Privacy notice for the EpCOT study V4

The data collected is individual level data consisting of patient data from the UK Transplant Registry (UKTR); the Hospital Episode Statistics database for England ((HES) information about hospital care and appointments), the civil registration (mortality) database, and the National Cancer Registration and Analysis Service ((NCRAS), the cancer registry in England) from NHS England (a trusted third party).  The data from the UKTR and NCRAS is linked by NHS England to identify patients who have received an organ transplant and have either been diagnosed with cancer, or not. 

The data is pseudonymised, which means that any information which would enable an individual to be directly identified has been removed and replaced by a unique identifier (a large number). NHS England hold the key for the pseudonymised identifiers.  NHS England will then confirm to the UKTR which patients are matched so that UKTR and NHS England can extract the relevant health data from their datasets.  For patients identified as having an organ transplant and a cancer diagnosis, NCRAS will provide information about each patient’s tumour (such as date of diagnosis, type of tumour and grade) as well as information about the cancer treatment they have received. 

The data from UKTR and NHS England (NCRAS, deaths and HES) will be shared with the University of Birmingham with only a pseudonymised ID and direct patient identifiers removed.  This makes the possibility of linking the data back to an individual employee or their employment records highly unlikely.  The University of Birmingham cannot identify and contact individual members of the cohort. 

The reason for the study is to investigate the long-term health outcomes, including the risk of developing cancer and increased risk in mortality, in patients who have had an organ transplant. The data from UKTR and NHS England (NCRAS, deaths and HES) will enable an analysis of those patients who had a transplant and a diagnosis of cancer, in conjunction with those patients who had a transplant and NO diagnosis of cancer, to understand: 

• the risks of causes of death after a patient has had an organ transplant
• survival after cancer in transplant patients.
• the risks of cancer after a patient has had an organ transplant.
• the risks of other conditions which require a hospital stay in transplant patients both generally, and in those who develop cancer after their transplant.
• the risk of developing cancer after an organ transplant using machine learning (predictions made by artificial intelligence, based on data).

The final research aim is to collaborate with the Standards Committee of the British Transplantation Society, with the goal to develop evidence-based standardised clinical follow-up guidelines based upon the research findings. The results should facilitate more informed risk counselling, provide an evidence-based resource for both healthcare professionals and patients, and support the design of clinical studies to trial tailored immunosuppression medications for solid organ transplant recipients who are considered at high-risk for developing cancer. 

The University of Birmingham considers the legal basis for processing the data is to carry out research in the public interest and processing is necessary for archiving purposes in the public interest, scientific or historical research purposes.  GDPR article 6.1(e): Public task: “the processing is necessary for you to perform a task in the public interest or for your official functions, and the task or function has a clear basis in law”. 

Special Category data (health data) is processed in accordance with article 9.2(j): “processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes. Further details are available under the General Data Protection Regulations (GDPR) article 6.1(e) and 9.2(j), which can be found at: 

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/public-task/ 

https://ico.org.uk/for-organisations/guide-to-the-general-data-protection-regulation-gdpr/lawful-basis-for-processing/special-category-data/ 

Within the University of Birmingham, personal data is shared with only those University staff responsible for the holding and processing of the personal data. All University staff with access to the personal data have undertaken mandatory data protection and information security training. The personal data is stored on file servers located on-site at the University of Birmingham. No cloud storage is used. No data relating to the EpCOT project will be shared outside of England and Wales. 

In line with the Data Protection Act, or any Act which replaces it, and the General Data Protection Regulation, the University of Birmingham will hold the personal data for no longer than is necessary to fulfil the purposes of the project.

In the first instance funding has been secured for this study to continue to 31/12/2026 to complete the objectives of this work proposal. After which if no further funding is available to extend the analysis time period the data will be archived securely at the University of Birmingham for 25 years.

After the archiving timeframe has expired and no funding has been acquired to complete further analysis of the cohort the data will be securely destroyed.