Privacy

The NIHR Birmingham BRC (Biomedical Research Centre) is part of the National Institute for Health and Care Research (NIHR) and is hosted by University Hospitals Birmingham NHS Foundation Trust (UHB) in partnership with University of Birmingham (UoB).

Our associate partners bring additional expertise, increase our research capacity and add regional capability. They include:

• Birmingham Community Healthcare NHS Foundation Trust
• Birmingham Women’s and Children’s NHS Foundation Trust
• Sandwell and West Birmingham NHS Trust
• Aston University
• Keele University
• University of Oxford

NIHR BRCs are collaborations between universities and NHS organisations. They bring together academics and clinicians to translate lab-based discoveries into potential new treatments, diagnostics and technologies.

The NIHR funds, enables and delivers world-leading health and social care research that improves people’s health and wellbeing and promotes economic growth. The NIHR has awarded £816 million over five years to 20 BRCs across England.

The NIHR Birmingham BRC aims are to:

• Drive innovation in the prevention, diagnosis and treatment of ill-health
• Translate advances in biomedical research into benefits for patients

We collect personal information from:

• our researchers in order to support them with their research and research funding applications and other interactions with the NIHR and to promote and distribute content that will align to their BRC work
• our patients who might be suitable to participate in any of our research projects
• members of the public and patient representatives for our “Public and Patient Engagement and Involvement” (PPIE) work and who may wish to be part of research projects
• our website visitors via our own or third party cookies.

Our researchers

The type of personal information we collect will vary according to the interactions you are having with the NIHR Birmingham BRC. Different interactions and information collected are outlined below:

• For formal interactions with NIHR – such as applications for funding – we will increasingly ask researchers for an ORCiD identifier as a consistent and universal identifier of a researcher across NIHR, and beyond. This will help us (and other research bodies) to recognise you as the same individual and will provide opportunities to remove duplication of your effort in recording information more than once.
• We may ask for your name, email address and organisational unit in order to help personalise content to you, communicate with you (e.g. via emails and our monthly BRC Newsletter/Bulletin), and support you through your BRC activities. We also use this information to formally report back to the NIHR as part of our annual report obligations.
• You may also be asked to provide additional information including contact details and job title, associations with organisations and institutions and your association with various NIHR activities e.g. applications, grants, awards, studies, training activities projects and programmes, PPIE activities, patient research ambassador activities.  This information will help to foster collaborative working across the BRC, and will also enable any internal and external (e.g. to the NIHR) reporting that we are obligated to submit.
• We may collect additional special category data relating to equality and diversity (such as ethnicity).  When we do this, we will explain why we are requesting this data and we will store the information separately and encrypted to maintain anonymity. When we report any such data, this will be done in aggregated format which means that you will not be identifiable from this information .  By collecting this information, we will be able to better understand, for example, how diverse our workforce is, which in turn will help us to create a more  impactful  equality and diversity strategy.  More information on this can be found within our EDI strategy.

Study participants

If you are a study participant, we may collect your data from many sources which may include:

• Research questionnaires or surveys
• Hospital & GP based medical records
• NHS National datasets
• Online forms

The data we collect will be dependent on the study and this will be explained to you in the patient information sheet when you are consenting to the study. Every study is different and will have a nominated “sponsor”. You should therefore read the Privacy Policy for the sponsor organisation for the study you are considering to take part in.

Patient and Public Engagement

As part of our Patient and Public Engagement (PPIE) work which involves reviewers, PPIE representatives and Research Ambassadors, we may collect personal data such as name, job title, work institution, contact details and bank details. Bank details are collected only if we need to reimburse you for any expenses that you may have accrued. We may also collect additional special category data relating to equality and diversity (such as ethnicity) to monitor and report the diversity of our PPIE representatives. This is optional. More information on this can be found within our PPIE and EDI strategies.

Cookies

Our website uses cookies to monitor their use and tailor the website operation to your needs and preferences. More information is available in our cookie policy.

We use your personal information for the following purposes:

• To carry out research activities and studies in accordance with applicable laws and regulations
• To contact you regarding your participation in research studies or to invite you to participate in new studies
• To analyse and process research data, ensuring the protection of your privacy
• To improve the quality and safety of healthcare services
• To comply with legal and regulatory requirements
• To contact you about opportunities such as events
• To inform you about any updates from our BRC
• To tell you about research outputs.

The way in which we use your information is governed by law. The principal legislation that applies is the UK General Data Protection Regulation (UK GDPR) 2016/679, as established by the European Union (Withdrawal) Act 2018), and the Data Protection Act 2018, both as amended Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019 (SI 2019/419) following the UK’s exit from the EU (DPPEC Regulations).

Our processing of our “personal data” or “special category data” data (which is sensitive data such as information about your health or ethnicity) is based on the following legal grounds:

• For personal data collected for the administration and commissioning of NIHR research programmes and infrastructure, we are processing under Article 6.1 (e) of the UK GDPR  (“processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller”).
• For processing of personal data, where the activity or purpose does not fall under the “public task”, we rely on “legitimate interest”, as per Article 6.1 (f) UK GDPR, where appropriate, supported by a legitimate interest assessment.
• For processing of special category data in connection with a particular research project, which was collected as part of your direct care or where you have provided your consent to research, we rely on the legal basis of  Article 9.2 (j) UK GDPR (“research purposes”). For more information, please visit our generic privacy notice for research:  Privacy notice (uhb.nhs.uk)
• For the processing of special category data of our research staff, collaborators or members of our public and private engagement and involvement (PPIE) groups, we rely on the substantial public interest condition in Article 9.2 (g) UK GDPR and paragraphs 6 and 8 of Schedule 1, Part 2 of the DPA 2018 (“substantial public interest”).

