Type of Personal Data Collected

The information we collect may include but is not limited to:

• Patients’ details: year of birth, sex, practice registration date, practice de-registration date, ethnicity, Address, Postcode, Telephone and Mobile number
• Morbidity data: symptoms, diagnoses with dates, referrals to hospitals
• Prescribed medication: all prescriptions with date issued, drug name, formulation, strength, quantity, dosing instructions
• Immunisations: all in-practice immunisations
• Lab tests and other health data: smoking status, height, weight, blood pressures, pregnancy, birth, death

Data is collected by the practice in an Electronic Medical Record system (EMR).

The identifiable data are routinely (weekly) collected from GP practices’ EMR who agree to participate in the collection schemes.

Once data is in IQVIA secure location, the data extract files have direct identifiers removed and held in a secure location in IQVIA.

Data is located in restricted access, secure IQVIA-hosted servers in the UK.

Data collection is performed via secure web transmission methods (encrypted).

Purposes of Collection

The overall goal is to create a near-real-time database of primary care records which can provide mutual benefits to primary care partners, patients, Interface and IQVIA.

The expected benefits to primary care partners and/or patients include but are not limited to the following examples:

• Improvements to Quality Outcome Framework (QOF) reimbursement and care management, including an increase in QOF point value for reimbursement
• Correctly coding patients to ensure they are in the correct disease registry
• Ensuring optimal treatment once the patient is registered correctly
• Prioritising patients for review
• Improved management and understanding of patients with existing Long Term Conditions (LTC’s)
• Early detection of undiagnosed and at-risk patients
• Opportunity to shape the disease areas to work in
• Deployment of algorithms to find patients currently undiagnosed or at risk of a medical event
• Chance to identify patients suitable to participate in clinical trials and research
• Increased opportunity to participate in clinical trials
• Support data needs such as retrospective research on behalf of the NHS

In particular, the following benefits related to the use cases are expected:

1. Code Cleansing: Accurate disease registers ensure patients are recalled appropriately for review and supports reimbursement for activity undertaken. This would lead to improved patient outcomes and improved practice capacity and demand planning.
2. Case finding: Earlier diagnosis of patients prevents downstream avoidable disease progression, complications and unplanned events. For example, finding patients to avoid disease progression and the risk of transmitting the disease to others.
3. Clinical Trials: Simplified process supporting clinician awareness of patients eligible for trial(s); streamlining of clinical trials process for practices who are already research active; easier onboarding to trials for practices wishing to participate

Some projects may require linking this data with other sources including, but not limited to, specialist/hospital data, test results, ONS (Office of National Statistics), population data, etc.

Legal Basis for Processing Data

Any personal data about you is processed on behalf of the GP practices under the following legal basis:

• Article 6(1)(e) of the GDPR - Condition of Processing: Official authority
• Article 9(2)(h) of the GDPR - Condition for Processing: Health and social care

Article 6(1)(e) of the GDPR - Condition of Processing: Official authority

The UK Data Protection regulations (GDPR) details lawfulness for processing data. To confirm the correct lawfulness, the Information Commissioners Office (ICO) provides a tool designed to support the correct classification applicable to the processing purpose. The tool involves answering a series of questions the result being that IHAN falls within Article 6 (1) (e) “processing for the legitimate interests pursued by the controller or by a third party”.

Article 9(2)(h) of the GDPR - Condition for Processing: Health and social care

Processing of Special Categories of Personal Data – This includes data concerning health. Processing of this data is only allowed if certain criteria apply. For IHAN the relevant clause would be Article 9 (2) (h) “processing is necessary for the purposes of preventive or occupational medicine, for the assessment of the working capacity of the employee, medical diagnosis, the provision of health or social care or treatment or the management of health or social care systems and services pursuant to contract with a health professional.

Your Rights

Interface (an IQVIA business) does not have an existing relationship with the patients.

Each GP practice informs you (via posters and information leaflets) that it is participating in a data collection scheme. The posters explain that you can withdraw your consent to your data being collected in this way without this affecting the level of care they receive.

You can opt out by notifying your practice. Type 1 opt outs are recorded as such by your practice and allow you to be no longer included in data collection going forward.

National Data Opt-out will allow you to opt out of their confidential patient information being used for secondary purposes, which includes anything that is not direct care (e.g. research).

You have the option to opt-out of your data being used for secondary purposes by registering a National Data Opt-Out with NHS Digital.

For details on the National Data opt out scheme, please see these links:

https://www.nhs.uk/your-nhs-data-matters/

https://digital.nhs.uk/services/national-data-opt-out-programme

Where we process personal data on behalf of the GP practices, we have considered whether we and GP practices have legitimate interests in processing your personal data, what the impact of this processing is and legitimate interests. These rights may be limited in some situations – for example, where we can demonstrate that we have a legal requirement to process your data. In some instances, this may mean that we are able to retain data even if you withdraw your consent. We hope that we can satisfy queries you may have about the way we process your data. You can contact our Data Protection Officer at dpo@interface-cs.co.uk.

If you have unresolved concerns, you also have the right to complain to data protection authorities.

Data Retention

As Sub-Processor IQVIA holds the data and related material in accordance with the GP practice, we aim to retain the data for the duration of the agreement with the Practice and then for 1 year after the end of the agreement.

Changes to this Notice

We may update this notice from time to time. We encourage you to review this notice periodically to stay informed about how we are using and protecting information. Any changes to this notice take effect immediately after being posted or otherwise provided by us.

About IQVIA

IQVIA Ltd is part of the IQVIA Inc. group of companies serving the combined industries of health information technologies and clinical research worldwide. We specialise in the provision of products and services including medical research and analytical solutions to healthcare and life sciences organisations. In the UK, IQVIA has collected and supported the research use of non-identified patient data for over 20 years.

We are registered in England and Wales as: IQVIA Ltd, registration number 03022416 and our registered office is 3 Forbury Place, 23 Forbury Road, Reading, United Kingdom, RG1 3JH.

Interface Clinical Services Ltd (Interface) is a recent acquisition of IQVIA.