NHS DigiTrials Service Transparency Notice

NHS Digital is enhancing its support for health and life sciences research by developing a service called NHS DigiTrials. This service will help clinical trials progress more easily at every stage, using the data that NHS Digital already collects from health and care organisations across England.

The NHS DigiTrials service will:

• increase opportunities for the widest possible group of individuals to participate in vital clinical research to address large scale public health risks
• improve the diversity of research cohorts, so that those who are offered the opportunity take part in research become more representative of the population
• support faster participant recruitment to trials to find answers to important clinical questions more rapidly
• reduce the cost of running clinical trials and other important research - this will provide particular benefit for publicly funded studies such as those which have run during the COVID-19 global pandemic
• support a thriving UK life sciences research sector by reducing the costs of running trials and attracting more research to the UK
• ultimately improve NHS services and access to evidence-based diagnostics, vaccines and treatments for the wider population

The NHS DigiTrials service aims to do this by providing relevant data held by NHS Digital in a timely manner to healthcare research studies (including clinical trials) within the bounds of robust governance, including data protection requirements and information security.

Each specific element of the NHS DigiTrials service will process the data that NHS Digital holds in different ways:

Feasibility service

Fully anonymised and aggregate data will be processed to improve the assessment of clinical trial feasibility – supporting improved planning and locating of clinical trials in the UK.

Recruitment support (identification) services

Identifiable patient data will be processed for approved¹ research.  The aim of this service is to deploy data analysis and linkage to provide data to research projects in the form of lists of potential research participants who meet the inclusion criteria for the purposes of inviting them to join a trial.

There is an 18-month pilot of this service starting in August 2021, with a maximum of 4 large scale trials. These four trials will focus on research into the early diagnosis and treatment of conditions with a significant health burden including cancer, cardiovascular disease and diabetes.

Communication services

We have received feedback from patients that they would like to hear about the results of the trials they took part in. This service will process the identifiable patient data of participants who have consented to receive such information so that those participants can be provided with ongoing information about the trial.

Outcomes services

Identifiable patient data will be processed to support research teams’ information about the impact of an intervention or to support the long term follow up of research participants who have consented to be part of a trial or for other approved research.

Read more about NHS DigiTrials.

The types of personal data that will be processed will be dependent upon the nature of the trial and be specific to the needs of the trial.   However, to identify people who are to be invited to take part in a trial and to update participants about the trial they are already enrolled on or for follow up analysis, we will likely need:

• demographic data – patient name, date of birth, sex, NHS number and contact details such as address, telephone numbers and email address
• health information – information relating to the health and care patients have been provided - this may include information about medical conditions (in the form of condition codes held in central NHS records)

Under the UK General Data Protection Regulation 2018 (UK GDPR), NHS Digital is the controller of personal data where we are directed or requested to process this for NHS DigiTrials purposes. We are a joint controller with the person who has directed or requested us to do this work.

Where we share data, NHS Digital is usually the sole controller, unless we have been directed to share the data by the Secretary of State or NHS England, in which case we will be joint controllers.

The trial organisation is the controller for the data they collect directly from the participants that they have enrolled in the research study or clinical trial.

Where NHS Digital has been directed to process personal data, this is a legal obligation, and we are allowed to do this under Article 6 (1)(c) of UK GPDR. NHS Digital has been directed to analyse and link personal data under the Pilot NHS DigiTrials Recruitment Support Services Directions 2021.

Where we process personal data as part of our statutory functions, this is part of our public task. We are allowed to do this under Article 6(1)(e) of UK GDPR.

Where we need to process health data and other special categories of personal data, we will only do this where it is necessary as part of our statutory functions. Under UK GPDR we are allowed to do this where it is necessary for scientific research or statistical purposes under Article 9(2)(j) – processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; plus Part 1, Sched 1 Data Protection Act 2018, para 4 research.

Where we process data on behalf of the clinical trial customer, such as to communicate with participants on behalf of the trial, we will do so in our role as data processor. These participants will be a consented research cohort.

Where the consent obtained from the research cohort is inadequate for the additional NHS DigiTrials services being sought by the research team, we will ensure that an alternative legal basis is in place, such as section 251, for us to process the participants data on behalf of the trial.

NHS Digital will share personal data with approved researchers outside NHS Digital (subject to a rigorous governance process), including for the purposes of carrying out clinical trials (for example, to invite you to join a trial).

We will only share data with other organisations where this is lawful and in line with data protection law.

Data will be shared with the clinical research teams as part of the service that we offer to our customers: recruitment support, communications or outcomes (follow up) activity. Our feasibility service does not provide any identifiable data to researchers.

As outlined above the NHS DigiTrials service uses the NHS Digital Access Request Service (DARS) to deliver its four clinical trial services. The information about why and how we process data to deliver NHS DigiTrials services can be found at Data Access Request Service (DARS) online: GDPR information - NHS Digital.

In some situations, NHS Digital will write to consented patients on behalf of the trial (acting as a ‘Processor’ on behalf of the trial). This will be to invite patients to participate in the trial or share information about a trial that patients have already enrolled in and consented to receive such communications.

Data shall be retained for no longer than 20 years in accordance with the NHS Records Management Code of Practice 2021.

Other organisations with whom we share your personal data have obligations to keep it for no longer than is necessary for the purposes for which we have shared your personal data. Information about this will be provided in their transparency or privacy notices which are published on their websites.

NHS Digital only stores and processes personal data for this service within the United Kingdom. Clinical trial customers that we share your data with will only share the data for limited and specific purposes. Typically, for clinical trials, this sharing will be for audit or regulatory purposes with the trial sponsor organisation or with regulatory bodies (such as the MHRA in the UK, EMEA in Europe or the FDA in the USA) as part of the medicines licensing process.

Fully anonymous data, for example, statistical data (which does not allow you to be identified), may be stored and processed outside of the UK.

To read more about the health and care information NHS Digital collects, our legal basis for collecting this information and what choices and rights you have, see how we look after your health and care information, and our NHS Digital transparency notice.

We may make changes to this transparency notice. If we do, the ‘last updated’ date at the top of the notice will also change. Any changes to this notice will apply immediately from the date of any change.