We may share your personal information with the following parties:

• Researchers and collaborators involved in research studies
• Healthcare professionals and organisations involved in providing healthcare services
• Regulatory bodies, ethics committees, and funding agencies
• Service providers who assist us in carrying out research activities (e.g., data processors, laboratories)
• Any other parties as required by law or with your explicit consent

We will ensure that appropriate safeguards are in place to protect the privacy and security of your information when sharing it with third parties.

For research purposes and equality, diversity and inclusivity purposes, we may use your information anonymously in reports or presentations, or share such information externally or with other NHS or University bodies within the BRC. Publicly available information will always be presented in aggregated format, which means that you will not be identifiable from this information.

The NIHR Birmingham Biomedical Research Centre (BRC) is part of the National Institute for Health and Care Research (NIHR) and hosted by University Hospitals Birmingham NHS Foundation Trust (UHBFT) in partnership with the University of Birmingham (UoB). For more information on what happens when we process your information for the purposes of “research”, please visit the UHB privacy notice or the UoB privacy notice.

Where you have consented to a particular research project, additional information on the nature of the research project and specifics of how your data will be managed will be contained within the participant/patient information sheet and/or supplementary research transparency information sheet you are provided with during the informed consent process. Please feel free to ask the researchers for clarification.

For more information about the general use of patient data in research in the health service please visit the Health Research Authority website (opens in new tab).

For more information of how we process personal information of our staff, please visit our generic staff privacy notice.

Data collected as part of your interaction with our website will be used for monitoring purposes only, for example, to understand what parts of our website is accessed more frequently than others and what search terms users are using to identify the content on our website.

We will not:

• share your identifiable data with third parties for marketing purposes
• sell your identifiable data

Where we are required to transfer identifiable information about you internationally outside the UK/EU, we will make sure that an adequate level of protection is to be satisfied before the transfer.

When you agree to take part in a research study, the information about your health and care may be provided to researchers running research studies here at UHB and at other organisations. These external organisations may be non-commercial partners such as universities or other hospitals, or commercial companies involved in health and care research in this country or abroad.

Your information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Health and Social Care Research.

UK Policy Framework for Health and Social Care Research (opens in new tab)

If you are also a patient at UHB, please refer to our main patient privacy notice which explains when we might have to share information about you with the Care Quality Commission or other regulatory/law enforcement authorities.

Privacy notice for patients (opens in new tab)

We will retain your personal data only for as long as necessary to fulfil the purposes for which it was collected, as required by law or regulations, or as necessary for legitimate business purposes.

Where we process your personal information for a particular research project, the applicable retention period will be outlined to you as part of the informed consent process or ethical approval (see above).

Following the expiry of the relevant retention period, your personal information will be fully anonymised and archived, or destroyed. Where information is to be destroyed, this will be done in a confidential manner and in accordance with the NHS Record Management Code of Practice. Anonymised archived data may be re-used for scientific or historical research purposes.

Under current data protection legislation (Art 13 to 18 UK GDPR), you have certain rights to manage your data as you see fit. These rights include:

• The right to access and obtain a copy of your personal data
• The right to rectify inaccurate or incomplete personal data
• The right to erasure of your personal data under certain circumstances
• The right to restrict or object to the processing of your personal data
• The right to data portability, where applicable
• The right to withdraw your consent at any time (if consent was the legal basis for processing)

However, for the purpose of research, your rights to access, object, change, transfer and or delete/erase your information are limited. This is because we need to manage the data in specific ways to ensure the research we conduct is reliable and accurate, and that we are accountable to those organisations which fund and monitor our research.

If you withdraw your consent to participate in a research project, we may not remove all of your data. We may keep the information about you that we have already used for a particular research project to ensure research integrity is maintained in the public’s interest and publicly funded research meets is goals. To safeguard your rights, we will strive to use the minimum personally identifiable information possible following your withdrawal of consent.

Where research has been conducted, based on a section 251 of the National Health Service Act 2006, via CAG approval (see “our legal basis for processing personal information about you”), you may have a right to opt-out. The national data opt-out right emanates from the Caldicott principles and entitles you to object to be contacted about new research for which it was not possible to obtain your informed consent, unless this right has been waived by the Secretary of State for Health and Social Care or the Health Research Authority.
National data opt-out programme (opens in new tab)

The Information Commissioner’s Office (ICO) is the body that regulates the Trust under data protection and freedom of information legislation.
ICO website (opens in new tab)

If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to the ICO.
How to make a complaint to the ICO (opens in new tab)

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
Cheshire, SK9 5AF

0303 123 1113

01625 545 745

casework@ico.org.uk

To exercise your rights or for any privacy-related inquiries or complaints, please contact us using the details provided in Section 9.

We take appropriate technical and organisational measures to protect your personal data against unauthorised access, alteration, disclosure, or destruction. We regularly review our security practices to ensure the ongoing confidentiality, integrity, and availability of your information.

If you have any questions, concerns, or requests regarding the processing of your personal data or this Privacy Notice, please contact our Data Protection Officer: information.governance@uhb.nhs.uk

This page is reviewed when necessary and at least annually. Any changes will be published here.