Equality, Diversity and Inclusion in Health and Care Research pilot project transparency notice

The purpose of the EDI data collection is to understand inclusion, representation and participation in health and care research, identify variation in participation in health and care research, based on demographics, to assess and improve equality, diversity and inclusion in such research, to ultimately improve access to good quality, evidence-based health and care.

Different groups of people respond differently to illnesses and treatments. For example, we know from cancer registration statistics that the 3 most common cancers diagnosed in England vary by gender and age.

Therefore, if research fails to include a broad range of participants, results may not be applicable to the whole population. Only by studying the effects of a treatment on different groups can we fully understand it’s impact.

A pilot project is taking place which will allow the Department of Health and Social Care (DHSC) and the National Institute for Health and Care Research (NIHR) to access aggregated data to better understand EDI in health research studies

The personal information we collect about you includes:

• NHS Number (of people participating in health research)
• Health data implied from research speciality ( participation in cancer trials)

NHS England will match the NHS number collected from the NHS trusts with the NHS number held within its own systems, to obtain the following data about people who have participated in health research:

• postcode
• date of birth
• age range (obtained from date of birth)
• gender (recorded in Patient Demographics Services (PDS) as administrative gender. Provided by the General Register Office and as gender is written on the birth certificate)
• ethnicity data ethnicity data is out of scope for the initial phase of the project. The source and the use of the ethnicity data will be considered in the later stages of the project)

Data collected is aggregated by NHS England, with small numbers suppressed, so you cannot be identified from the data, before it is made available for approved analysts to use.

NHS England will also collect the personal information for named contacts for health and care organisations for the purposes of managing their participation in the EDI Research project, including

• name and surname of research and development director
• email address
• role or job title

NHS England will collect personal information about you from certain health and care organisations in England who hold your information as part of a clinical trial you are involved in. This could be a hospital, your GP or other health or care bodies who are providing services to them.

A list of the health and care organisations who are sharing information with NHS England is published alongside the Data Provision Notice (DPN).

Information regarding contacts for health and care organisations will be supplied to NHS England, both by the Department of Health and Social Care and when the health and care organisations submit named contact information at the point at which they join the EDI Research project.

NHS England has been issued with a legal document, called directions, from the Secretary of State for Health and Social Care, which places a legal obligation on NHS England to collect and analyse your personal information for the EDI research project.

The directions are issued to NHS England under section 254 of the Health and Social Care Act 2012 and are called the Equality, Diversity and Inclusion (EDI) in health and Care Research Pilot Directions 2025 (pilot directions). 

Under the UK General Data Protection Regulation (UK GDPR), NHS England is a joint controller with the Secretary of State for Health and Social Care for deciding to collect and analyse your personal information for the purposes of the EDI research project. NHS England is however the only controller that collects and analyses your personal information.

Under the UK GDPR NHS England must have a legal basis to collect and analyse your personal information under Article 6 and also for data about your health, under Article 9 of UK GDPR. Our legal basis is:

• Article 6(1)(c) – As we have a legal obligation under the Directions to collect your personal information
• Article 9(2)(g) – As there is a substantial public interest in processing your personal information under the Directions. We are also relying on para 6 of Schedule 1 of the Data Protection Act 2018 (DPA) - Statutory and government purposes

NHS England will share anonymous statistical information that has been processed about you for the EDI research project with the Department of Health and Social Care (DHSC) and NIHR.

This statistical information cannot identify you.

The personal information we collect about you will be kept for 5 years following the expiry of the Pilot Directions. This is in accordance with the timescales for this type of information set out in the NHS Records Management Code 2021 and NHS England’s Records Management Policy.

NHS England only stores and processes your personal information for this service within the United Kingdom.

Under data protection law, you have a number of rights including:

• the right to be informed about how your data is being processed
• the right to access what data is held about you
• the right to have inaccurate data rectified
• the right to restrict the processing

You can read more about the health and care information collected by NHS England, and your choices and rights in:

• how we look after your health and care information
• NHS England General Transparency Notice and its associated UK General Data Protection Regulation (GDPR) record of processing entry
• how to make a subject access request

We want you to feel confident that we look after personal data in line with the law. If you have any questions about your rights, you can get in touch with Customer Contact Centre:-

Telephone: 0300 311 22 33 
Email: [email protected] 

The National Data Opt-Out provides an individual with a right to opt out of their confidential patient information being used for purposes beyond their direct care, unless an exemption applies. More information about exemptions is available on the NHS website. 

Health and care organisation are legally required to share information with NHS England therefore the national data opt-out does not apply to the information NHS England collects and analyses.

NHS England will also not be sharing confidential patient information it receives with other organisations and therefore National Data Opt-Out policy does not apply as NHS England.

We take our responsibility to look after your data very seriously. If you have any questions or concerns about how NHS England uses your data, please contact our Data Protection Officer at: [email protected]

If you are not happy with our response, you have the right to make a complaint about how we are using your data to the Information Commissioner’s Office by calling 0303 123 1113 or through their website.

We may make changes to this transparency notice. If we do, the ‘last updated’ date at the top of the notice will also change. Any changes to this notice will apply immediately from the date of any change.