Heard study privacy notice

Devon County Council is working in partnership with Devon Partnership Trust, Torbay and South Devon NHS Foundation Trust, the Royal Devon & Exeter NHS Foundation Trust, PenCHORD and West London Mental Health Trust as part of a study using retrospective data collected as part of routine NHS care to describe the cost and patterns of health and social care service use by people with severe relational disturbance in Devon and west London.

The purpose of this research is to undertake an evaluative and descriptive study of the service use across health and social care of patients with the most severe and complex relational disturbance.

If the study demonstrates a high cost associated with this patient group and identifies their pattern of service use this will highlight the needs of this patient group to policymakers. This will provide strategic direction to the future planning of therapeutic pathways and services.

This notice explains what information will be shared, why it is being shared and how it will be kept secure. It also explains your rights and our legal obligation.

We will notify you of any changes to this privacy notice

This privacy notice was last updated on 22 May 2020. If we use your personal data for any new purposes, updates will be made to the policy information and changes communicated, where necessary in accordance with current data protection legislation. Any queries relating to this privacy notice please contact the Data Protection Officer.

What information will be shared and how will it be used

The following information will be shared with Devon Partnership Trust (DPT) who will store this information securely:

  • NHS number (To be transformed to unique pseudo-anonymised patient ID by DPT performance team)
  • Age at referral
  • Provider name
  • Care setting
  • Referral date
  • Discharge date
  • Service use instance (with community contacts reported individually)
  • Service name
  • ICD-10 primary diagnosis
  • HONOS care cluster
  • General speciality
  • HONOS score (and score components)

Data that is shared as part of this research will involve patients who may not have a primary diagnosis of personality disorders but have other symptom presentations which are recognised to arise from severe attachment disorders and trauma.

In Devon, activity data will be collected from:

  • DPT Carenotes
  • Virgin care re adolescents in Transition to adult services
  • IPP data
  • NHSE data re nationally commissioned beds
  • Acute Trusts (physical healthcare (Provided IG obstacles to data collection can be overcome)
  • DCC social care records

A comparable data set will be collected in west London although CRIS and WSIC already have access to physical and mental health data along with social care so the data collection will be more straightforward.

This data is stored in a secure data warehouse provided by DPT and will be de-personalised (pseudonymised) before being shared with PenCHORD who are being commissioned to perform statistical the research and statistical analysis as part of this project.

How we will protect your privacy

Information provided by each participating organisation will be pseudonymised by DPT, and then re-pseudonymised to ensure that an individual cannot be re-identified. There will be strict controls regarding who can access the data, and all data will be securely transferred using a secure file transfer system.

No data, reports or analyses will be published in a manner that enables any person to be identified and no decisions will be taken that might impact on a specific individual.

No data that is collected for any of the purposes outlined in this notice is never used for direct marketing purposes and is not sold on to any other third parties.

The legal basis for using data in this way

Whilst the sharing of data as part of the Heard study does not enable any individuals to be re-identified from any data that is shared, the partners are mindful that the following lawful grounds support the sharing of personal data:

  • Article 6(1)(e) of the general data protection regulation
  • Article 9(2)(h) of the general data protection regulation

How long data will be held for

The data within the DPT data warehouse will be destroyed two years after the publication of the final Heard study report. No patient identifiable data will be passed to PenCHORD, all patient ID’s will be anonymised by DPT.

All pseudo-anonymised data will be stored by PenCHORD on password encrypted laptops with encrypted hard drives in line with the University of Exeter ‘Open Access Research and Research Data Management Policy’.

In line with University policy, the pseudo-anonymised project data will be retained for 5 years post-publication of the findings to enable responses to freedom of information requests and substantiation of the analysis should the findings be challenged or the analysis needs to be replicated. After two years post-publication, the project data will be permanently deleted.

Your data protection rights

Under data protection legislation, you have various rights, which include:

  • the right to receive a copy of your personal data
  • the right to request the rectification of inaccurate
  • the right to request the erasure of your personal data
  • the right to request the restriction of processing of your personal data
  • the right to request personal data you supply in a portable form
  • the right to object to the processing of your personal data in certain circumstances
  • the right to object to automated decision making

If you wish to exercise any of your rights under data protection legislation, you should direct these requests to the relevant data controller whose contact details are below:

International transfers

Please note that no data that is shared as part of the Heard study will be transferred to countries to which UK data protection laws do not apply.

Automated decisions

Please note that no automated decisions will be taken regarding individuals as part of the Heard study.


If you have any comments, queries or complaints about this privacy notice or the processing of your personal data please contact our Data Protection Officer.

Alternatively, if you are not happy with the way that either Devon County Council, Devon Partnership Trust, Torbay & South Devon NHS Trust or the Royal Devon & Exeter NHS Foundation Trust is handling your personal data, you are entitled to appeal to the Information Commissioners Office (ICO). The Information Commissioners Office enforces and oversees the Data Protection Regulations.

Contact details are below:

Information Commissioner’s Office
Wycliffe House
Water Lane

Web form: https://ico.org.uk/make-a-complaint/your-personal-information-concerns/