Vivaldi (Covid-19 in Care Homes) study Privacy Notice
Our contact details
Name: UCL Institute of Health Informatics
Address: 222 Euston Road, London NW1 2DA
Telephone: 020 3549 5969
VIVALDI STUDY - Privacy Notice
Summary of initiative/policy
VIVALDI is one of the national surveillance studies that have been commissioned by the Department of Health & Social Care (DHSC) to generate evidence on the burden of COVID-19 infection across healthcare and community settings.
VIVALDI focuses on care homes in England, and is a collaboration between the DHSC, UCL, University of Birmingham, Public Health England (PHE) and the Francis Crick Institute.
The main aims of the study are to measure the proportion of care home staff and residents who have been infected with COVID-19, and to investigate immunity and its duration. The study will also be used to estimate the effectiveness of COVID-19 vaccination in care home staff and residents.
University College London and the Department of Health & Social Care are joint data controllers for this study
What personal data we collect
We are collecting personal data (ethnicity and health data including records of vaccination against COVID-19 and influenza and ethnicity) from staff and residents of care homes participating in the VIVALDI study in England. This includes residents and staff in care homes run by Four Seasons Healthcare, The Orders of St John Care Trust, HC1 and up to 60 independently run care homes.
How we use your data (purposes)
The information we collect will be used to investigate the burden of infection in care home staff and residents, evidence of immunity to infection, effectiveness of vaccination and how infection spreads in the care home setting. Our aim is to use this data to inform the national pandemic response to COVID-19 in care homes, so we can protect staff and residents from current and future waves of infection.
Legal basis for processing personal data
The lawful basis for this work is “legal obligation” under the Coronavirus (COVID-19): notice under regulation 3(4) of the Health Service (Control of Patient Information Regulations) 2002 and “performance of a task carried out in the public interest or in the exercise of official authority vested in the data controller”. The Parties’ condition for processing special category data with regard to GDPR is Article 9(2)(h) “health or social care” as processing is necessary for reasons of substantial public interest to protect care home residents and staff from becoming infected with COVID-19.
Participating care homes are providing identifiable information on all their residents, and for staff who have consented to take part in the VIVALDI study to NHS England. NHS England will also use information collected through the care home testing programme to identify results from staff and residents in care homes that are participating in the VIVALDI study.
NHS England are acting as data processors on behalf of the Department of Health & Social Care and UCL (who are joint data controllers for the study). NHS England will link individual-level records from residents and staff to data on hospital admissions, vaccination history (influenza and COVID-19 only), mortality and COVID-19 test results, creating a detailed record which will allow us to compare outcomes in people who have / have not been infected with or vaccinated against COVID-19. The linked dataset will be pseudo-anonymised to remove direct identifiers such as name, address or date of birth before being transferred to the research team.
Data Processors and other recipients of personal data
The Doctors Laboratory (TDL). TDL will receive blood samples with identifiers attached from staff and residents who consent to participate in the study. Blood samples will be tested for antibodies to COVID-19. TDL will send the test results to NHS England.
The University of Birmingham (UoB). UoB will receive blood samples with identifiers attached from staff and residents who consent to participate in the study. UoB will also receive antibody test results from TDL to inform their testing protocols. They will test blood samples for markers of immunity to COVID-19 and will send their pseudonymised test results (all identifiers removed) to the UCL research team..
NHS England (NHSE). NHSE will receive identifiable data (name, address, date of birth, registered GP, NHS Number) from each participating care home and from each of the laboratories that is testing blood samples as part of the study. They will link this information together and link it to medical records including hospital admissions and cause of death. Once the dataset has been linked they will pseudonymise the dataset by removing names, dates of birth and addresses.
Public Health England (PHE). PHE will process pseudo-anonymised data (names, dates of birth and addresses removed) and receive residual blood samples (after antibody testing has been performed) from TDL. These samples will be used to investigate the immune response following vaccination. Pseudonymised results will be sent to the UCL research team.
The Francis Crick Institute: The Crick will receive residual blood samples (after antibody testing has been performed) and pseudonymised data (names, date of birth and addresses removed) from TDL. They will use these samples to investigate the immune response to COVID-19. Pseudonymised test results will be sent to the UCL research team.
International data transfers and storage location(s)
Anonymised information collected through this project may be shared with researchers in the UK or EU who are undertaking research on COVID-19, subject to appropriate research ethical and information governance approvals. The dataset will be stored in the UCL data safe haven which is housed in the UK.
Retention and disposal policy
Personal information will be stored for 3 years after the end of the study. The anonymised research dataset will be stored for 10 years after the study, in line with UCL policy on data retention.
How we keep your data secure
The linked, pseudo-anonymised dataset will be stored securely in the UCL Data Safe Haven. Secure deletion of data will be undertaken within the UCL Data Safe Haven using a software-based data erasure method.
Your rights as a data subject
By law, data subjects have a number of rights and this processing does not take away or reduce these rights under the EU General Data Protection Regulation (2016/679) and the UK Data Protection Act 2018 applies.
These rights are:
1. The right to get copies of information – individuals have the right to ask for a copy of any information about them that is used.
2. The right to get information corrected – individuals have the right to ask for any information held about them that they think is inaccurate, to be corrected
3. The right to limit how the information is used – individuals have the right to ask for any of the information held about them to be restricted, for example, if they think inaccurate information is being used.
4. The right to object to the information being used – individuals can ask for any information held about them to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.
5. The right to get information deleted – this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.
Comments or complaints
Anyone unhappy or wishing to complain about how personal data is used as part of this programme, should contact DHSC data protection offider in the first instance or write to:
Data Protection Officer
1st Floor North
39 Victoria Street
Alternatively, you can contact the UCL Data Protection Officer.
Anyone who is still not satisfied can complain to the Information Commissioners Office. Their website address is www.ico.org.uk and their postal address is:
Information Commissioner's Office
Automated decision making or profiling
No decision will be made about individuals solely on the basis of automated decision making (where a decision is taken about them using an electronic system without human involvement) which has a significant impact on them.
Changes to this policy
This privacy notice is kept under regular review, and new versions will be available on our privacy notice page on our website. This privacy notice was last updated on 15 March 2021.