Guidance

Vivaldi Adult Social Care: privacy notice (active)

Updated 26 September 2024

Applies to England

Summary of initiative and policy

The Vivaldi Social Care study will collect and link limited data on care home residents to improve our understanding of the burden of infection, outbreaks and antimicrobial resistance (AMR) in this vulnerable population. We will work with people who live and work in care homes to decide the most important things to measure, and our findings will be used to find new ways to better protect residents from infections without compromising their quality of life. The study will also establish a fully anonymised research database that can be used by approved researchers to find new ways to reduce infections and their impact. The study has been commissioned by the UK Health Security Agency (UKHSA).

Vivaldi focuses on care homes for older adults in England and is a collaboration between the Outstanding Society (OS), Care England and University College London (UCL). Also supporting the study are NHS England (NHSE), UK Health Security Agency (UKHSA), Quantaim Ltd, the National Institute of Health and Care Research (NIHR), and software vendors (Nourish Care Systems Ltd, Person Centred Software Ltd and Camascope) who supply electronic care records to those care homes involved in the study.

About the OS, Care England and UCL

The OS is a community interest company that aims to support other care providers to deliver outstanding care and to achieve/maintain “Outstanding” Care Quality Commission (CQC) inspection ratings.

Care England is a registered charity which represents small, medium, and large care providers in England and advocates for appropriate resources and policies that will allow Providers to continue to deliver and develop high quality care.

UCL is one of the world’s leading multi-disciplinary universities. It operates in a global context and is committed to excellence, innovation, and the promotion of global understanding in all its activities: research, teaching, learning, enterprise and community engagement.

Data controllers

The OS, Care England and UCL are the joint data controllers for data generated through the study, however UCL is acting as the lead data controller on behalf of the other two organisations. This document explains how we, as joint data controllers, process personal data in connection with this study.

What personal data is collected

The Vivaldi Social Care study is only taking place in care homes that use digital social care records. A range of care providers are taking part. There are 5 stages in the data collection process:

1. The study will collect NHS numbers for all residents in participating care homes from their digital care records, unless residents have opted out of the study.
2. NHS numbers for residents in participating homes will be sent by the software vendors (on behalf of the relevant care homes) to NHS England.
3. NHS England will switch (de-personalise) each resident’s NHS number by replacing it with a pseudonym (a non-identifying phrase or number that replaces personal information) and substituting date of birth with age in years. This means the record no longer identifies the resident and protect people’s confidentiality.
4. The new codes will be used by a software engineer employed by Quantaim Ltd to link to other datasets that are already held by the NHS within the secure NHSE data environment.
5. The de-personalised final linked dataset will be shared with UCL and UKHSA who will use it in analyses and to report trends in infection in the form of reports and dashboards.

Personal data collected through the study will include:

• demographic information – age, sex, ethnic group, and the care home in which they live
• health information – including infection test results, information on hospital admissions such as dates and diagnoses
• information on cause of death
• information about some medical treatments such as vaccinations and antimicrobial prescriptions issued in the community (not in hospital)

Individual level data that has been de-personalised (all names, dates of birth removed) will be shared by NHSE with UCL and used to create a research database. Quantaim Limited are a data consultancy company that will act under instructions from the joint data controllers to link these de-personalised data to other datasets to create the final research database. Researchers from the UK can then apply to access this database to undertake studies that have been approved by the study oversight committee which includes people who live and work in care homes. UKHSA will also use the research database to create dashboards that will be shared with care providers and policymakers. Importantly, we will not be accessing any detailed information about residents’ symptoms or receive any ‘free text’. All the information is stored as numbers or codes consisting of letters and/or numbers.

How the data is used

The information collected for the Vivaldi Social Care study will be used in 2 main ways:

1. To create reports and dashboards describing the burden of infection, AMR and outbreaks in care homes which will be shared with care providers and policymakers. This information will be used to inform targeted strategies, policies or interventions which aim to reduce the burden of infections in care homes and improve care quality and outcomes. No information that could identify any individual will be published in these reports.
2. To establish a database that can be used to support observational and modelling studies on infection, with the aim of finding new ways to reduce the impact of infection, outbreaks and AMR without compromising residents’ quality of life.

In addition to measuring disease burden, examples of the type of research questions we aim to answer through the study include:

• What happens to residents who get infected? Why do some residents get really unwell and others do not?
• How effective are vaccines against conditions such as COVID-19 and influenza at preventing infection, hospital admission and death in residents? How does this vary year by year?
• How often are residents prescribed antimicrobials? Do certain types of residents get more antimicrobials than others? What is the relationship between frequency of antimicrobial use and infections with antimicrobial resistance organisms in care home residents?
• How do infections spread between care homes and hospitals?

Legal basis for processing the personal data

The legal basis for UCL, the OS and Care England, as joint data controllers, to direct the collection and use of personal information for the Vivaldi Social Care study is provided by the following sections of the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018:

• UK GDPR Article 6(1)(e) ‘processing is necessary for the performance of a task carried out in the public interest’
• UK GDPR Article 9(2)(i) – processing is necessary for reasons of public interest in the area of public health
• UK GDPR Article 9(2)(j) ‘processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes’
• Data Protection Act Schedule 1 Part 1 (3) ‘public health’
• Data Protection Act Schedule 1 Part 1 (4) ‘research’

For UCL, the university’s charter and statutes, which establish the purposes for which it was incorporated and its related powers, provide its lawful basis as a public authority to process personal data for research purposes.

