Wales LPMS Privacy Notice
Wales Local Portfolio Management System
(LPMS) is used to manage information about health and care research taking
place in Wales. This notice describes how personal information is collected
and processed within Wales LPMS.
Wales LPMS holds personal information about
those involved in the support and delivery of research, including:
·
Researchers
·
Research Support Staff
·
Research Participants
Health and Care Research Wales Support and
Delivery organisations work collaboratively to maintain personal information in
Wales LPMS. Welsh Health Boards and NHS Trusts are responsible (and data
controllers) for maintaining Wales LPMS records for the researchers, support
staff and participants connected with research activity taking place within
their organisation; the Health and Care Research Wales Support and Delivery
Centre, hosted by Powys Teaching Health Board, are responsible (and data
controller) for maintaining Wales LPMS records for research activity taking
place within primary care organisations.
Your rights
Under data protection legislation, you have
the right:
·
to be informed of the personal data we hold
about you and to access it
·
to require us to rectify inaccuracies in that
data
·
to (in certain circumstances) object to or
restrict processing
·
for (in certain circumstances) your data to be
‘erased’
·
to (in certain circumstances) data portability
·
to lodge a complaint with the Information
Commissioner’s Office (ICO) who is our independent regulator for data
protection
What kind of personal information do we
collect?
Names, work email addresses and phone
numbers are collected for Wales LPMS users, researchers and research support
staff. Depending on the needs of the study, the personal information collected
for research participants can include:
·
Name
·
Date of birth
·
Ethnicity
·
Gender
·
Language
·
Address
·
Phone number
·
NHS number
·
Hospital number
Who do we share your personal
information with?
Researcher and research support staff names
and work email addresses are shared with users of Wales LPMS to allow them to
be linked to research studies and activity taking place within each NHS
organisation. Access to the personal information for research participants is
restricted to the clinical Wales LPMS users that directly support research
participant activity who only have access to participant information that is relevant
to their work area; non-clinical Wales LPMS users’ access to research
participant data is restricted to non-identifiable information.
Wales LPMS is developed and hosted on the
ReDA system by Infonetica Ltd. Infonetica may need to access personal
information to provide support in resolving systems issues and is contractually
bound to respect your confidentiality when doing so. Infonetica will not share
personal information outside the team who provide ReDA support.
How do we protect your Personal Data?
We have implemented a variety of security
measures to protect your Personal Data from unauthorised access, use and
disclosure. These follow technical and organisational measures generally
accepted as appropriate security standards in the industry, including access
controls, passwords, encryption, regular security assessments, and the like.
Data will be processed and retained in line with the Records
Management Code of Practice for Health and Social Care 2022.
Lawful basis for processing personal
data
The lawful basis for processing your
personal data under the UK GDPR is Article 6(1)(f) Legitimate Interest for
staff data processed in an employee/employer context, otherwise the lawful
basis for processing your personal data is 6(1)(e) Public Task. For further information
on how your information will be processed, please refer to your Health Board or
Trust full privacy notice. Please contact the appropriate NHS Wales
organisation for queries about your personal information held in Wales LPMS for
secondary care research:
For queries about your personal information
held in Wales LPMS for primary care research please contact research-primarycare@wales.nhs.uk.
For general queries please contact Research-information@wales.nhs.uk.
If the relevant data controller is unable
to resolve your query you have a right to refer the matter to the Information
Commissioners Office. The ICO complaints portal links are: Data
protection complaints | ICO. Bilingual helpline: 0330 414 6421. Bilingual
e-mail queries: wales@ico.org.uk.