About the NIHR HealthTech Research Centre

Manchester University NHS Foundation Trust (MFT) hosts the NIHR HealthTech Research Centre in Emergency and Acute Care (HRC).

MFT is the Data Controller for the information it collects and records, uses and stores in relation to the HRC.

Purpose of Statement

This is our Privacy Notice which informs you how and why the NIHR HealthTech Research Centre in Emergency and Acute Care processes your personal data.

Legal notification

MFT is registered with the Information Commissioner’s Office (ICO).

Our registration number is ZA282424

If you would like to look at our registration, please go to the Data Protection register on the ICO website or use the link: https://ico.org.uk/esdwebpages/search

We process personal data under the Data Protection Act 2018 (DPA 2018) and the UK General Data Protection Regulation (UK GDPR).

What is personal information?

Personal information is information about an identifiable individual, as defined by the Data Protection Act and UK General Data Protection Regulation.

Collecting personal information

We collect and hold personal information provided by you such as when you:

  • Contact us via email
  • Contact us via an enquiry form
  • Fill out a survey or other form with your personal information included
  • Request us to provide you with information
  • Sign up to a mailing list – The mailing list for the NIHR HealthTech Research Centre in Emergency and Acute Care, which you can subscribe to by following the subscribe link on the web page, is managed through internal databases held on the Manchester University NHS Foundation Trust server. This makes it possible to manage a database of email contacts, phone contacts or any other contact information to communicate with the user.

We may also search the internet for other information about you, or gain this from third parties (e.g. other people who know you), so that we can tailor our communications with you – this may include recording your:

  • Job title
  • Area of interest/expertise
  • Sector (such as HealthTech, pharma, academia or healthcare)

What data we collect and record

We keep records about people who: are interested in working with the HRC; have presented at or attended HRC events; have provided information to the HRC; or are involved in HRC projects.  Details of the information we keep include, but are not limited to:

  • Personal details such as name, job title, employing organisation, sector, address, email and telephone number.
  • Contact we have with you (e.g. information we have provided to you, emails, quotes we have sent you, events you have attended/will attend)

This information will be given to us directly by you or by one of your colleagues (for example, if they are booking you a place on an event) or may be generated by us. The staff who record your information are the HRC team (administrators and managers).

Lawful basis for using (processing) your information

We will only process information relating to you as long as there is a lawful basis, and it is necessary to do so. We may use one of the following lawful bases:

  • Contract – in order to perform our contract with you
  • Legitimate interest – where we need to process your data to share information about the HRC, run projects for the HRC and for the day to day running of the HRC programme other than for the performance of a contract
  • Consent – where you have given us your consent to use your information

Where the above lawful basis is not appropriate, other lawful basis will be used such as consent, and in that case, we will approach you for your consent.  If you have given us your consent to process your personal information, then you can remove your consent at any time by contacting HRC-Emergency@mft.nhs.uk

How is your information used?

Your information is used for providing information to you, and for administrative purposes, which may include (but is not limited to):

  • Recording who has attended, will attend, or may wish to attend a particular event
  • Recording enquiries to us
  • Recording all stages of a proposal to work with the HRC
  • Recording who wishes to be on our mailing list
  • Sending out news and information about the HRC
  • Sending information about a project
  • Sharing opportunities for collaboration, and information about upcoming funding awards or similar, which we deem to be relevant and/or of interest to you

Sometimes, we may need to share information about you with other organisations in relation to the work of the HRC such as:

  • Information requested by our funding organisation, the National Institute for Health and Care Research (NIHR), an arm’s length body of the Department of Health and Social Care
  • Relevant information requested as part of a process for an inspection by the Medicines and Healthcare products Regulatory Agency (MHRA), Health Research Authority (HRA), Care Quality Commission (CQC), or other appropriate governing body overseeing clinical research and delivery of NHS care services
  • Relevant information required by regulators for monitoring and auditing

The information we may provide to them will always meet data protection legislation and we ensure that it is relevant and proportionate for the purpose for which it is being used.

We may also use your data to provide:

  • Anonymised information – where your data is rendered into a form which does not identify you. This data cannot be converted back into identifiable format
  • Pseudonymised information – where your identifying data is replaced with non-identifiable data so that your ‘real world’ identity is removed. This data can only be converted back into identifiable format by an authorised, restricted key-holder

This is done through a strict approval process to ensure it is safe and secure and only used for the purpose of evaluating the HRC programme.

Your rights as a data subject

Under the Data Protection Act and UK General Data Protection Regulation, in certain circumstances, you have the right to:

  • Withdraw your consent to our processing of your personal data where that is the legal basis for such processing
  • Access any of your personal data which we hold
  • Have your personal data which we hold corrected if it is inaccurate
  • Have any of your personal data which we hold erased*
  • Restrict the ways in which we process your personal data
  • Object to our processing of your personal data
  • Receive a copy of any of your personal data which we hold in a structured and commonly used machine-readable format (known as ‘data portability)*
  • In certain cases not be subject to a decision based solely on automated decision making
  • Lodge a complaint with a supervisory authority

*The right to erasure and right to data portability are not applicable when processing on the lawful basis of a public task.

You are not required to pay any charge for exercising your rights. If you make a request, we have one month to respond to you.

Please contact us at HRC-Emergency@mft.nhs.uk if you wish to make a request.

Data breaches

In the event of a data breach, this will be logged on our Incident Reporting system and fully investigated, with remedial action taken where required.  We will report certain types of personal data breach to the Information Commissioner’s Office (ICO).

Retention of data

We keep your data for as long as required and this will be in line with the NHS England Records Management Code of Practice:

https://transform.england.nhs.uk/information-governance/guidance/records-management-code/

How to complain

If you have any concerns about our use of your personal information, you can make a complaint to us at:

The Data Protection Officer

Manchester University NHS Foundation Trust (MFT)

Group Digital

Cobbett House

Oxford Road

Manchester

M13 9WL

Telephone 0161 701 0375

Email: dpo@mft.nhs.uk

 

You can also complain to the ICO if you are unhappy with how we have used your data.

The ICO’s address:

Information Commissioner’s Office

Wycliffe House

Water Lane

Wilmslow

Cheshire

SK9 5AF

Helpline number: 0303 123 1113

ICO website