User login
Back to top

Privacy Notice


How we use your personal information

The material presented here supplements the information that you may have already received about the Yorkshire & Humberside Haematology Network (YHHN) contained in the YHHN Information Leaflet. It provides more details about the ways in which YHHN deals with personal data, explaining:

  • The type of personal information collected and stored by YHHN
  • How data are collected
  • How information is stored and processed
  • The legal basis for collecting and processing data
  • Your rights concerning personal data
  • How to withdraw from YHHN
  • Who to contact if you have any questions or concerns
  • How to make a complaint


What personal information is being collected and processed by YHHN?

Personal data is any information that could potentially allow an individual to be identified.  The following information may be collected and processed by YHHN:

  • Name (surname, forename)
  • Date of birth
  • Sex
  • Ethnicity 
  • Address
  • NHS number
  • Hospital number
  • Diagnosis (and date)
  • Genetic data
  • National administrative data on hospital visits and admissions (Hospital Episode Statistics - HES), cancers and deaths (where applicable); these data come from NHS Digital.

All information held by YHHN is for research purposes only. Data are only collected if they are needed to answer particular research questions, and may not be collected on everyone.


How are the data collected?

From medical records (paper-based and electronic) we collect information about diagnosis, which may include findings from genetic tests performed on diagnostic sample(s). We also collect data on disease management, treatments received, and response to therapies. To link these data to national administrative data, we send name, sex, date of birth, NHS number, and YHHN study number to NHS Digital using their secure electronic portal. Using the same system, NHS Digital use the YHHN study number to return the linked information to us.


How do YHHN store, process and use personal information?

All data, including personal information is always stored securely in databases at the University of York, and is processed by a restricted number of YHHN staff; all of whom are employed by the University of York and trained in confidentiality procedures. Our security policies are approved under the NHS Information Governance Toolkit. YHHN only uses information and samples for ethically-approved projects to help research into blood cancers and related disorders. No extra information is stored, shared or used.


Will information be kept confidential?

All information held by YHHN is kept in accordance with the Data Protection Act. Participants are given a study number that is used to link all information. The data that are extracted and processed contain no personal information.


Will data be shared?

Only a restricted number of YHHN staff at the University of York can access YHHN data. Occasionally, we undertake studies with academics from other universities and we may share some information with them. However, this information is always anonymised, ensuring no-one can be identified. Data received from NHS Digital will never be shared with other individuals or organisations.


What is the legal basis for YHHN collecting and using personal and special category data and what permissions do YHHN have?

Under the General Data Protection Regulation (GDPR), the University of York has to identify a legal basis for processing personal data, and an additional legal basis for processing special category data. In line with the University’s charter, which states that we advance learning and knowledge by teaching and research, the University processes personal data for research purposes under Article 6 (1) (e) of the GDPR:

Processing is necessary for the performance of a task carried out in the public interest

Special category data is processed under Article 9 (2) (j):

Processing is necessary for archiving purposes in the public interest, or scientific and historical research purposes or statistical purposes

In line with ethical expectations, and to comply with common law duty of confidentiality, YHHN will seek your consent to participate where appropriate. This consent is not, however, our legal basis for processing data under the GDPR.  


What and who is the data controller?

A data controller is an organisation that has full authority to decide how and why personal data are processed; this includes using, storing and deleting data. The University of York is the joint data controller for YHHN along with Hull Teaching Hospitals NHS Trust.  


What permissions do you have to collect the data?

We work with the clinical teams that are responsible for the care of patients with blood disorders to inform patients about YHHN.  As part of this, an information pack is either given or sent to most patients. In addition to information about YHHN, the pack also contains a consent form requesting  permission to access and use clinical information for research purposes, and for NHS Digital to send us information from national NHS databases. 

Unfortunately, sometimes it is not appropriate to contact a patient to inform them about YHHN, and consequently the project has been granted specific legal permission to collect information about  patients without the need to seek consent. This permission is granted through Section 251 of the NHS Act 2006; and every year this support is reviewed by the Health Research Authority’s (HRA) Confidentiality Advisory Group (CAG).


I do not wish you to obtain information on me - what should I do?

Please contact us and we will ensure that no personal information about you is processed, and that data is neither sent to, nor received from, NHS Digital.


What rights do I have in relation to my data?

Under GDPR you have a general right to restrict the use and processing of your data, a right to rectification, erasure and withdrawal. However, because this is a research project we cannot provide individuals with their test results.


I have previously consented for my data to be used, and now wish to withdraw my consent - what should I do?

You can withdraw from YHHN at any time, without giving a reason. If you wish to do this, please contact us. Any information you have supplied or we have obtained from NHS Digital will be destroyed, and information about you will not be used in ongoing or future research. However, where anonymised data has already been used for the research purposes this will not be possible.


Who can I contact?

If you have any questions please contact us or you can also contact the University of York’s Data Protection Officer at More information about how the University of York processes data can be found in the University of York General Privacy Notice.


How do I complain?

If you are unhappy with the way in which the University has handled your personal data, you have a right to complain to the Information Commissioner’s Office. For information on reporting a concern to the Information Commissioner’s Office, please visit the Information Commissioner’s Office website.