> Patients and Visitors > What Happens to my Information? > Our Services > Research and Development Privacy Notice

Research and Development Privacy Notice

Data Controller: Research and Development Privacy Notice

Research and Development is a core component of Trust activity and is key to making advancements in patient care. Clinical research is an essential requirement to improve knowledge and understanding of which treatments work best. At the Royal Wolverhampton NHS Trust we continually strive to ensure that our patients are identified and offered early participation in suitable research as part of their treatment and care choice. The research we undertake helps to answer important questions about which methods of diagnosis and treatments have the most beneficial outcomes for patients, in terms of caring, controlling or preventing disease. Patient involvement in clinical research is vital. New and better treatments for many diseases wound not have been possible without research. Research is the only way we can continue to improve prevention and treatment of diseases and patient care.

What information do we collect about you?

We collect data using existing your hospital record for example:

Paper Records
Clinical Systems
Images
Information shared by other health authorities

To allow us to conduct research we collect personal contact details such as:

Name
Addresses
Date of birth
Gender
Marital status
Telephone numbers

We may also collect, store and use the following “special categories” of more sensitive personal information for example:

Information about ethnicity
Health and clinical course
Results of investigations such as laboratory tests
Smoking status
Any learning disabilities
Religion
NHS Numbers

Return to top

How do we use this and what is the legal basis?

As a data controller the Trust must establish and publish the lawful basis that is relied on for processing personal data and data that is special categories (sensitive data). Generally most of the processing we carry out is to deliver your care and treatment, and is covered by the following legal provisions;

For the performance of a task carried out in the public interest or in the exercise of official authority, to delivery you a heath care service For medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems
To support the health of the general public
To review care provided to ensure it is of the highest standard possible
Protect our legal position in the event of legal proceedings

The department conducts research which could involve your personal data. Should this be the case, we will rely upon GDPR Article 6(1)(f) '...legitimate interests…except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject...'

The legal basis which allows us to process your personal data is Article 6 1(a) the data subject has given consent to the processing of his or her personal data for one or more specific purposes; and Article 9 (2) (a) the data subject has given explicit consent to the processing those personal data for one or more specified purposes.

The legal basis is informed consent.

Return to top

Who do we share your information with?

NHS England
Public Health England
National Institute for Health Research
Health Research Authority
Other NHS Trusts
General Practitioners (GP’s)
Ambulance Services
Primary Care Agencies
External Health Care Companies outside of the NHS
Neonatal Data Analysis Unit
Imperial College and Chelsea
Universities
NHS Digital

We may need to share information from your health records with other non-NHS organisations from which you are also receiving care, such as Social Services or private care homes. However we will not disclose any health information to third parties without your explicit consent unless there are circumstances, such as when the health or safety of others is at risk or where current legislation permits or requires it.

There may be situations where the Trust is required by law to share information provided to us with other bodies responsible for auditing or administering public funds, in order to prevent and detect fraud.

There may also be situations where we are under a duty to share your information, due to legal requirement. This includes, but is not limited to, disclosure under a court order, sharing with the Care Quality Commission for inspection purposes, the health & safety executive if you are involved in a reportable incident whilst on site, the police for the prevention or detection of crime or where there is an overriding public interest to prevent abuse or serious harm to other and other public bodies (for example HMRC for the misuse of public funds in order to prevent and detect fraud).

For any request to transfer your data internationally outside the UK/EU, we will make sure that an adequate level of protection is satisfied before the transfer.

The Trust is required to protect your personal information, inform you of how your personal information will be used, and allow you to decide if and how your personal information can be shared.

Personal information you provide to the Trust in confidence will only be used for the purposes explained to you and to which you have consented. Unless, there are exceptional circumstances, such as when the health or safety of others is at risk, where the law requires it or there is an overriding public interest to do so. Where there is cause to do this, the Trust will always do its best to notify you of this sharing.

UK National Research Ethics Committees often allow health researchers to use clinical information anonymously (without and personal information) for medical research where this does not require any additional contact with patients. The Royal Wolverhampton NHS Trust participates in research to benefit patient care, and so your information could be studied anonymously but only after approval by a National Research Ethics Committee. If your identifiable personal information (the information that identifies you) is to be used in research you will be asked for your consent. However, a specially appointed national body, the Confidentiality Advisory Group (CAG), may allow personal details to be used without consent in specific circumstances where the research is seen to be in the public interest. Studies without a section 251 CAG approval and where informed consent is not being taken Nation Data Opt out apply.