To enable confidential patient information (NHS numbers) from residents in participating care homes to be shared by digital care record suppliers to enable data linkage, without the direct consent of residents, ‘section 251’ approval has been provided by the Secretary of State for Health and Social Care for the purpose of research (23/CAG/0134) and surveillance (23/CAG/0135). The relevant provisions in law that apply here are section 251 of the National Health Service Act 2006 and Regulation 5 of the associated Health Service (Control of Patient Information) Regulations 2002.

The Vivaldi Social Care study has been reviewed and approved by the NHS Research Ethics Committee (approval reference 23/SW/0105).

Data processors

The OS, Care England, and UCL have appointed 2 other organisations to help support the Vivaldi study. These organisations are data processors acting on instructions of the joint controllers. They are not allowed to use the personal information for any purpose other than specified by the OS, Care England and UCL, they are not allowed to keep the information once their work on Vivaldi has ended, and they must comply with strong data security and protection requirements when processing the information.

The data processors appointed by the OS, Care England and UCL are:

• NHS England which receives identifiable data (NHS numbers) from each participating care home – NHS England replaces the NHS number with a code that cannot be used to identify the resident and links residents’ records to other medical records that are already held by NHSE such as hospital admissions and cause of death; once the dataset has been linked, NHS England depersonalises it (removes all identifiers including the codes) before sending it to UCL to be analysed
• Quantaim Ltd which links de-personalised data within the NHSE secure data environment to other datasets that are held by NHSE to create the study dataset

International data transfers and storage locations

The study dataset is created in NHSE’s secure data environment. A depersonalised copy of the dataset will be stored in the UCL data safe haven, which is housed in the UK. Approved researchers from the UK can apply to access the depersonalised dataset within the secure UCL environment.

Retention and disposal policy

Researchers can apply to use the research dataset until 31 October 2026. After this point the dataset will be stored in the UCL data safe haven for 3 years. The dataset will thereafter be fully anonymised and will be stored for a further 7 years, equating to 10 years storage in total from the Vivaldi Social Care study end date. This is in line with UCL’s policy on research data retention, accessible at Retention Schedule, Library Services, UCL.

How we keep the data secure

The personal information collected and used for the Vivaldi Social Care study is protected in a range of ways.

The data is stored on computer systems in the UCL data safe haven, which have been independently assessed as meeting the ISO27001 information security standard. These computers are kept up-to-date and regularly tested to make sure they are secure and protected from viruses and hacking and have security systems equivalent to the NHS systems.

Personal information can only be seen by staff who have been specially trained to protect confidentiality. Strict controls are in place to make sure they can only see the information they need to do their job, and they are only provided with access to the minimum necessary information.

Whenever possible, information is only used in a form that does not directly identify individuals. No information that could identify any individual will ever be published by the OS, Care England, UKHSA or UCL.

Your rights as a data subject

By law, data subjects have a number of rights, and this processing does not take away or reduce these rights under the UK General Data Protection Regulation and the UK Data Protection Act 2018. Those rights apply to your data as it is used in this study.

These rights are:

1. The right to get copies of information: individuals have the right to ask for a copy of any information about them that is used.
2. The right to get information corrected: individuals have the right to ask for any information held about them that they think is inaccurate, to be corrected.
3. The right to limit how the information is used: individuals have the right to ask for any of the information held about them to be restricted, for example, if they think inaccurate information is being used.
4. The right to object to the information being used: individuals can ask for any information held about them to not be used. However, this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.
5. The right to get information deleted: this is not an absolute right, and continued use of the information may be necessary, with individuals being advised if this is the case.

Automated decision making or profiling

No decision about the health care and treatments received by participants in the Vivaldi Social Care study is made on the basis of automated decision making (where a decision is taken about them using an electronic system without human involvement) which has a significant impact on them.

Opting out of Vivaldi

Residents of participating care homes can opt out of being included in the Vivaldi Social Care study by speaking to any member of care home staff, or by emailing the named contact in their care home.

Additionally, any residents of participating care homes who have opted out of their confidential patient information being used for research and planning purposes through the NHS national data opt out process will not be included in Vivaldi.

Information on the NHS opt-out and how to register your choice can be found at Your NHS data matters. On this webpage you will:

• see what is meant by confidential patient information
• find examples of when confidential patient information is used for individual care and examples of when it is used for purposes beyond individual care
• find out more about the benefits of sharing data
• understand more about who uses the data
• find out how your data is protected
• be able to access the system to view, set or change your opt-out setting
• see the situations where the opt-out will not apply

How to find out more or raise a concern

If you are a participant in the Vivaldi Social Care study and wish to exercise any of your rights as a data subject, or if have any concerns about how Vivaldi is using and protecting personal information, you can contact the UCL Data Protection Officer at data-protection@ucl.ac.uk or by calling 020 7679 7338.

You also have the right to contact the Information Commissioner’s Office if you have any concerns about how any of the organisations involved in the study use and protect personal information. You can do so by calling the ICO’s helpline on 0303 123 1113, visiting the ICO website or writing to the ICO at:

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
SK9 5AF

Changes to this policy

This privacy notice is kept under regular review, and new versions will be available on the privacy notice page on our website. This privacy notice was last updated on 1 July 2024.