Your Privacy

This privacy notice describes what we do with your personal information for the purposes of health and care research within the North West Secure Data Environment (North West SDE). It tells you what information we collect about you, how we store it, how long we retain it and with whom we might share it.

It is important that you read this notice, together with any other privacy notice or specific information you may already have been given (for example, in participant information booklet/leaflets or any consent forms), so that you are aware of how and why we are using information about you.

Data controller means the organisation that determines or decides the purposes, conditions and means of the processing of personal data.

De-identified means the removal of personal identifying information from data.

Information Commissioners Office means the body that regulates public bodies under data protection and freedom of information legislation.

UK GDPR “UK GDPR” means the General Data Protection Regulation (2016/679).

Personal data/information means information relating to a natural (living) person or “data subject”, which can be used to identify the person. This provides for a wide range of information to constitute personal data, for example:

• name
• identification number
• social media posts
• location data
• online identifier

Processing means anything that is done to the personal data we hold.

Sensitive Information/Special category of personal data means information that is thought to be ‘extra sensitive’, such as:

• ethnicity
• data concerning health
• biometric data
• sexual orientation
• religious or philosophical beliefs

The North West Secure Data Environment (North West SDE) is an NHS England-funded programme that supports the creation of a secure platform for data analysis. This platform is made available to researchers across the region.

Through the North West Secure Data Environment, partner organisations will make the information they hold on you available to researchers. This will only be made available under the correct ethical framework. The partner organisations to whom this applies are listed on this website’s ‘Our Region’ page. The areas covered are:

• Cheshire and Merseyside
• Greater Manchester
• Lancashire and South Cumbria

Each partner organisation is bound by a duty of confidentiality and must abide by the Data Protection Act 2018 and UK GDPR.

Each organisation is required to hold and maintain a registration with the Information Commissioner’s Officer (ICO) as Data Controller of the personal data it collects on you as part of providing direct care.

Lancashire Teaching Hospitals NHS Foundation Trust (LTHTR) will act as the host organisation for the NWSDE programme and is registered with the Information Commissioner’s Office (ICO) to process personal and special category information under registration number Z6929649.

High-quality data is essential to ensure health and social care research is accurate and successful. We will use your personal information to carry out research in the interests of the public. This means that each research project will be required to demonstrate that the research will have meaningful impact on the population; for example by improving existing services or introducing new treatments. The personal data held by a partner organisation will be anonymised before access is granted to the individuals conducting the research.

We might also use your personal information to carry out your request to opt out of allowing your health information to be used for research projects supported through the North West SDE, or to opt back in, should you make one of these requests to us. Please see the section called ‘Your rights’ below.

Each research project conducted within the North West SDE is required to specify the information that is necessary to fulfil the project’s aim.

In most cases, a partner organisation/s may already hold the personal information required for a specific research project due to the healthcare we provide to you.

The information that we already hold about you, or that may be collected from you, may include sensitive information such as:

• ethnicity
• information concerning your health
• biometric data
• sexual orientation
• religious or philosophical beliefs

If you make a request to opt out of allowing your health information to be used for research projects supported through the North West SDE, or to opt back in, we will need you to give us some information to enable us to carry out your request. We will ask you to provide the following:

1. Full name
2. Date of birth
3. NHS number
4. Address
5. Email address
6. Signature as part of a signed declaration

The national data opt-out service allows you to opt out of your NHS information being used for all research and service planning.

You can find out more and make your choice on the NHS.uk website.

Local data opt-out services prevent your information being used for research on SDEs. They do not apply to research outside SDEs.

Depending on where you live in the North West, a different local data opt-out will apply to you. Information on the different opt-outs is on the links below.

• Cheshire and Merseyside
• Greater Manchester
• Lancashire and South Cumbria (in progress).

If you are unsure which local data opt-out applies to you, this NHS Digital geographic search can help.

The first principle of UK GDPR requires personal data to be processed lawfully, fairly and transparently. As a result, a lawful basis is required when processing personal information and in this instance the following lawful basis will be relied upon:

When we use your information for research, we rely on Article 6(1)e (“processing is necessary for the performance of a task carried out in the public interest”) and Article 9(2)j (“processing is necessary for archiving purposes in the public interest, scientific or historical research purposes”) of the General Data Protection Regulation (GDPR) in combination with Schedule 1, Part 1, Art 4 Data Protection Act (DPA) 2018.

In addition, confidential information that you have shared with our staff to enable them to provide your care is governed by the common law duty of confidentiality, as described by NHS England.

