Skip to main content

Privacy notice (Pathway)

This privacy notice provides information about how University Hospitals Birmingham NHS Foundation Trust's (UHB) health research data hub, Pathway, collects and processes your personal data.  

The date this page was last reviewed is available at the bottom. It is reviewed when necessary and at least annually.

Who we are

UHB is recognised as one of the leading research trusts in Europe and a Centre of Excellence for a number of services.

The Trust hosts the Institute of Translational Medicine and led the West Midlands Genomic Medicine Centre.

Our researchers, many of whom are world leaders in their field, are engaged in a broad range of research activity. 

As a leading research Trust, we are committed to protecting the privacy and security of your personal information. We are registered with the Information Commissioner’s Office (ICO) registration number: Z556810, to process personal and special category information.

If you have any questions about this privacy notice, including any request to exercise your legal rights as set out in this privacy policy, please contact our Data Protection Officer.

What is Pathway?

Pathway is a Health Data Research Hub established by UHB to provide controlled access to data for clinicians, analysts and researchers to improve patient care and the population’s health.

The data hub stores UHB healthcare data for all patients who have received care/treatment (i.e. information contained in healthcare records) or who have accessed a service at one of our hospitals. Staff processing data within the UHB Pathway Data Hub are specialists based within the UHB Research & Development Department.

UHB is the controller and responsible for data contained in the Pathway. The Trust has been awarded the required NHS Research Ethical approval (Ref: 22/EE/0161) for Pathway processing activities. 

For information about the general use of patient data in research in the health service please visit the Health Research Authority website. 

What is personal data?

Personal data is information relating to a natural (living) person or data subject, which can be used to identify the person. This provides for a wide range of information to constitute personal data, for example:

  • name
  • identification number
  • date of Birth
  • location data
  • online identifier

Special category of personal data

Information which is thought to be extra sensitive:

  • ethnicity
  • data concerning health
  • biometric data
  • sexual orientation
  • religious or philosophical belief


Anything that is done to the personal data we hold.

Pseudonymised or anonymised data

Personal data can no longer be attributed to a specific person.

Why we collect personal information about you

The Trust uses your personal information to carry out health and social care research in the public interest. UHB’s research activities serve society as a whole, for example, by improving disease detection, diagnosis and treatments or improving existing services.

Our legal bases for processing personal information about you is processed for the purposes of:

“The performance of a task carried out in the public interest or in the exercise of official authority vested in the controller” under chapter 2, article 6 (1) (e)

“The provision of health or social care or treatment or the management of health of social care systems and services” under chapter 2, article 9 (2) (h) of the UK GDPR.

“The provision of health or social care or treatment or the management of health of social care systems and services” under chapter 2, article 9 (2) (j) of the UK GDPR. (“Processing is necessary for archiving purposes in the public interest, scientific or historical research purposes”) of the GDPR, in combination with Schedule 1, Part 1, Art 4 Data Protection Act (DPA) 2018.

What personal information we need to collect about you and how we collect it

The personal identifiable information that UHB collects is information that we already hold about you due to the healthcare services you have received as part of the usual care processes, in order for UHB to deliver services and care to patients. This includes information from your clinical care records including imaging/graphical data.

Some information about you may be linked to other information shared by primary care providers (e.g. GPs) and secondary care providers (e.g. acute trusts) to create an improved information set to for medical research for the benefit of public health.

How your personal information could be used

Personal information we collect about you will be pseudononymised/anonymised and may be:

  • used for research and innovation projects to improve NHS care (Research and Innovation projects must demonstrate a significant benefit to patients and the public)
  • used to measure treatment and care outcomes, provided by UHB services to identify improvements
  • shared with other organisations such as NHS bodies, academics or commercial entities that request Pathway data to support research and development/ Innovation projects

Access to UHB pseudonymised/anonymised health data will only be permitted for following a formal application process/contractual process and at no point will any patient identifiable data be accessible to anyone outside of the organisation.

The Trust will ensure that each application to use Pathway data will be fully scrutinised and approved and identify the project reporting method for results. When project results are published UHB will ensure that it is impossible to identify you.

We will not:

  • share your identifiable data with third parties for marketing purposes
  • sell your identifiable data

If we are required to transfer anonymised information about you outside the UK/EU, we will make sure that data is protected before transferring any data.

Who we share your information with and why

Anonymised information about your health and the care you have received may be provided to researchers conducting research studies both here at the Trust and at other third party organisations.

Third party organisations are typically non-commercial partners such as universities or NHS hospitals.

Your information will only be used for research in accordance with the UK Policy Framework.

We may have to share information about you with the Care Quality Commission or other regulatory/law enforcement authorities. Please see the Trust's privacy notice for patients.

How we retain and reuse your information

Each application to use UHB Pathway patient health data is considered on a case by case basis and is subject to a stringent approval process as set out by the UK Data Service.

Each application is evaluated by both UHB Research & Development professionals and an independent Data Trust Committee before recommendations are made on whether an application should be approved.

Data is only approved for research use following rigorous governance processes and approval from the UHB Caldicott Guardian and the member of staff responsible for the data (known as the Information Asset Owner).

Time limited contractual agreements will be put in place to protect pseudononymised/anonymised patient datasets. 

Following the expiry of the contract your personal information will be archived for a specified period and then securely destroyed, in accordance with the Trust’s Record Management Policy.

Under certain circumstances, anonymised archived data may be re-used for scientific or historical research.

Your rights

Under current data protection legislation (Article 13 to 18, GDPR), you have certain rights to manage your data as you see fit. For the purpose of research, your rights to access, object, change, transfer and/or delete your information will differ as

UHB need to manage the data in specific ways to ensure the research we conduct is reliable and accurate, and that we are accountable to research organisations which fund and monitor our research.

If you do not want your health data to be used for research and planning purposes(including Pathway), then you can choose to opt-out, via the NHS website.

The Information Commissioner’s Office (ICO) is the body that regulates the Trust under data protection and freedom of information legislation. If you are not satisfied with our response or believe we are not processing your personal data in accordance with the law you can complain to the ICO.

Last reviewed: 05 June 2023