West Midlands Research Collaborative Health Informatics Haematology Database (WMRC database)

The WMRC database is split into two parts. The first part involves hospitals using identifiable data already available on the hospital patient records to pseudoanonymise and then input data into a separate database housed at RWT.

The second part is where the data held on the database will be extracted, made completely anonymous and will be utilised for research projects that are scrutinised by the WMRC.

We will collect, store and use the following categories of information about you:

At hospital level only:

• Date of birth
• Postcode
• NHS number

This data will be reviewed upon entry into the database to establish data opt-out requests, to merge datasets from the data partners, and obtain age and deprivation scoring.

At WMRC database level:

The data will then be stripped of NHS number, date of birth, postcode, and the identifier replaced with a research code and will be stored in the WMRC database. We will also collect, store and use the following categories of information about you:

• Gender

We may also collect, store and use the following “special categories” of more sensitive personal information:

• Information about ethnicity
• Information about health and clinical course including treatment, diagnosis and outcomes
• Physical and mental health

The data is stored on encrypted computers and network drives, and any hard records are stored safely in a lockable cabinet on hospital premises.

The ethical approval for the database is 23/SC/0174 and logged through IRAS application number 306020. The project has also been reviewed and signed off by the RWT Caldicott Guardian for RWT.

The legal basis which allows us to process your personal data is GDPR Article 6 (1)(e) ‘processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller’.

And GDPR Article 9 (2) (j) ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89 (1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.’

Only anonymised information is shared with external researchers/companies for the purposes of research projects that are scrutinised by the WMRC.

No personal data will be shared with or transferred to any third parties. Personal data provided to the research team for the research database will not be transferred to other countries.

We identify patients from NHS health records stored on the Haematology Unit, and the data is collected and transferred onto the database by a member of the clinical team. Information will not be obtained if you have indicated to opt out of such projects.

We are not using automated decision-making, including profiling (using computer algorithms to make decisions on individuals without human intervention) for this project.

Below is a list of the rights you have in relation to your data and when they apply. To make an application for any of the below rights, please contact the Data Protection Team by emailing rwh-tr.dataprotectionteam@nhs.net in the first instance. All rights should be considered within 30 calendar days from date of receipt, but may be extended if complex.

You have the right to request a copy of any information held by the Trust as well as any supplementary information. See ‘How do I request my information?’ for details on how to request this.

Request correction of the personal information that we hold about the subject. This enables the subject to have any incomplete or inaccurate information we hold about corrected.

Request erasure of the subject’s personal information. This enables them to ask us to delete or remove personal information where there is no good reason for us continuing to process it. They also have the right to ask us to delete or remove personal information where the subject has exercised the right to object to processing (see below).

Object to processing of personal information where we are relying on a legitimate interest and there is something about a particular situation which makes the subject want to object to processing on this ground.

Request the restriction of processing of personal information. This enables the subject to ask us to suspend the processing of personal information about the subject, for example to establish its accuracy or the reason for processing it.

All our records are destroyed in accordance with the NHS Retention Schedule, which sets out the appropriate length of time each type of NHS records is retained. We do not keep your records for longer than necessary. All records are destroyed confidentially once their retention period has been met, and the Trust has made the decision that the records are no longer required. For more information please see the Record Management Code for Practice for Health and Social Care 2016, retention schedules.

You have a right to see or have copies of any information held by the Trust that relates to you free of charge. We have the right to charge an administration fee in situations where repeated requests are received for the same information or the request is excessive. You will be required to prove your identity when making requests.

Subject Access Requests must be processed within 30 days of receipt of your request. However, once our team has established the complexity of the request there may be a requirement to extend this up to 90 days. We will contact you within 30 days should this be the case.

To request access to health records please complete a Subject Access Request form, and send to:

Health Records Access Team
Health Records Library (Location B19)
New Cross Hospital
Wolverhampton Road
Wolverhampton
WV10 0QP

Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 ext. 5544/5545 or 8093

To request access to your data held on the WMRC database please contact the sponsor:

Sarah Glover, R&D Directorate Manager
Research & Development Directorate
New Cross Hospital
Wolverhampton Road
Wolverhampton
WV10 0QP

Email: sarah.glover7@nhs.net
Telephone: 01902 307999 Ext. 5065

If you have any concerns, or wish to make a complaint about your care, please speak to a health professional involved in your care in the first instance. If your concern is not resolved to your satisfaction please contact the Patient Advice and Liaison Service (PALS).

Data Protection Officer (DPO)
New Cross Hospital, Wolverhampton Road, Heath Town, Wolverhampton WV10 0QP
Email rwh-tr.IG-Enquiries@nhs.net or Telephone: 01902 307999 ext. 88124

The DPO is a point of contact for advice and guidance in relation to your rights.

That person is responsible for monitoring the Trust’s compliance with the Data Protection Act 2018 and the General Data Protection Regulations (GDPR) 2016 as any policies the organisation has in relation to the protection of personal data.

The DPO shall perform their duties in an independent manner with due regard to the risk associated with processing operations, taking into account the nature, scope, context and purposes of processing.

If you have any concerns about how your information is being processed or any of the rights as detailed above, please contact the Trust in the first instance through:

Health Records Access Team
Health Records Library (Location B19)
New Cross Hospital
Wolverhampton Road
Wolverhampton
WV10 0QP

Email: rwh-tr.healthrecordsaccess@nhs.net
Telephone: 01902 307999 Extension 85544/85545/88093

You also have a right to complain directly to the Information Commissioner’s Office if you feel the Trust has not responded effectively to any of the above.

Information Commissioner’s Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Telephone: 0303 123 1113
Website: Information Commissioner’s Office