What is this privacy notice about?
This privacy notice explains how the Institute for Leadership and Management in Health (ILMH) ("we", "our", "us") collects, uses and shares your personal data (information) and your rights in relation to this data. The notice relates to our processing of personal data from NHS Digital, Hospital Episodes Statistics ("you", "your").
This privacy notice answers the following questions:
ILMH is part of Kingston University ("the University"). The University is the data controller of your personal data and is subject to the General Data Protection Regulation (the "GDPR") and the UK Data Protection Act 2018. As such, the University listed on the Information Commissioner's Office (ICO) register of fee payers.
You can find a copy of the University's Data Protection Policy online along with copies of our other relevant information regulations.
We may update this privacy notice periodically. If we do, we will publish this on our website.
What is the role of ILMH?
ILMH conducts health research. To do this, ILMH requires access to the NHS Admitted Patient Care (APS) - Hospital Episode Statistics (HES) database. The objective of this specific research study is to estimate the economic burden of human papilloma virus (HPV) in the UK.
How do we collect your information?
We collect the data from two NHS Digital databases:
- Admitted Patient Care (APS) - Hospital Episode Statistics (HES) database
- Outpatient - Hospital Episode Statistics (HES) database
Data will be provided to the University by the NHS in a pseudonymised format, meaning that directly-identifiable pieces of information, such as names, will have been removed before the University receives them. Pseudonymised data is considered personal data and therefore falls under the protection of data protection legislation.
Data will not be used for commercial purposes, or direct marketing or provided in any form to any third party for other purposes.
What types of information do we collect about you?
A number of information fields are contained in the datasets. These data fields include personal and non-personal data such as:
- Age and date of birth
- Gender
- Diagnosis and secondary diagnoses codes
- Duration of time spent in hospital
- Date of discharge from hospital
- Relevant primary care trust and hospital provider
The data does not include names of individuals.
How will we use your information?
The information will be analysed to estimate the economic burden of HPV in the UK. This analysis will be written up to produce a scientific article to be submitted to peer-reviewed journals for publication. No individuals will be identified in the published article.
What legal basis do we have for processing your information?
There are a number of lawful bases for processing personal data under the GDPR. These bases are different depending on whether the data is normal personal data (for example, names and phone numbers) or special category personal data. Special category personal data is sensitive personal data such as information relating to health, religion and trade union membership.
For personal data we rely upon processing that is necessary for the performance of a task carried out in the public interest as our lawful basis (GDPR Article 6 (1) (e)). This relates to the University's mission to conduct research for education purposes.
For special category personal data we rely upon processing that is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes as our lawful basis (GDPR Article 9 (2) (j)) and conditions relating to research under the Data Protection Act 2018 (Schedule 1, Part 1). Again, the University has an objective to facilitate education and research.
For the dissemination of the NHS data researchers rely upon the Health and Social Care Act 2012 (s261(1) and s261(2)(b)(ii)).
Who will we share your information with?
The raw data is provided by, and shared with, NHS Digital. Data will not be used for commercial purposes or direct marketing. Data will not be passed on to any third party except very limited suppliers that provide information technology services to the University. This may include, for example, cloud storage. These suppliers have contractual obligations with the University to preserve the confidentiality and security of the data.
Within the University, data will be controlled by members of the ILMH. Data requested will only be accessed by individuals within the University who have authorisation from ILMH to access the data for the specific research purpose(s) described. Researchers involved in the project are employees of the University. As substantive employees at Kingston University they will only carry out data processing for which they have been appropriately trained in data protection and confidentiality.
Information transferred overseas
Some of the personal data we process about you may be transferred to, and stored at, a destination outside the European Economic Area ("EEA"). These processes include where the personal data is processed by our staff, contractors or suppliers who are based outside the EEA or who use storage facilities outside the EEA, such as cloud storage providers.
In these circumstances, your personal data will only be transferred on one of the following bases:
- where the transfer is subject to one or more of the "appropriate safeguards" for international transfers prescribed by applicable law (for example, standard data protection clauses adopted by the European Commission);
- a European Commission decision provides that the country or territory to which the transfer is made ensures an adequate level of data protection;
- there exists another situation where the transfer is permitted under applicable law (for example, where we have your explicit consent).
For how long do we keep your information?
The University has a data sharing agreement to use the data with NHS Digital that ends on 14 February 2021.
How do you make sure my information remains accurate?
It is important that the personal information we hold about you remains accurate. We do not amend the data we receive from NHS Digital, apart from to enable our analysis, which does not affect the accuracy of the data. Any outputs, such as publications, are therefore based on the original accurate data. The raw data is held for the duration of the data sharing agreement.
What are your rights?
Under the GDPR and the DPA 2018, you have the following rights if it is possible for us to identify you in the data set:
- to access from us the personal data we hold about you
- to require us to correct the personal data we hold about you if it is incorrect
- to require us to erase your personal data
- to require us to restrict our data processing activities
- to object, on grounds relating to your particular situation, to any of our particular processing activities where you feel this has a disproportionate impact on your rights
- to not be subject to a decision based solely on automated processing, including profiling, which has a legal effect on you.
If you wish to exercise your rights please contact the project team or Data Protection Officer using the contact details set out below.
Who can you contact about your information?
If you have any queries about the research and the data being used you should, in the first instance, contact Professor Giampiero Favato, Director of the Institute of Leadership and Management in Health by email: g.favato@kingston.ac.uk.
If you wish to request access to the personal data we hold about you, please use the Subject Access Request Form available online. For any other queries about this privacy notice, or how we process your personal data, you can contact our Data Protection Officer by email: DPO@kingston.ac.uk or by post: Data Protection Officer, Vice Chancellor's Office, River House, 53–57 High Street, Kingston upon Thames, Surrey KT1 1LQ.
If you are not satisfied with how we are processing your personal data, you can make a complaint to the Information Commissioner.
You can find out more about your rights under data protection legislation from the Information Commissioner's Office website.
