IMPPP NHS Digital Privacy Notice
Purpose of this privacy notice
This privacy notice aims to give you information on how the research team will collect and process data related to the use of hospital services by participants of the IMPPP trial
Controller
The sole data controller for this project is the University of Bristol, Beacon House, Queens Road, Bristol, BS8 1QU. As the ‘data controller’ for this project, the University of Bristol determines the purposes and means of processing personal data. The University Charter gives researchers the power to make provision for research and for the enhancement and dissemination of knowledge.
Universities in the UK have a duty to ensure that it is in the public interest to collect and use person details from people who have agreed to take part in research. The University of Bristol will only use data collected as needed to conduct the study analysis.
Dr Rupert Payne is the data controller’s representative for this project. Dr Payne can be contacted via email; r.payne@bristol.ac.uk or via telephone 0117 331 4545. The University of Bristol has a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. You can contact our Data Protection Officer at the University of Bristol on data-protection@bristol.ac.uk
The data we collect about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
The IMPPP research team may collect, use and store the following personal data for from study participants: date of birth, NHS number, postcode and gender.
Purposes for which we will use your personal data
The processing of this personal data is for the purposes of the IMPPP study; a clinical trial which aims to evaluate the clinical and cost effectiveness of a new approach for Improving the use of Medicines in People with Polypharmacy attending Primary care (IMPPP) compared with usual care.
We have set out below a description of all the ways the research team plan to use personal data, and the legal bases we rely on to do so.
|
Type of data being collected |
Specific purpose/activity |
Lawful basis for processing |
|
Date of birth NHS number Postcode Gender |
Identifying information is required to enable NHS Digital to establish linkage with Hospital Episodes Statistics (HES) identification codes and data relating to hospital usage by IMPPP study participants. Anonymised data for a period of 18 months to include the 6-month period prior to provision of consent up until the point of completion of the final study questionnaire will be collected from NHS Digital. Data will be processed by the University of Bristol. |
Article 6 (1) (e) necessary for the performance of a task carried out in the public interest Article 9 (2) (i) necessary for reasons of public interest in the area of public health Article 9 (2) (j) necessary for reasons of public interest in the area of scientific research |
The research team have a contract with NHS Digital which enables collection of data from the hospital records of IMPPP study participants. Explicit consent will be sought from IMPPP study participants for sharing of personal data with NHS Digital. Sharing of personal data with NHS Digital is necessary to enable data linkage with the Hospital Episodes Statistics dataset and collection of data from hospital records. The researchers will provide NHS Digital with the participants unique study identification code alongside the following personal data; date of birth, NHS number, postcode and gender. The dataset that NHS Digital return to the research team will be pseudonymised. This means that personal information to include date of birth, NHS number, postcode and gender will be removed. The released data set will contain the participants unique study identification code alongside hospital usage data.
The unique study identification code will be used by the studies analytic team to enable linkage of released data to other study data held at the University of Bristol for the purposes of data analysis. Linkage of the data released by NHS Digital with the study data held at the University of Bristol is necessary to ensure that the participants data is analysed within the study group (e.g. intervention or control group) to which they have been randomly assigned.
Disclosures of IMPPP study participant personal data
Personal data will only be shared with NHS Digital. The researchers will not share personal data with any third-party countries or international organisations.
Data security
The researchers have put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, access to personal data is limited to members of the research team who are involved in data analysis. Procedures are in place to deal with any suspected personal data breach. IMPPP study participants and any applicable regulator will be notified should a breach arise.
Data retention
The research team will only retain IMPPP study participant personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. All personal information collected from IMPPP study participants will be removed from the study records so that identification is not possible. Personal data will be securely destroyed within 3 months of study completion.
Your legal rights
To safeguard your rights, the researchers will use the minimum personal data possible. The GDPR provides data subjects with a number of rights in relation to their personal data. These include:
- Right to withdraw consent: where the lawful basis relied upon by the University is the data subject’s consent, the right to withdraw such consent at any time without having to explain why
- Right to be informed: the right to be provided with certain information about how we collect and process the data subject’s personal data
- Right to complain: the right to make a complaint to the Information Commissioner’s Office (ICO) or another appropriate supervisory authority.
If you wish to withdraw consent, please contact the research team via email at imppp-study@bristol.ac.uk.
To make a complaint about how researchers at the University of Bristol have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. You can contact our Data Protection Officer at the University of Bristol via email at; data-protection@bristol.ac.uk or you can complain to the Information Commissioner’s Office via telephone on 0303 123 1113. Please see www.ico.org.uk for further information about making a complaint.
Research exemption
Since this research meets the exemption conditions contained within the GDPR and DPA 2018, the right of individuals to access their personal data and the rights of individuals to rectification, erasure, restriction and objection do not apply. This is because researchers need to manage information in specific ways for the research to be reliable and accurate.
Source of personal data
Personal data will be obtained from the participant contact details form which IMPPP study participants complete and return to the research team alongside the completed study consent form.
Study participants are not required under a statute or contract to provide personal data and are free to withdraw from the study at any point.
Study participants are not required under a statute or contract to provide personal data and are free to withdraw from the study at any point.
Please note that we do not make use of automated decision making in relation to personal data.
