VIVALDI Privacy Notice

Updated 27 January 2023

VIVALDI STUDY - Privacy Notice

Our contact details

Name: UCL Institute of Health Informatics

Address: 222 Euston Road, London NW1 2DA

Telephone: 020 3549 5969

Summary of initiative/policy

VIVALDI is one of the national surveillance studies commissioned by the UK Health Security Agency (UKHSA) to generate evidence on the burden of COVID-19 infections across healthcare and community settings.

VIVALDI focuses on care homes in England and is a collaboration between UKHSA and University College London (UCL). Also supporting the study are NHS England, University of Birmingham, the Doctors Laboratory and the Francis Crick Institute.

The main aims of the study are to measure the proportion of care home staff and residents who have been infected with COVID-19, and to investigate immunity and its duration. The study is also being used to estimate the effectiveness of COVID-19 vaccination in care home staff and residents.

About UKHSA and UCL

On 1 October 2021, UKHSA became operational. It combines many of the health protection activities previously undertaken by Public Health England, together with all of the activities of the NHS Test and Trace Programme and the Joint Biosecurity Centre.

UKHSA is responsible for planning, preventing and responding to external health threats, and providing intellectual, scientific and operational leadership at national and local level, as well as internationally. UKHSA will ensure the nation can respond quickly and at greater scale to deal with pandemics and future threats.

The UKHSA general privacy notice provides further information about the personal data the agency collects and uses.

UCL is one of the world’s leading multi-disciplinary universities. It operates in a global context and is committed to excellence, innovation and the promotion of global understanding in all its activities: research, teaching, learning, enterprise and community engagement.

The UCL general privacy notice provides further information about the personal data the University collects and uses.

Data controllers

The Department of Health and Social Care and University College London are the joint data controllers for the study. UKHSA is an executive agency of DHSC, and acts on behalf of DHSC in carrying out its obligation as joint data controller in relation to VIVALDI.

What personal data is collected

VIVALDI is looking at COVID-19 infections in the residents and staff of care homes participating in the study. These include the homes run by Four Seasons Healthcare, The Orders of St John Care Trust, HC One and a further 60 independently run care homes. The personal data collected on the study participants includes:

  • demographic information – such as name, date of birth, sex, ethnic group and the care home in which they live or work
  • health information – including COVID-19 test results, information on hospital admissions and information on deaths
  • treatment information – including COVID-19 vaccination history

How the data is used

The information collected for the VIVALDI study is used for the following purposes:

  • to investigate the burden of COVID-19 infection in care home staff and residents
  • to look for evidence of immunity to infection
  • to understand the effectiveness of vaccination
  • to monitor how infection spreads in care home settings.

The overall aim is to use the study data to inform the national pandemic response to COVID-19 in care homes to help protect staff and residents from current and future waves of infection.

Data on residents and staff from participating homes is collected securely as part of the National Testing Programme. NHS England links the records of the study participants to data on their hospital admissions, COVID-19 vaccination history, COVID-19 test results, antibody test results (for individuals for whom there is consent for serology testing), and mortality records. This linkage allows researchers to monitor COVID-19 infections over time among study participants and undertake a range of analyses which support the pandemic response and improve our knowledge of how to protect care homes from COVID-19.

The linked data is de-personalised by NHS England by replacing name and NHS number with pseudonyms (a non-identifying phrase or number that replaces personal information) and substituting date of birth with age in years, before being sent to the researchers at UCL for analysis. This is to protect people’s confidentiality. Only aggregate data – that is, data for many people combined so that no individual can be identified – is provided to UKHSA.

The results of the analysis of the data are used by UKHSA and UCL to produce reports that are shared with the providers and commissioners of care home services. These reports aim to highlight the levels of infection rates among care home residents and staff, and the effectiveness of vaccination in preventing the spread of infection. No information that could identify any individual is published in these reports.

Legal basis for processing the personal data

The legal basis for DHSC/UKHSA and UCL, as joint data controllers, to direct the collection and use of personal information for the VIVALDI study is provided by the following sections of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018:

  • UK GDPR Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest’
  • UK GDPR Article 9(2)(h) ‘processing is necessary for the provision of health or social care or treatment or the management of health or social care systems and services’
  • UK GDPR Article 9(2)(j) ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes’
  • Data Protection Act Schedule 1 Part 1 (2) ‘health or social care purposes’
  • Data Protection Act Schedule 1 Part 1 (4) ‘research’

UKHSA’s remit from the DHSC to fulfil the statutory duty of the Secretary of State for Health and Social Care to protect public health from disease or other dangers to health means that the parts of the law that provide this authority are section 2A of the NHS Act 2006, as amended by section 11 of the Health and Social Care Act 2012.

For University College London, the University’s Charter and Statutes, which establish the purposes for which it was incorporated and its related powers, provide its lawful basis as a public authority to process personal data for research purposes.

To enable the confidential patient information of residents in some of the participating care homes to be shared by care home managers with NHS England for it to link to other health information, ‘section 251’ approval has been provided by the Secretary of State for Health and Social Care for this to take place without the direct consent of the residents.

