Health Sciences
Privacy Notice
Where do we obtain data from?
This study uses data from Hospital Episode Statistics (HES) data which is provided by NHS Digital. It is data about admissions at NHS hospitals in England. This data is collected during patients’ time at hospital and is collated centrally to allow hospitals to be paid for the care they deliver. HES data is designed to enable other non-clinical uses, such as research into aspects of NHS care. More information is available on the NHS Digital website (https://digital.nhs.uk/data-and-information/data-tools-and-services/data-services/hospital-episode-statistics).
For those children who have died we also have data about their death from the Office for National Statistics national registration data. These data are also supplied by NHS Digital.
What data do we hold?
The data does not contain patients’ names, addresses, phone numbers, NHS numbers, or records from primary care. It contains the month and year of patients’ births, although not the date. The death record data contains the date of death and the cause(s) of death.
These data do include a unique identifier, which if combined with data held by NHS Digital would allow identification of an individual therefore these data are classed as ‘personal data’ under the General Data Protection Regulation (GDPR).
Who will process my personal information?
Only researchers in the Martin House Research Centre at the University of York will process your data. We do not shre the personal data for this study with anyone else. All publications and presentations will be undertaken using aggregate level data.
What is the purpose and legal basis of the processing?
Under the General Data Protection Regulation (GDPR), the University has to identify a legal basis for processing personal data and, where appropriate, an additional legal basis for processing special category data.
In line with our charter which states that we advance learning and knowledge by teaching and research, the University processes personal data for research purposes under Article 6 (1) (e) of the GDPR:
Processing is necessary for the performance of a task carried out in the public interest
Special category data is processed under Article 9 (2) (j):
Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes
Research will only be undertaken where ethical approval has been obtained, where there is a clear public interest and where appropriate safeguards have been put in place to protect data.
How will you keep my data secure?
The data controllers for this study are the University of York.
The University will put in place appropriate technical and organisational measures to protect your personal data and/or special category data.
Information will be treated confidentially and shared on a need-to-know basis only. The University is committed to the principle of data protection by design and default and will collect the minimum amount of data necessary for the project.
How can I access my personal information?
Various rights under data protection legislation, including the right to access personal information that is held about you, are qualified or do not apply when personal information is processed solely in a research or archival contact. This is because fulfilling them might adversely affect the integrity of, and the public benefits arising from, the research study or project.
The full list of (qualified or inapplicable) rights is: the right to access the personal information that is held about you by the University (further details are published here), the right to ask us to correct any inaccurate personal information we hold about you, to delete personal information, or otherwise restrict our processing, or to object to processing (including the receipt of direct marketing) or to receive an electronic copy of the personal information you provided to us.
If you have any questions regarding your rights in this context, please use the contact details below.
Please note as we do not hold names or addresses for this study we cannot remove participants from this study.
How long is my information kept?
Although the analyses conducted by the Martin House Research Centre Team cannot identify any individual from the HES data provided to it by NHS Digital, it takes great care in protecting the HES data. The MHRC team is subject to strict contractual standards imposed by NHS Digital, as the data provider.
As contractually required, HES data is not kept for longer than the length of the research study and is then securely destroyed.
Who can I contact?
If you have any questions about this research study, please contact the principal investigator Dr Lorna Fraser on lorna.fraser@york.ac.uk.
If you have any general questions about how your personal information is used by the University, or wish to exercise any of your rights, please consult the University’s data protection webpages. If you need further assistance, please contact the University’s Data Protection Officer at dataprotection@york.ac.uk.
How can I complain?
If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO).
Our Data Protection Officer is Durham Burt and you can contact him at dataprotection@york.ac.uk
For information on reporting a concern to the Information Commissioner’s Office, please follow this link.