Purpose of this privacy notice
This privacy notice aims to give you information on how the research team will collect and process data related to the use of hospital services by participants of the IMPPP trial
Controller
The sole data controller for this project is the University of Bristol, Beacon House, Queens Road, Bristol, BS8 1QU. As the ‘data controller’ for this project, the University of Bristol determines the purposes and means of processing personal data. The University Charter gives researchers the power to make provision for research and for the enhancement and dissemination of knowledge.
Universities in the UK have a duty to ensure that it is in the public interest to collect and use person details from people who have agreed to take part in research. The University of Bristol will only use data collected as needed to conduct the study analysis.
Dr Rupert Payne is the data controller’s representative for this project. Dr Payne can be contacted via email; r.payne@bristol.ac.uk or via telephone 0117 331 4545. The University of Bristol has a data protection officer (DPO) who is responsible for overseeing questions in relation to this privacy notice. You can contact our Data Protection Officer at the University of Bristol on data-protection@bristol.ac.uk
The data we collect about you
Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data).
The IMPPP research team may collect, use and store the following personal data for from study participants: date of birth, NHS number, postcode and gender.
Purposes for which we will use your personal data
The processing of this personal data is for the purposes of the IMPPP study; a clinical trial which aims to evaluate the clinical and cost effectiveness of a new approach for Improving the use of Medicines in People with Polypharmacy attending Primary care (IMPPP) compared with usual care.
We have set out below a description of all the ways the research team plan to use personal data, and the legal bases we rely on to do so.
|
Type of data being collected |
Specific purpose/activity |
Lawful basis for processing |
|
Date of birth NHS number Postcode Gender |
Identifying information is required to enable NHS Digital to establish linkage with Hospital Episodes Statistics (HES) identification codes and data relating to hospital usage by IMPPP study participants. Anonymised data for a period of 18 months to include the 6-month period prior to provision of consent up until the point of completion of the final study questionnaire will be collected from NHS Digital. Data will be processed by the University of Bristol. |
Article 6 (1) (e) necessary for the performance of a task carried out in the public interest Article 9 (2) (i) necessary for reasons of public interest in the area of public health Article 9 (2) (j) necessary for reasons of public interest in the area of scientific research |
The research team have a contract with NHS Digital which enables collection of data from the hospital records of IMPPP study participants. Explicit consent will be sought from IMPPP study participants for sharing of personal data with NHS Digital. Sharing of personal data with NHS Digital is necessary to enable data linkage with the Hospital Episodes Statistics dataset and collection of data from hospital records. The researchers will provide NHS Digital with the participants unique study identification code alongside the following personal data; date of birth, NHS number, postcode and gender. The dataset that NHS Digital return to the research team will be pseudonymised. This means that personal information to include date of birth, NHS number, postcode and gender will be removed. The released data set will contain the participants unique study identification code alongside hospital usage data.
The unique study identification code will be used by the studies analytic team to enable linkage of released data to other study data held at the University of Bristol for the purposes of data analysis. Linkage of the data released by NHS Digital with the study data held at the University of Bristol is necessary to ensure that the participants data is analysed within the study group (e.g. intervention or control group) to which they have been randomly assigned.
Disclosures of IMPPP study participant personal data
Personal data will only be shared with NHS Digital. The researchers will not share personal data with any third-party countries or international organisations.
Data security
The researchers have put in place appropriate security measures to prevent personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. In addition, access to personal data is limited to members of the research team who are involved in data analysis. Procedures are in place to deal with any suspected personal data breach. IMPPP study participants and any applicable regulator will be notified should a breach arise.
Data retention
The research team will only retain IMPPP study participant personal data for as long as necessary to fulfil the purposes for which it was collected, including for the purposes of satisfying any legal, accounting, or reporting requirements. All personal information collected from IMPPP study participants will be removed from the study records so that identification is not possible. Personal data will be securely destroyed within 3 months of study completion.
Your legal rights
To safeguard your rights, the researchers will use the minimum personal data possible. The GDPR provides data subjects with a number of rights in relation to their personal data. These include:
- Right to withdraw consent: where the lawful basis relied upon by the University is the data subject’s consent, the right to withdraw such consent at any time without having to explain why
- Right to be informed: the right to be provided with certain information about how we collect and process the data subject’s personal data
- Right to complain: the right to make a complaint to the Information Commissioner’s Office (ICO) or another appropriate supervisory authority.
If you wish to withdraw consent, please contact the research team via email at imppp-study@bristol.ac.uk.
To make a complaint about how researchers at the University of Bristol have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. You can contact our Data Protection Officer at the University of Bristol via email at; data-protection@bristol.ac.uk or you can complain to the Information Commissioner’s Office via telephone on 0303 123 1113. Please see www.ico.org.uk for further information about making a complaint.
Research exemption
Since this research meets the exemption conditions contained within the GDPR and DPA 2018, the right of individuals to access their personal data and the rights of individuals to rectification, erasure, restriction and objection do not apply. This is because researchers need to manage information in specific ways for the research to be reliable and accurate.
Source of personal data
Personal data will be obtained from the participant contact details form which IMPPP study participants complete and return to the research team alongside the completed study consent form.
Study participants are not required under a statute or contract to provide personal data and are free to withdraw from the study at any point.
Study participants are not required under a statute or contract to provide personal data and are free to withdraw from the study at any point.
Please note that we do not make use of automated decision making in relation to personal data.