The part of the law that applies here is section 251 of the National Health Service Act 2006 and Regulation 5 of the associated Health Service (Control of Patient Information) Regulations 2002. Prior to 30 June 2022, this use of confidential patient information without consent for the VIVALDI study took place under the Notices issued by the Secretary of State for Health and Social Care under Regulation 3(4) of the 2002 Regulations, which enabled the sharing of confidential patient information for purposes supporting the national response to the COVID-19 pandemic, including COVID-19-related research.

The VIVALDI study has been reviewed and approved by the NHS Research Ethics Committee (approval reference 20/SC/0238).

Data processors

DHSC/UKHSA and UCL have appointed a number of other organisations to help support the VIVALDI study. These organisations are data processors acting on instructions. They are not allowed to use the personal information for any purpose other than specified by UKHSA and UCL, they are not allowed to keep the information once their work on VIVALDI has ended, and they must comply with strong data security and protection requirements when processing the information.

The data processors appointed by UKHSA and UCL are:

  1. The Doctors Laboratory (TDL) – receives blood samples from staff and residents who consent to provide this; these samples are tested for COVID-19 antibodies and the results sent to NHS England
  2. University of Birmingham (UoB) – receives blood samples from staff and residents who consent to provide this, as well as antibody test results from TDL, to test blood samples for markers of immunity to COVID-19
  3. NHS England – receives identifiable data (name, address, date of birth, ethnic group, NHS Number) from each participating care home and from the laboratories that are testing blood samples.  NHS England links this information together, and also links it to medical records including hospital admissions and cause of death.  Once the dataset has been linked, NHS England de-personalises the data before sending it to UCL to be analysed
  4. Francis Crick Institute – receives residual blood samples and associated de-personalised data from TDL to investigate the immune response to COVID-19; the results of these investigations are sent to UCL to be analysed

International data transfers and storage location(s)

The study dataset is stored in the UCL data safe haven, which is housed in the UK.

Retention and disposal policy

The personal information collected and used for the purposes of the VIVALDI study will be stored for 3 years after the end of the study. At this period, the data will be anonymised and stored for a further 7 years in line with UCL policy on research data retention.

How we keep the data secure

The personal information collected and used for the VIVALDI study is protected in a range of ways.

The data is stored on computer systems in the UCL data safe haven, which has been independently assessed as meeting the ISO27001 information security standard. These computers are kept up-to-date and regularly tested to make sure they are secure and protected from viruses and hacking, and have security systems equivalent to the NHS.

Personal information can only be seen by staff who have been specially trained to protect confidentiality. Strict controls are in place to make sure they can only see the information they need to do their job, and they are only provided with access to the minimum necessary information.

Whenever possible, information is only used in a form that does not directly identify individuals. No information that could identify any individual will ever be published by UKHSA or UCL.

Your rights as a data subject

By law, data subjects have a number of rights and this processing does not take away or reduce these rights under the UK General Data Protection Regulation and the UK Data Protection Act 2018.

These rights are:

  1. The right to get copies of information – individuals have the right to ask for a copy of any information about them that is used.
  2. The right to get information corrected – individuals have the right to ask for any information held about them that they think is inaccurate, to be corrected
  3. The right to limit how the information is used – individuals have the right to ask for any of the information held about them to be restricted, for example, if they think inaccurate information is being used.
  4. The right to object to the information being used – individuals can ask for any information held about them to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.
  5. The right to get information deleted – this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.

Automated decision making or profiling

No decision about the health care and treatments received by participants in the VIVALDI study is made on the basis of automated decision making (where a decision is taken about them using an electronic system without human involvement) which has a significant impact on them.

Opting out of VIVALDI

Staff and residents of participating care homes are able to opt out of being included in the VIVALDI study by speaking to the care home manager.

Additionally, any staff or residents of participating care homes who have opted out of their confidential patient information being used for research and planning purposes through the NHS national data opt out process will not be included in VIVALDI.

Information on the NHS opt-out and how to register your choice can be found at www.nhs.uk/your-nhs-data-matters. On this web page you will:

  • see what is meant by confidential patient information
  • find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
  • find out more about the benefits of sharing data
  • understand more about who uses the data
  • find out how your data is protected
  • be able to access the system to view, set or change your opt-out setting
  • see the situations where the opt-out will not apply

How to find out more or raise a concern

If you are a participant in the VIVALDI study and wish to exercise any of your rights as a data subject, or if have any concerns about how VIVALDI is using and protecting personal information, you can contact the UCL Data Protection Officer at data-protection@ucl.ac.uk or by calling 020 7679 7338.

You also have the right to contact the Information Commissioner’s Office if you have any concerns about how DHSC/UKHSA or UCL use and protect personal information. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO’s website at www.ico.org.uk or writing to the ICO at:

Information Commissioner's Office

Wycliffe House

Water Lane

Wilmslow

SK9 5AF

Changes to this policy

This privacy notice is kept under regular review, and new versions will be available on our privacy notice page on our website. This privacy notice was last updated on 27 January 2023.