This privacy notice provides information about how University Hospitals Birmingham NHS Foundation Trust's (UHB) health research data hub "Pathway" collects and processes your personal data.
The date this page was last reviewed is available at the bottom. It is reviewed when necessary and at least annually.
Who we are
UHB is recognised as one of the leading research trusts in Europe and a Centre of excellence for a number of services. UHB hosts the Institute of Translational Medicine and led the West Midlands Genomic Medicine Centre. UHB researchers, many of whom are world leaders in their field, are engaged in a broad range of research activity. For more information about the research UHB undertakes, please visit our website:
As a leading research Trust, we are committed to protecting the privacy and security of your personal information. We are registered with the Information Commissioner’s Office (ICO) registration number: Z556810, to process personal and special category information.
If you have any questions about this privacy notice, including any request to exercise your legal rights as set out in this privacy policy, please contact our Data Protection Officer.
What is Pathway?
Pathway is a Health Data Research Hub established by UHB to provide controlled access to data for clinicians, analysts and researchers to improve patient care and the population’s health.
The data hub stores UHB healthcare data for all patients who have received care/treatment (i.e. information contained in healthcare records) or who have accessed a UHB service. Staff processing data within the UHB Pathway Data Hub are specialists based within the UHB Research & Development Department.
UHB is the controller and responsible for data contained in the Pathway. UHB has been awarded the required NHS Research Ethical approval (Ref: 22/EE/0161) for Pathway processing activities.
For information about the general use of patient data in research in the health service please visit the Health Research Authority website.
Definition
"Personal data" means information relating to a natural (living) person or "data subject", which can be used to identify the person. This provides for a wide range of information to constitute personal data, for example:
- name
- identification number
- date of Birth
- location data
- online identifier
"Special category of personal data" means information which is thought to be extra sensitive, such as:
- ethnicity
- data concerning health
- biometric data
- sexual orientation
- religious or philosophical belief
"Processing" means anything that is done to the personal data we hold.
"Pseudonymised/anonymised data" means personal data can no longer be attributed to a specific person.
Why we collect personal information about you
UHB uses your personal information to carry out health and social care research in the public interest. UHB’s research activities serve society as a whole, for example by improving disease detection, diagnosis and treatments or improving existing services.
Our legal bases for processing personal information about you is processed for the purposes of:
“The performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” under chapter 2, article 6 (1) (e)
“The provision of health or social care or treatment or the management of health of social care systems and services” under chapter 2, article 9 (2) (h) of the UK GDPR.
“The provision of health or social care or treatment or the management of health of social care systems and services” under chapter 2, article 9 (2) (j) of the UK GDPR. (“Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes”) of the GDPR, in combination with Schedule 1, Part 1, Art 4 Data Protection Act (DPA) 2018.
What personal information we need to collect about you and how we collect it
The personal identifiable information that UHB collect is information that UHB already hold about you due to the healthcare services you have received as part of the usual care processes, in order for UHB to deliver services and care to patients. This includes information from your clinical care records including imaging/graphical data.
Some information about you may be linked to other information shared by primary care providers (e.g. GPs) and secondary care providers (e.g. acute trusts) to create an improved information set to for medical research for the benefit of public health.
What we may do with your personal information
Personal information we collect about you may be:
- used for research and innovation projects to improve NHS care (Research and Innovation projects must demonstrate a significant benefit to patients and the public)
- used to measure treatment and care outcomes, provided by UHB services to identify improvements
- shared with other organisations such as NHS bodies, academics or commercial entities that request Pathway data to support research and development/ Innovation projects
Access to UHB pseudonymised/anonymised health data will only be permitted for following a formal UHB application process/contractual process and at no point will any patient identifiable data be accessible to anyone outside of UHB.
As part of a recent amendment to the Research Ethics Committee, PATHWAY can in certain circumstances grant permission to access identifiable data to direct clinical care teams to facilitate projects, using both structured (for example medications or test results) and unstructured health data (for example discharge letters or radiology reports) for the purposes of quality improvement and research. This data may be used for analysis in an identifiable format however it will be a mandated requirement that any publication or output will be presented as aggregated and fully anonymised and will be required for review before authorisation for publication.
The recent amendment also supports the use of types of technology within research and quality improvement, this includes the use of:
- Machine Learning Algorithms are ways to interpret patterns within data which can then be used to predict, train and develop artificial intelligence (AI)
- Natural language processing (NLP) is a machine learning technology that gives computers the ability to interpret and understand language.
- Text mining which is another type of artificial intelligence (AI) technology that uses NLP to transform the free (unstructured) text in documents and databases into accessible and usable, structured data suitable for analysis or to drive machine learning (ML) algorithms.
UHB will ensure that each application to use Pathway data will be fully scrutinised and approved and identify the project reporting method for results. When project results are published UHB will ensure that it is impossible to identify you.
UHB will not:
- share your identifiable data with third parties for marketing purposes
- sell your identifiable data
If UHB are required to transfer anonymised information about you outside the UK/EU, UHB will make sure that data is protected before transferring any data.
Who do UHB share your information with and why
Information about your health and the care you have received may be provided to researchers conducting research studies both here at the Trust and in other third party organisations.
Third party organisations are typically non-commercial partners such as universities or NHS hospitals, however there may be collaborative partnerships with Commercially funded companies.
Your information will only be used for research in accordance with the UK Policy Framework.
UHB may have to share information about you with the Care Quality Commission or other regulatory/law enforcement authorities. Please see the UHB Privacy notice for patients.
How we retain and re-use your information
Each application to use UHB Pathway patient health data is considered on a case by case basis and is subject to a stringent approval process as set out by the UK Data Service, in the 'Five Safes framework'.
Each application is evaluated by both UHB Research & Development professionals and an independent Data Trust Committee before recommendations are made on whether an application should be approved.
Data is only approved for research use following rigorous governance processes and approval from the UHB Caldicott Guardian and the member of staff responsible for the data (known as the Information Asset Owner).
Time limited contractual agreements will be put in place to protect pseudononymised/anonymised patient datasets.
Following the expiry of the contract your personal information will be archived for a specified period and then securely destroyed, in accordance with the Trust’s Record Management Policy.
Under certain circumstances, anonymised archived data may be re-used for scientific or historical research.
Your rights
Under current data protection legislation (Article 13 to 18, GDPR), you have certain rights to manage your data as you see fit. For the purpose of research, your rights to access, object, change, transfer and/or delete your information will differ as UHB need to manage the data in specific ways to ensure the research we conduct is reliable and accurate, and that we are accountable to research organisations which fund and monitor our research.
If you do not want your health data to be used for research and planning purposes(including Pathway), then you can choose to "Opt-out" using the NHS Digital website.
The Information Commissioner’s Office (ICO) is the body that regulates the Trust under data protection and freedom of information legislation. If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to the ICO.
Last reviewed: 05 December 2023