If you do not wish personal data that we hold about you to be used in the way that is described in this notice, please discuss the matter with us. You have the right to object in certain circumstances, such as where you have given consent to the processing or have entered into a contract you have given consent, but this may affect our ability to provide you with care or advice.

Return to top

What rights do I have in relation to my information?

Below is a list of the rights you have in relation to your data and when they apply. To make an application for any of the below rights please contact the Health Records Access Team who will coordinate your request (see ‘how do I request my information’ section below). All rights requests must be completed within 30 calendar days from the date received, but may be extended if complex.

The Right of Access
You have the right to obtain a copy of any personal information held by the Trust as well as any supplementary information we hold about you.

Right to Rectification
If you believe your information may be inaccurate or incomplete you can make a request to have your information reviewed.

The Right to Erasure
The right to erasure is also known as the ‘right to be forgotten’. This introduces a right for you to have personal data erased. Generally this right is not available with health care data. Where this right is available for specific processing you will be notified.

The Right to Restrict Processing
The right to restriction allows you to request the restriction or suppression your personal data. This right is closely linked with the right to rectify and the right to object and will only apply if:

you contest the accuracy of your personal data and the accuracy is being verified by the trust;
the data has been unlawfully processed (ie in breach of the lawfulness requirement of the first principle of the GDPR) and you oppose erasure and requests restriction instead;
the personal data is no longer needed but we need to keep it in order to establish, exercise or defend a legal claim.

The Right to Data Portability
The right to data portability allows you to obtain and reuse your personal data across different services. The process should allow for moving, copying or transfer of personal data easily from one IT environment to another in a safe and secure way, without hindrance to usability. The right to data portability is not an absolute right and generally will not apply to your health care record unless:

The processing is based on your consent or in the performance of a contract;
When processing is carried out by automated means.

The Right to Object

The right to object to processing means that data should cease to be processed. This right applies only where data is obtained with your consent. In most cases we rely on our legal basis to process your data and not consent and therefore for care purposes this right may not apply. If your data is used for any other reason this right may apply, but would have to be assessed on an individual basis.

We will always try to keep your information confidential and only share information when absolutely necessary.

Return to top

How do I request my information?

You have a right to see or have copies of any information held by the Trust that relates to you free of charge. We have the right to charge an administration fee in situations where repeated requests are received for the same information or the request is excessive. You will be required to prove your identity when making requests.

Subject Access Requests must be processed within 30 days of receipt of your request. However, once our team has established the complexity of the request there may be a requirement to extend this up to 90 days. We will contact you within 30 days should this be the case.

To request access to health records please complete a Subject Access Request form, link provided below and forward on to:

Health Records Access Team
Health Records Library (Location B19)
New Cross Hospital
Wolverhampton Road
Wolverhampton
WV10 0QP

Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 Ext. 5544 / 5545 or 8093

Return to top

How long is my information kept for?

All our records are destroyed in accordance with the NHS Retention Schedule, which sets out the appropriate length of time each type of NHS records is retained. We do not keep your records for longer than necessary. All records are destroyed confidentially once their retention period has been met, and the Trust has made the decision that the records are no longer required. For more information please see the Record Management Code for Practice for Health and Social Care 2016 retention schedules.

For clinical trials records retention schedules please see the MHRC guidance available at Good Clinical Practice for Clinical Trials.

Return to top

How to make a complaint

If you have any concerns or wish to make a complaint about your care, please speak to a health professional involved in your care in the in the first instance. If your concern is not resolved to your satisfaction please contact the Patient Advice and Liaison Service (PALS)

Data Protection Officer (DPO): rwh-tr.dpo@nhs.net
New Cross Hospital
Wolverhampton Road
Heath Town
Wolverhampton
WV10 0QP

Email: rwh-tr.IG-Enquiries@nhs.net
Telephone: 01902 307999 ext. 8124

The Data Protection Officer is a point of contact for advice and guidance in relation to your rights. The DPO is responsible for monitoring the Trusts compliance with the Data Protection Act 2018 and the General Data Protection Regulations (GDPR) 2016 as any policies the Trust has in relation to the protection of personal data. The DPO shall perform their duties in an independent manner with due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.

If you have any concerns about how your information is being processed or any of the rights as detailed above, please contact the Trust in the first instance through:

Health Records Access Team
Health Records Library (Location B19)
New Cross Hospital
Wolverhampton Road
Wolverhampton
WV10 0QP

Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 Ext. 5544 / 5545 or 8093

You also have a right to complain directly to the Information Commissioner’s Office if you feel the Trust has not responded effectively to any of the above.

Information Commissioners Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Telephone: 0303 123 1113
Website: https://ico.org.uk/

Return to top