, adapt or otherwise create derivative works" from the health advice platform.
Amazon was keen to hit back at suggestions the data went beyond what is already available on the NHS Direct website. The official line was: "General health-related content from the NHS website is now available to Alexa users via voice technology. The new option is particularly useful for those with accessibility needs who may not have been able to easily access nhs.uk content via a mobile device or computer in the past."
The spokeswoman also insisted: "Amazon does not build customer health profiles based on interactions with nhs.uk content or use such requests for marketing purposes."
An NHS spokesperson said: "No patient data is being provided to this company by the NHS, which takes data privacy extremely seriously and has put appropriate safeguards in place to ensure information is used correctly."
A spokesman for privacy campaigners medConfidential said: "Amazon are correct to say that the information they get from DoH/NHS is content from the NHS website, but it's what they can do with it and what they use all the information they collect as a result that is entirely open ended... As far as DoH is concerned, that's not DoH's problem."
Health secretary Matt Hancock has faced previous criticism that he plays fanboi for technology companies instead of ensuring value for money.
You can find the redacted contract here.
It also emerged this weekend that the UK's Clinical Practice Research Datalink (CPRD) made £10m selling patient records from GP surgeries to American and other medical companies last year.
A Commercial Multi-study Licence Fee from CPRD costs up to £330,000 while commercial dataset licence fees go for up to £60,000.
The CPRD is not covered by GDPR rules because the data it holds and sells is anonymised.
The chief executive of CPRD insisted to The Observer the organisation obeys all "ethical, information governance, legal and regulatory requirements" and has rigorous processes in place to ensure the data is truly anonymous.
It is up to individual patients to tell their GP if they do not want their medical records handed over and sold in this way.
Documents released last month revealed the pressure from US trade negotiators to get access to NHS data – described by Phil Booth of medConfidential as the health service's Crown Jewels and potentially the most valuable dataset on the planet. ®
Sponsored: Webcast: Ransomware has gone nuclear