Privacy Notice for COVID-19 IBD Risk Tool

How your data from using this Tool may be handled


This tool is provided by the IBD Registry. It has been designed in response to the COVID-19 pandemic to support the doctors treating you in hospital to identify high-risk patients with inflammatory bowel disease (IBD), to assist the British Society of Gastroenterology (BSG) and Crohn’s & Colitis UK with their wider messaging strategy for patients, and to enable further communication with patients related to COVID-19 and IBD if required.

We recommend that all patients with inflammatory bowel disease (IBD) follow the government’s recommendations on social distancing and staying at home.
Further information on IBD and COVID-19 is available from Crohn’s & Colitis UK

Who we are

The IBD Registry is a company limited by guarantee registered in England under company number 11197749, whose registered address is 3 St Andrews Place, Regent’s Park, London NW1 4LB. Our VAT number is: 291683766 (this is our registered office; see below for our office address)

We are a not-for-profit organisation, wholly owned by three joint members – the Royal College of Physicians (RCP), the British Society of Gastroenterology (BSG) and Crohn’s & Colitis UK.

We act as the Data Controller for the personal data that you submit to us and protect that data in accordance with all relevant laws. We are registered with the ICO (Information Commissioner’s Office). Our ICO Registration Number is: ZA334069

How to contact us

Our office address is: Suite 9, Epsom Workhub, Epsom Square, 6-7 Derby Square, EPSOM, Surrey KT19 8AG. For enquiries related to this tool, please contact us on

Our Data Protection Officer can be contacted by email at or by post to The DPO at the office address given above.

The purposes of the processing and recipients of personal data

 The NHS has been giving particular thought to the approximately 500,000 people living with IBD across the UK during the COVID-19 pandemic and the extra steps that can be taken to keep you well.

The doctors and nurses providing specialist hospital care for IBD have been asked to directly contact any patients identified as being at particular risk from COVID-19 to let them know, using a standard letter containing the information that they need to commence shielding and access support. Hospital specialists have also been asked to inform relevant GPs of the decision to include patients in the vulnerable group.

To support this, the BSG have been working with the RCP, other societies and the Chief Medical Officer for England to assist in the identification of patients considered to be at high risk, and to support hospital specialists in this exercise. Consultant gastroenterologists (the specialist senior doctors for IBD) from hospitals providing IBD treatment across the UK have formed a working group to draw up the BSG’s risk assessment to address the Government’s mandate.

This consists of three levels of risk:
• Higher risk: these patients are instructed to following ‘shielding’ guidance
• Moderate risk: possible increased risk from COVID-19, to follow enhanced social distancing
• Lower risk: as background population

The risk grid is now in the public domain. Crohn’s & Colitis UK and the BSG executive have been working closely together to develop a clear messaging strategy for patients. There have been long discussions about how best to identify those patients in the higher risk category.

The IBD Registry have agreed to support both specialist doctors in the identification of high-risk patients, and CCUK and the BSG with their wider messaging strategy for patients, through the UK COVID-19 IBD Tool (Crohn’s, Colitis and IBD-U). It is designed to:

1. Collect relevant information from respondents who are living with IBD across the UK to be able to quickly and easily determine the level of risk based on the risk assessment released by the BSG;

2. Allow respondents to enter their personal data and details of the hospitals, specialist doctors and the GPs that care for them so that the responses can be shared with:
a. The specialist doctors that currently care for them within hospitals and NHS Trusts; and
b. Their GP Practice.
This will ensure that both sets of medical professionals have the most up to date information about their patients’ condition and treatment which is relevant to their risk status during this COVID-19 response period;

3. Allow the specialist doctors and the GPs to be able to contact respondents to:
a. Request additional information from them if this is considered necessary to more accurately inform their risk status or to better understand risk and outcomes;
b. Inform them of any changes that may be made to advice contained within the risk grid or the tool;
c. Provide any specific advice based on their risk status or specific needs; and
d. Support their medical needs in any other way during the COVID-19 outbreak.

4. Allow information about those respondents living with IBD across the UK to be shared centrally with NHS England and equivalent bodies in the devolved nations to allow them to better respond to the COVID-19 pandemic;

5. Enable research and/or analysis of the data collected to improve care and treatment for IBD patients with respect in relation to COVID-19; and

6. For any other COVID-19 Purpose as defined within the ‘COPI Notice’ (see below).

The lawful basis for the processing

On 20 March 2020 the Secretary of State for Health and Social Care issued a ‘Notice’ under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 (COPI). This ‘COPI Notice’ requires organisations to process confidential patient information to support the Secretary of State’s response to COVID-19.

