BRHS Privacy Notice

BRHS Privacy Notice – Post-Study Use.

Although active follow-up of participants has ended in 2025, the British Regional Heart Study (BRHS) continues to use data and stored samples for approved health research. This privacy notice explains how your information is used and protected.

What data we hold

  • Information collected during your participation, including questionnaires, clinical measurements, and stored biological samples.
  • Linked health records from hospital, national, and imaging datasets (e.g. Hospital Episode Statistics (HES), Mental Health Minimum Dataset (MHMDS), Diagnostic Imaging Dataset (DID) for research on heart disease, dementia, stroke, and related conditions.
  • All direct identifiers (such as names, addresses, NHS number and GP contact details) have been deleted

How your data is used

  • To carry out research that advances understanding of heart health, ageing, dementia, and other chronic diseases.
  • To link historical data with hospital and national datasets for more detailed analyses.
  • To conduct research using stored blood and other samples.

Confidentiality and security

  • Researchers only see your ID number, not your name.
  • Data is stored securely and handled in accordance with UK GDPR and the Data Protection Act 2018.
  • Access is restricted to authorised researchers for approved projects only.

BRHS lawful basis for processing your data

Data is used for scientific research purposes, in line with your original consent and ethical approvals.

The BRHS fulfils the statutory requirements.  Written consent was sought from all participants for their participation in 2003. Through the information materials and consent form the BRHS research team set out to explain the basis of such participation and a summary of the scope to which participant data would be used by the BRHS research team and wider research community.

  • The lawful basis for processing personal data (Article 6.1) e:  Public task: the processing is necessary for the data controller to perform a task in the public interest or for their official functions, and the task or function has a clear basis in law. and GDPR article 10 and Part 1 of the DPA 2018 for sensitive/special category personal data.
  • The legal basis within GDPR and the Data Protection Act 2018 is separate, and in addition to, the permission you gave to take part in the study. Legal basis for processing special category data: (Article 9.2) j: Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes in accordance with Article 89(1) based on Union or Member State law which shall be proportionate to the aim pursued, respect the essence of the right to data protection and provide for suitable and specific measures to safeguard the fundamental rights and the interests of the data subject.

UCL published a statement of tasks in the public interest  in August 2018 which summarises the lawful basis or reason for processing data for research purposes.

Legitimate interest

Legitimate interests are defined in the UK GDPR as “processing which is necessary for the purposes of the legitimate interests pursued by the controller or by a third party, except where such interests are overridden by the interests or fundamental rights and freedoms of the data subject which require protection of personal data.  UCL is the “data controller” and in the UK GDPR ; there is a 3-step test to demonstrate “legitimate interests”. This is set out as a series of questions and answers:

Legitimate interest purpose test: what are BRHS legitimate interests? 

  • What is BRHS trying to achieve? Our objective is to set up and manage a research resource for health-related research that is in the public interest.
  • Who benefits from BRHS processing? Patients and the wider public benefit in efforts to improve risk assessment and prediction of CVD in older adults, to developing novel CVD preventive strategies, to improving the health of older adults and to studying the genetic determinants of CVD and related comorbidity including frailty.
  • How significant/important are these benefits? The BRHS is a rich data resource, including a wide range of morbidity outcomes, phenotypes and a DNA data bank will enable a diverse research program to be undertaken by large consortia and by the wider research community to investigate the aetiology, causes and prevention of CVD and related morbidity in older age. The BRHS study aims to contribute to refinement of clinical guidelines for improved management of CVD in later life.

Legitimate interest necessity test: is the processing necessary for the legitimate interests? 

  • Is processing personal data a reasonable way to achieve the objective? Without the personal data provided voluntarily by BRHS study participants over the last 40+ years this resource would not exist.
  • Is there another less obtrusive way to meet our purposes? The data are stored in a way that makes it is extremely difficult even for the BRHS Research team to re-identify you.  Data provided to researchers have personal identifiers removed so that an individual participant cannot be identified.
  • The active data collection phase has now ended. Direct identifiers have been deleted, and UCL no longer retains participants’ GP contact details.
  • Taking part in the BRHS should not have any adverse effect on you.

Legitimate interest balancing test:  BRHS research team has to weigh up the participant’s interests.

  • Would participants expect the research team to use their data this way? Yes; this is what we set out in the information materials provided to participants and in the study consent form each of them signed.
  • How likely would a participant be to object? This is unlikely. Participants are free to withdraw from the study at any time.

Participant participation

  • Participation was voluntary.

Consent

  • Consent was given to collect, store, and use information for health research, including genetic and blood samples.
  • Where direct contact wasn’t possible, approval from the NHS Health Research Authority’s Confidentiality Advisory Group (CAG) under Section 251 authorized the use of confidential information for research.

Data archiving

  • The BRHS data is archived with UKDS, enabling continued use by researchers under secure and ethical conditions.

The BRHS Privacy Notice has been updated in line with the Data Protection Act 2018 (UK GDPR).

For full details https://www.ucl.ac.uk/legal-services/privacy/ucl-general-privacy-notice-participants-and-researchers-health-and-care-research-studies