Privacy Notice

Where do we obtain data from?

This study uses data from the Clinical Practice Research Datalink (CPRD) which is a primary care dataset, with linked Hospital Episodes Statistics (HES) data. The data are about admissions at NHS hospitals in England and interactions with GP practices. The hospital data are collected during patients’ time at hospital and collated centrally to allow hospitals to be paid for the care they deliver. The primary care data is derived from patient record systems of a sample of GP practices in England and is collated for research purposes. HES data is designed to enable other non-clinical uses, such as research into aspects of NHS care. More information is available on the CPRD website (https://www.cprd.com/)

What data do we hold?

The data do not contain patients’ names, addresses, phone numbers or NHS numbers. It contains the month and year of patients’ births, although not the date.

These data do include a unique identifier, which if combined with data held by CPRD would allow identification of an individual. Therefore these data are classed as ‘personal data’ under the General Data Protection Regulation (GDPR).

Who will process my personal information?

Only researchers in the Martin House Research Centre at the University of York will process your data. We do not share the personal data for this study with anyone else. All publications and presentations will be undertaken using aggregate level data.

What is the purpose and legal basis of the processing?

Under the General Data Protection Regulation (GDPR), the University has to identify a legal basis for processing personal data and, where appropriate, an additional legal basis for processing special category data.

In line with our charter which states that we advance learning and knowledge by teaching and research, the University processes personal data for research purposes under Article 6 (1) (e) of the GDPR:

Processing is necessary for the performance of a task carried out in the public interest.

Special category data is processed under Article 9 (2) (j):

Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes.

Research will only be undertaken where ethical approval has been obtained, where there is a clear public interest and where appropriate safeguards have been put in place to protect data.

"We do not conduct automated decision-making or profiling on the data."

How will you keep my data secure?

The data controllers for this study are the University of York.

The University will put in place appropriate technical and organisational measures to protect your personal data and/or special category data.

Information will be treated confidentially and shared on a need-to-know basis only. The University is committed to the principle of data protection by design and default and will collect the minimum amount of data necessary for the project.

How can I access my personal information?

Various rights under data protection legislation, including the right to access personal information that is held about you, are qualified or do not apply when personal information is processed solely in a research or archival contact. This is because fulfilling them might adversely affect the integrity of, and the public benefits arising from, the research study or project.

The full list of (qualified or inapplicable) rights is: the right to access the personal information that is held about you by the University (further details are published here), the right to ask us to correct any inaccurate personal information we hold about you, to delete personal information, or otherwise restrict our processing, or to object to processing (including the receipt of direct marketing) or to receive an electronic copy of the personal information you provided to us.

If you have any questions regarding your rights in this context, please use the contact details below.

Please note as we do not hold names or addresses for this study we cannot remove participants from this study.

How long is my information kept?

Although the analyses conducted by the Martin House Research Centre Team cannot identify any individual from the data provided by CPRD, the team takes great care in protecting the data. The MHRC team is subject to strict contractual standards imposed by CPRD, as the data providers.

As contractually required, CPRD data are not kept for longer than the length of the research study and are then securely destroyed.

Who can I contact?

If you have any questions about this research study, please contact the principal investigator Professor Lorna Fraser on lorna.fraser@york.ac.uk.

If you have any general questions about how your personal information is used by the University, or wish to exercise any of your rights, please consult the University’s data protection webpages. If you need further assistance, please contact the University’s Data Protection Officer at dataprotection@york.ac.uk.

How can I complain?

If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer who will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO).

Our Data Protection Officer is Durham Burt and you can contact him at dataprotection@york.ac.uk

For information on reporting a concern to the Information Commissioner’s Office, please follow this link.