What we do with your data (fair processing)
The information here supplements material you may have already received from us about the Yorkshire & Humberside Haematology Network (YHHN) in our Information Leaflet. It provides more details about the way YHHN uses personal data, including:
- The personal information collected and stored
- How data are collected
- How information is stored and processed
- The legal basis for collecting and processing data
- Your rights concerning personal data
- How to withdraw from YHHN
- Who to contact if you have any questions or concerns
- How to make a complaint
Personal data is any information that could potentially allow an individual to be identified. The following information may be collected and processed by YHHN:
- Name (surname, forename)
- Date of birth
- Sex
- Ethnicity
- Address
- NHS number
- Hospital number
- Diagnosis (and date)
- Genetic data from diagnostic sample(s)
- National administrative data (via NHS Digital): hospital appointments and admissions (Hospital Episode Statistics; HES), cancers and deaths (where applicable).
All information held by YHHN is used for research purposes only. Data are collected to answer specific research questions and may not be collected on everyone.
Information is collected from medical records (paper and electronic) about diagnosis, including findings from genetic testing of sample(s), disease management, treatments and treatment response. These data are linked to national administrative databases by sending patient name, sex, date of birth, NHS number, and YHHN study number to NHS Digital's secure electronic portal. NHS Digital use the same system to return linked information, using YHHN study numbers.
All data, including personal information, is always stored securely in databases at the University of York, and is processed by a restricted number of YHHN staff; all of whom are employed by the University of York and trained in confidentiality procedures. Our security policies are approved under the NHS Information Governance Toolkit. YHHN only uses information and samples for ethically-approved research into blood cancers and related disorders. No extra information is stored, shared or used.
All information held by YHHN is kept in accordance with the Data Protection Act. Participants are given a study number that is used to link all information. The data that are extracted and processed contain no personal information.
A restricted number of YHHN staff at the University of York access the study data. Occasionally, we undertake projects with researchers from other universities and we may share information with them. However, this is always anonymised, so no-one can be identified. Data from NHS Digital are never shared with other individuals or organisations.
Under the General Data Protection Regulation (GDPR), the University of York has to identify a legal basis for processing personal data, and an additional legal basis for processing special category data. In line with the University’s charter, which states that we advance learning and knowledge by teaching and research, the University processes personal data for research purposes under Article 6 (1) (e) of the GDPR:
Processing is necessary for the performance of a task carried out in the public interest
Special category data is processed under Article 9 (2) (j):
Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes
In line with ethical expectations, and to comply with common law duty of confidentiality, YHHN seeks patients consent for participation where appropriate. This consent is not, however, our legal basis for processing data under the GDPR.
A data controller is an organisation that has full authority to decide how and why personal data are processed; this includes using, storing and deleting data. The University of York is the joint data controller for YHHN along with Hull University Teaching Hospitals NHS Trust.
We work with the clinical teams responsible for delivering care to people with blood disorders to inform patients about YHHN. This involves giving or mailing an information pack to most patients, along with a consent form asking them for permission to access and use their clinical information for research purposes, including data returned to us from NHS Digital from national NHS databases.
It is not always appropriate to contact a patient to inform them about YHHN, consequently YHHN has specific legal permission to collect information about patients without the need to seek consent. This permission is granted through Section 251 of the NHS Act 2006 (Reference: 20/CAG/0149). Every year, this support is reviewed by the Health Research Authority’s (HRA) Confidentiality Advisory Group (CAG).
Please contact us and we will ensure no personal information about you is processed, and that data is neither sent to, nor received from, NHS Digital.
Under GDPR, you have a general right to restrict the use and processing of your data, and a right to rectification, erasure and withdrawal. Because this is a research project we cannot provide individuals with their test results.
You can withdraw from YHHN at any time, without giving a reason. If you want to do this, please contact us. Any information you have supplied, or we have obtained from NHS Digital, will be destroyed, and your data will not be used in ongoing or future research. Where anonymised data have already been used for research purposes, however, this will not be possible.
If you have any questions please contact us or the University of York’s Data Protection Officer: dataprotection@york.ac.uk. More information about how the University of York processes data can be found in the University of York General Privacy Notice.
If you are unhappy with the way the University has handled your personal data, you have a right to complain to the Information Commissioner’s Office. Details about how to do this are available at their website.
Version 2; March 2021