Codes of practice for handling information in health and social care

Each partner organisation is responsible for the data they make available for access within the North West Secure Data Environment. Personal data within the North West SDE can only be viewed by the organisation providing the data and the support functions within the North West Secure Data Environment. All individuals who can view your personal data must comply with the law and ensure that your personal data is handled in a lawful way.

Your information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Health and Social Care Research.

UK Policy Framework for Health and Social Care Research

Researchers and organisations that wish to use your information to conduct research within the North West Secure Data Environment (North West SDE) will only have access to de-identified information.

Some information about you may also be linked to other information shared by primary care providers (eg your GP) and secondary care providers (eg an acute hospital trust) with the view to creating a more complete information set that will enable medical research for the benefit of public health.

Three ICBs, as data controllers for the North West SDE, have Section 251 Confidentiality Advisory Group and Research Ethics Committee (Research Ethics Service and Research Ethics Committees – Health Research Authority (hra.nhs.uk) approvals, which provide the legal basis for using and sharing health and care data under the common law duty of confidentiality.

CAG and REC reference numbers:

• Cheshire and Merseyside ICB – CAG Reference: 23/CAG/0033, REC Reference: 24/EE/0035
• Greater Manchester ICB – CAG Reference: 24/CAG/0034, REC Reference: 24/EE/0036
• Lancashire and South Cumbria – (in progress)

Privacy policies:

• Cheshire and Merseyside
• Greater Manchester
• Lancashire and South Cumbria (in progress)

If you submit a request to opt out of allowing your health information to be used for research projects supported through the North West SDE, or to opt back in, your personal information supplied as part of this request will only be seen by our staff responsible for processing your request.

Your personal information is held in both paper and electronic format, as required, for specified retention periods, as set out in the applicable research protocol. The applicable retention period for research studies may vary and will be outlined within each application.

Following the expiry of the relevant retention period, your personal information will be fully anonymised and archived, or destroyed. Where information is to be destroyed, this will be done in a confidential manner and in accordance with the NHS Records Management Code of Practice. Anonymised archived data may be re-used for scientific or historical research purposes.

If you register an opt out, the details you provide for this will be retained on record to ensure your opt out remains active.

The right to be informed

You have the right to be informed about the collection and use of your personal data.

The right of access

You have the right to ask for confirmation of whether we process data about you and if we do, to have access to that data so you are aware and can verify the lawfulness of the processing.

The right to rectification

You are entitled to have personal data that held about you rectified if it is inaccurate or incomplete.

The right to erasure

You have the right to ask us to erase your personal information in certain circumstances.

The right to restrict processing

You have the right to ask us to restrict the processing of your personal information in certain circumstances.

The right to data portability

You have the right to ask that we transfer the personal information you gave us to another organisation, or to you, in certain circumstances.

The right to object

You have the right to object to the processing of your personal information in certain circumstances.

Each Data Controller is accountable for complying with the above individual rights.

If you would like to find out more information on how you can exercise these rights, please see the below Privacy policies for each Data Controller.

Privacy policies:

• • Cheshire and Merseyside

• • Greater Manchester

• • Lancashire and South Cumbria (in progress)

How to make a complaint to the ICO

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you have the right to make a complaint to the ICO.

The ICO’s address is:

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Helpline number: 0303 123 1113 ICO

website: https://www.ico.org.uk

This page is reviewed when necessary and at least annually. The information on this page will be updated regularly as the programme progresses. Any changes will be published here. Information on the rest of this website will also change at times. We will update relevant pages as the programme progresses.

North West SDE is responsible for the management of this website and take the privacy of information provided by visitors to this website extremely seriously.

We do not capture or store personal information about individuals who browse this website. We do however collect statistical information, such as the number of visits to the website, which is not personally identifiable.

Visitors to our public website remain anonymous as none of the data collected is linked to any personal information. The information allows us to assess the popularity of the pages on the website, so that we can continue to improve our site and access to information.

To find out more about how we use Cookies, please visit our Cookie Policy.

Want to learn more about what we do with any information we collect in relation to the NW SDE? Please visit the My Privacy section

This website may include links to third-party websites and their applications. Clicking on those links and taking any other actions on those websites may allow those third parties to collect information about you. We’re not responsible for those websites and don’t have any control over how they collect information, so we recommend that you read the privacy statement of any site linked to this one.

We may need to update our privacy policy if the service we provide changes. You will not receive notification of these changes but they will be published on this page.