The IBD Registry is closing current activities by Easter 2024, and is in discussions through Spring 2024 about possible transition to an NHS organisation. See our Closure Announcement, Data Transfer Update, Closure FAQs and Achievements. 

Privacy Notice for COVID-19 Follow-On Survey

Privacy Notice Version 1.0 dated April 2021 can be downloaded here

Summary

In April 2020 as a response to the COVID-19 pandemic the IBD Registry designed a web-based tool for people with IBD (i.e. Crohn’s disease, ulcerative colitis or unspecified IBD). Its purpose was to enable people to assess their level of risk relating to COVID-19. This information was also made available to their IBD specialist team.

In addition, the data collected was also intended to:

  • Be made available centrally to NHS England and equivalent bodies in the devolved nations to allow them to better respond to the COVID-19 pandemic;
  • Enable research and/or analysis of the data collected to improve care and treatment for IBD patients with respect in relation to COVID-19; and
  • Be processed for any other COVID-19 Purpose as defined within the ‘COPI Notice’ issued by the Secretary of State for Health and Social Care under Regulation 3(4) of the Health Service Control of Patient Information Regulations 2002 (COPI).

The Privacy Notice for the original COVID-19 web-based tool can be found here

As we enter further phases of the pandemic, and even as the vaccination programmes start to pick up pace in the UK and globally, further challenges remain to protect the health of people with IBD. The prospect of ongoing mutations means that understanding the risk for people with IBD of becoming infected with SARS-CoV-2 remains essential, as does understanding the severity of the resulting outcome. The combination of the unknowns surrounding the interaction of the virus and the disease, and the many public health protection measures that have resulted from these has meant that many people with IBD have faced changes to their medical care and their treatments, as well as to their work and lifestyle.

With this in mind, the IBD Registry has identified that valuable additional information could now be collected from the original COVID-19 IBD Risk Tool participants, via an online survey (the Covid-19 Follow-On Survey), which may be of value to IBD specialist teams. The IBD Registry has also identified this exercise as an opportunity to collect additional data to support analysis and research.

This Privacy Notice is intended to provide those who choose to submit their data via the Covid-19 Follow-On Survey with information about how their personal data will be processed, the purposes for which it will be used, how it will be protected and what rights they will have over their personal data once it has been submitted.

Who we are

The IBD Registry is a company limited by guarantee registered in England under company number 11197749, whose registered address is 3 St Andrews Place, Regent’s Park, London NW1 4LB. Our VAT number is: 291683766 (this is our registered office; see below for our office address)

We are a not-for-profit organisation, funded by three joint members – the Royal College of Physicians (RCP), the British Society of Gastroenterology (BSG) and Crohn’s & Colitis UK.

We act as the Data Controller for the personal data that you submit to us and protect that data in accordance with all relevant laws. We are registered with the Information Commissioner’s Office (ICO). Our ICO Registration Number is: ZA334069

How to Contact Us

Our office address is: Suite 9, Epsom Workhub, Epsom Square, 6-7 Derby Square, EPSOM, Surrey KT19 8AG.

For enquiries related to this tool, please contact us on [email protected]
Our Data Protection Officer can be contacted by email at [email protected] or by post to The DPO at the office address given above.

The purposes of the processing and recipients of personal data

The IBD Registry intends to support the NHS and public health bodies in their ability to respond to the COVID-19 pandemic by ensuring that COVID-19 risk-related details of patients living in the UK with IBD can be collected via a web-based tool and then made available to healthcare professionals to support direct care and elsewhere within the NHS to support the wider COVID-19 response.

This is intended to:

  1. Allow specialist doctors to be able to contact respondents to:
    a. Request additional information from them if this is considered necessary to more accurately inform their risk status or to better understand risk and outcomes;
    b. Inform them of any changes that may be made to advice contained within the risk grid or the tool;
    c. Provide any specific advice based on their risk status or specific needs; and
    d. Support their medical needs in any other way during the COVID-19 outbreak.
  2. Allow information about those respondents living with IBD across the UK to be made available centrally to NHS England and equivalent bodies in the devolved nations to allow them to better respond to the COVID-19 pandemic; and
  3. For any other COVID-19 Purpose as defined within the ‘COPI Notice’*.