A COVID-19 Purpose includes but is not limited to:

• understanding COVID-19 and risks to public health, trends in COVID-19 and such risks, and controlling and preventing the spread of COVID-19 and such risks;
• identifying and understanding information about patients or potential patients with or at risk of COVID-19, information about incidents of patient exposure to COVID-19 and the management of patients with or at risk of COVID-19 including: locating, contacting, screening, flagging and monitoring such patients and collecting information about and providing services in relation to testing, diagnosis, self-isolation, fitness to work, treatment, medical and social interventions and recovery from COVID-19;
• understanding information about patient access to health services and adult social care services and the need for wider care of patients and vulnerable groups as a direct or indirect result of COVID-19, and the availability and capacity of those services or that care;
• monitoring and managing the response to COVID-19 by health and social care bodies and the Government including providing information to the public about COVID-19 and its effectiveness and information about capacity, medicines, equipment, supplies, services and the workforce within the health services and adult social care services;
• delivering services to patients, clinicians, the health services and adult social care services, workforce and the public about and in connection with COVID-19, including the provision of information, fit notes and the provision of health care and adult social care services; and,
• research and planning in relation to COVID-19.

This allows us to process and share confidential information about you for a COVID-19 Purpose. All use of information will be limited to that which is necessary for the particular purpose and as far as is reasonably practical individual identifiers will be removed to the extent that they are not required for the purpose.

As the Data Controller, we are still required to comply with relevant and appropriate data protection standards and to ensure within reason that we operate within statutory and regulatory boundaries. The General Data Protection Regulation (GDPR) allows health data to be used as long as one of the conditions under both Article 6 and Article 9 are met. There are conditions under both Articles that can be relied on for the sharing of health and care data:

For all processing:

Article 6(1)(e) – ‘processing is necessary for the performance of a task carried out in the public interest…’
For sharing special categories of personal data with professionals involved in your care:
Article 9(2)(h) – ‘processing is necessary for the purposes of…the provision of health or social care or treatment or the management of health or social care systems and services.
For sharing special categories of personal data with other recipients involved in the COVID-19 response:
Article 9(2)(i) – ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health…’
For research involving special categories of personal data as part of the COVID-19 response:
Article 9(2)(j) – ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes…’

Automated decision-making

The data collected will be used to automatically generate your risk score based on the BSG’s risk assessment. Where the level of risk identified is ‘higher risk’ details may be automatically shared centrally with NHS England and equivalent bodies in the devolved nations to allow them to better respond to the COVID-19 pandemic. This automated decision-making is considered to be for reasons of substantial public interest.

The storage of personal data

All data collected via the UK COVID-19 IBD Tool (Crohn’s, Colitis and IBD-U) will be held at AIMES who are an accredited provider of healthcare cloud services based in the UK.

The UK COVID-19 IBD Tool (Crohn’s, Colitis and IBD-U) is operated and maintained separately to the IBD Registry’s main IBD Registry dataset.

The retention periods for the personal data

The ‘COPI Notice’ which supports the processing of confidential personal data is time limited and is currently due to be reviewed on or before 30 September 2020. It may be extended further by notice in writing by the Secretary of State for Health and Social Care. Personal data will be processed for the duration of the ‘COPI Notice’ at which point it will be securely destroyed by the IBD Registry and any recipients who have received this data on the basis of the ‘COPI Notice’, unless they can identify an alternative legal basis to support their continued retention or processing of the data.

For example, your specialist or GP Practice may include the confidential data you supply in the clinical records they hold about you for the purposes of continuing to provide you with direct care. For information about how your specialist or GP Practice process your personal confidential data, you should refer to their Privacy Notice.

Any data retained by the IBD Registry beyond the expiry of the ‘COPI Notice’, for example to support research into the impact of COVID-19 on patients with IBD, will be anonymised. This will ensure individuals can no longer be identified.

Your rights

You have the following rights under the GDPR, which this Privacy Notice and our use of personal data have been designed to uphold:

• The right to be informed about our collection and use of personal data;
• The right of access to the personal data we hold about you;
• The right to rectification if any personal data we hold about you is inaccurate or incomplete;
• In certain circumstances, the right to object to us using your personal data for particular purposes;
• In certain circumstances, the right to ask us to delete any personal data we hold about you;
• In certain circumstances, the right to ask us to restrict the processing of the information we hold about you; and
• Rights with respect to automated decision making and profiling.
If you wish to find out more about your rights in relation to our use of your personal data, please contact us using the details provided at the top of this Privacy Notice and we will do our best to resolve the problem for you.

If we are unable to help or you are unhappy with our response, you also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.  You can find out more here.

For further information about your rights, please contact the Information Commissioner’s Office or your local Citizens Advice office.

Download this Privacy Notice

This COVID-19 IBD Risk Tool Privacy Notice can be downloaded. (select this link to start the download as a pdf file)


IBD Registry Ltd is a not-for-profit company limited by guarantee - Company Number 11197749.