Data security and privacy

We make every effort to ensure our standards are high in handling personal data in our work. This privacy notice explains how we use the personal information we collect, and the rights that you have if you think that we hold information about you as a data subject.

Information we collect

The Manchester Self-Harm Project collects data on everyone who presents to an emergency department in the City of Manchester following self-harm. We collect basic information on time, date, method of self-harm, as well as age and gender. For some people who are assessed by psychiatric liaison staff we also collect details on what might have led to the self-harm, past or current psychiatric care, as well as where people were referred to from the emergency department for follow-up care. These data make it possible for us to monitor self-harm rates in Manchester over time, and to investigate different aspects of self-harm behaviour and outcomes, such as repetition of self-harm, which help to improve patient care.

As part of our work we look at mortality in people who self-harm and present to hospital in Manchester. To do this we securely submit some of the identifiable personal data we collect to information services at NHS Digital, such as name and/or postcode. This makes it possible for our data to be linked to Civil Registration data, which can tell us whether people are still alive, if and/or how they have died, or if they have lost contact with the NHS – for example by leaving the country. With this information we can look at risk of suicide after a presentation to hospital for self-harm, and look at any changes in risk over time.

The Manchester Self-Harm project is also one of three self-harm monitoring projects that make up the collaborative Multicentre Study of Self-harm in England (along with studies based at the University of Oxford and Derbyshire Healthcare NHS Foundation), a limited amount of data is sent to the Multicentre Study Coordinator who is based in Oxford. The Study Coordinator merges the site-specific data into a single database that includes information on self-harm and mortality follow-up, and then securely sends a copy of the full database back to us.  We do share date of death and cause of death if we have received this information from NHS Digital, but we do not share any, names, addresses, date of birth, NHS number, or any other identifiable personal data of anyone we collect data on in Manchester. Instead we use local study codes in the combined Multicentre Study database to link together data on each person so we know if someone has presented to hospital for self-harm on multiple occasions. Once a copy of the Multicentre Study database has been received, that copy belongs to The Manchester Self-Harm Project, and the data controller is therefore the University of Manchester.

How we use collected information

The Manchester Self-Harm Project produces a number of outputs based on analysis of the information we collect. We publish local reports on self-harm in Manchester which includes detailed analysis of who attends hospital for self-harm, self-harm methods, timings, and how common self-harm in different groups (e.g. age groups, gender, people with a history of psychiatric care), as well as trends over time. We also produce infographics that provide a clear and concise messages about self-harm in Manchester, including infographics relating to specific subgroups (e.g. children and young people). We also publish papers in peer reviewed scientific journals using Manchester-only data as well as leading on various collaborative papers as part of the Multicentre Study of Self-harm in England. We only publish aggregate figures, and we follow ONS guidance about small numbers (i.e. we do not publish low counts), and we do not share information about any individuals in our outputs. There are various retention periods for the information we collect, based on the specific requirements of the data providers and our overall Section 251 approval. Once a data destruction date is reached personal data are securely destroyed.

Data controller and security measures

Processing of data held by The Manchester Self-Harm Project is lawful under Article 6(1)(e) of the General Data Protection Regulation (2016) for ‘task in the public interest,’ and Article 9(2)(i) for ‘processing special category personal data, concerning health.’ We also comply with the Data Protection Act (2018), and NHS information governance procedures to ensure that any personal information we hold remains confidential and safe at all times. In order to carry out our work we have the following approvals in place:

Section 251 approval; this allows us to hold identifiable and patient sensitive data.

Data Sharing Agreements; these are agreements of principals for the release of sensitive data.

A 100% assessment on the Information Governance Toolkit; this is an online assessment against NHS information governance policies and standards.

The Manchester Self-Harm Project and its data are based at The University of Manchester, which was established by Royal Charter. As host organisation The University of Manchester is the data controller for the Manchester Self-Harm Project. If you have any questions about how your personal information is used you can contact the data protection officer by email at dataprotection@manchester.ac.uk, or by writing to:

The Data Protection Officer
Information Governance Office
Christie Building
University of Manchester
Oxford Road
Manchester M13 9PL

Subject access, correction, objection or restriction of processing requests

Subject access

If you believe that The Manchester Self-Harm Project holds personal information about you, you have a right to ask for a copy of that information. This is commonly known as a Subject Access Request. A request for information from health records has to be made with the organisation that holds your health records. For hospital health records, please contact the records manager or patient services manager at the relevant NHS hospital or mental health trust. You can find a list of NHS trusts on the NHS Choices website. If you would like to receive a copy of other information we hold about you, your request should be made in writing (or email) to The Manchester Self-Harm Project.

Email: MASH@manchester.ac.uk

Address: The Manchester Self-Harm Project, Room 2.316 Jean McFarlane Building, The University of Manchester, Oxford Road, Manchester, M13 9PL.

Please include the words ‘Subject Access Request’ at the beginning of your letter or in the subject line of your email. When making your request, please include the following details: your name, address and postcode and the type of information you want to look at including any relevant dates. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.

Correction request

You have the right to request that any personal information about you that is inaccurate be corrected. If you would like to request that personal data that we hold about you be corrected, your request should be made in writing (or email) to The Manchester Self-Harm Project (addresses provided above).

Please include the words ‘Correction of information’ at the beginning of your letter or in the subject line of your email. When making your request, please include the following details: your name, address and postcode and the type of information you want to look at including any relevant dates. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.

Objection to processing request

You have the right to object to the processing of your personal data by The Manchester Self-Harm Project for tasks in the public interest. The objection must be on grounds relating to your particular situation. If you would like to raise an objection to the processing of your data, your objection should be made in writing (or email) to The Manchester Self-Harm Project (addresses provided above).

Please include the words ‘Objection to Processing’ at the beginning of your letter or in the subject line of your email. When making your request, please include the following details: your name, address and postcode and the type of information you want to look at including any relevant dates. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.

Restriction of processing request

You may also request the right to restrict processing of your data. This is not an absolute right and applies only in specific circumstances:

Where you contest the accuracy of your personal data and we need to verify the accuracy of the data.

The personal data were unlawfully processed (i.e. in breach of the Data Protection Act 2018 and General Data Protection Regulation), and you request restriction rather than erasure of the data.

Where the personal data are no longer necessary in relation to the purpose for which it were originally collected/processed, but you need us to keep the data in relation to a legal claim.

When you object to the processing and we are considering whether our legitimate interest for continuing the processing would override this objection.

If you would like to raise an objection to the processing of your data, your objection should be made in writing (or email) to The Manchester Self-Harm Project (addresses provided above).

Please include the words ‘Restriction of Processing’ at the beginning of your letter or in the subject line of your email. When making your request, please include the following details: your name, address and postcode and the type of information you want to look at including any relevant dates. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.