The IBD Registry also intends to create a research database containing all of the data submitted by respondents for use in research and analysis to improve care and treatment for IBD patients. This will include data submitted via the original COVID-19 IBD Risk Tool as well as data submitted via the Covid-19 Follow-On Survey which will be linked to provide a more complete and valuable dataset.

The lawful basis for the processing

As the Data Controller, we are required to comply with relevant and appropriate data protection standards and to ensure that we operate within statutory and regulatory boundaries. The Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR) allows health data to be used as long as one of the conditions under both Article 6 and Article 9 are met. Where the personal data is also confidential, a lawful basis under the common law duty if confidentiality must also be met. The processing of health and care data by the IBD Registry is supported by the following lawful bases:

  • Purpose: Sharing of personal data with professionals involved in respondents’ care
  • Lawful Basis (Data Protection Law):
  • Article 6(1)(e) – ‘processing is necessary for the performance of a task carried out in the public interest…’
  • Article 9(2)(h) – ‘processing is necessary for the purposes of…the provision of health or social care or treatment or the management of health or social care systems and services.
  • Lawful Basis (Confidentiality Law): Consent
  • Purpose:  Processing of personal data which enables research and analysis as part of the COVID-19 response, or research which has received independent ethical approval
  • Lawful Basis (Data Protection Law):
  • Article 6(1)(e) – ‘processing is necessary for the performance of a task carried out in the public interest…’
  • Article 9(2)(j) – ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes…’
  • Lawful Basis (Confidentiality Law): Consent
  • Purpose: Processing of personal data by the IBDR which enables analysis, or for research which has received approval via an internal ethical approval process
  • Lawful Basis (Data Protection Law):
  • Article 6(1)(f) – ‘processing is necessary for the purposes of the legitimate interests pursued by the controller…’
  • Article 9(2)(j) – ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes…’
  • Lawful Basis (Confidentiality Law): Consent
  • Purpose: Processing of personal data for a COVID-19 purpose
  • Lawful Basis (Data Protection Law):
  • Article 6(1)(e) – ‘processing is necessary for the performance of a task carried out in the public interest…’
  • Article 9(2)(i) – ‘processing is necessary for reasons of public interest in the area of public health, such as protecting against serious cross-border threats to health…’
  • Lawful Basis (Confidentiality Law): Consent
  • Purpose:  Processing of personal data submitted alongside any feedback provided about the web-based tool
  • Lawful Basis (Data Protection Law):
  • Article 6(1)(f) – ‘processing is necessary for the purposes of the legitimate interests pursued by the controller…’
  • Lawful Basis (Confidentiality Law): N/A

The storage of personal data

All data collected via the Covid-19 Follow-On Survey will be held at AIMES who are an accredited provider of healthcare cloud services based in the UK.

Where data is shared with another recipient the IBD Registry will require the data to be stored in a location which is subject to equivalent security arrangements.

The retention periods for the personal data

Unless you withdraw your consent for your confidential personal data to be used to support research and analysis, the data held within the IBD Registry’s COVID-19 Research Database will be retained indefinitely to ensure it remains a valuable resource to support research and analysis.

Your rights

You have the following rights under the GDPR:

  • The right to be informed about our collection and use of personal data;
  • The right of access to the personal data we hold about you;
  • The right to rectification if any personal data we hold about you is inaccurate or incomplete;
  • In certain circumstances, the right to object to us using your personal data for particular purposes;
  • In certain circumstances, the right to ask us to delete any personal data we hold about you;
  • In certain circumstances, the right to ask us to restrict the processing of the information we hold about you; and
  • Rights with respect to automated decision making and profiling.

Where your data is processed for research and statistical analysis purposes and is subject to appropriate safeguards such as data minimisation the right of access, rectification, restriction and objection do not apply. If you no longer wish for your data to be used for research or statistical analysis the IBD Registry can ensure that your personal data is removed from its COVID-19 Research Database and is not used for any future research or analysis, however it will not be removed from any datasets already processed for research or analysis.

If you wish to find out more about your rights in relation to our use of your personal data, please contact us using the details provided at the top of this Privacy Notice and we will do our best to resolve the problem for you.

If we are unable to help or you are unhappy with our response, you also have the right to lodge a complaint with the UK’s supervisory authority, the Information Commissioner’s Office.

You can find out more here.

For further information about your rights, please contact the Information Commissioner’s Office or your local Citizens Advice office.

* For further information about the COPI Notice and how it applies to data processed by the IBD Registry please see our website.

You can download this Privacy Notice here