Data security and privacy

We make every effort to ensure our standards are high in handling personal data in our work. This privacy notice explains how we use the personal information we collect, and the rights that you have if you think that we hold information about you as a data subject.

National data opt-out

The national data opt-out is a service that allows patients to stop their confidential patient information being used for any reason other than direct care.

However, there are some cases where confidential patient information is needed to help develop new treatments and make recommendations that will improve the care and safety of patients overall.

In these cases the work undertaken is considered to be in the public interest, and as long as the data is held securely and no individual data is ever shared, the collection of confidential patient information is allowed to continue.

The Manchester Self-Harm Project collects information on people who self-harm and go to hospital Accident and Emergency departments in Manchester. This information is used to improve care and safety for people who self-harm and people who may be at risk of suicide.

Our project has been fully reviewed by the Confidentiality Advisory Group of the Health Research Authority, and they have recommended that our project be exempt from applying national data opt-outs. This means that even when someone has requested that their data not be used for anything other than their own care their data will still be included in our work on self-harm.

We take the security of your data very seriously and follow strict security protocols. Only trained staff working directly on the Manchester Self-Harm Project can access your data, and we never share individual information. All our publications, reports, and recommendations will only ever present completely anonymous grouped data, and we always ensure than no individual can be identified.

Plain language infographic and summary

National data opt-out infographic - thumbnail.View a simpler version of this information about the national data opt-out: National Data Opt-Out infographic (PDF).

You can also read the full plain English summary produced in collaboration with service users and carers from the MS4MH-R group: National data opt-out – plain language summary (PDF).

 

Information we collect

The Manchester Self-Harm Project collects data on everyone who presents to an emergency department in the City of Manchester following self-harm.

We collect basic information on time, date, method of self-harm, as well as age and gender. For some people who are assessed by psychiatric liaison staff we also collect details on what might have led to the self-harm, past or current psychiatric care, as well as where people were referred to from the emergency department for follow-up care.

These data make it possible for us to monitor self-harm rates in Manchester over time, and to investigate different aspects of self-harm behaviour and outcomes, such as repetition of self-harm, which help to improve patient care.

As part of our work we look at mortality in people who self-harm and present to hospital in Manchester. To do this we securely submit some of the identifiable personal data we collect to information services at NHS Digital, such as name and/or postcode.

This makes it possible for our data to be linked to Civil Registration data, which can tell us whether people are still alive, if and/or how they have died, or if they have lost contact with the NHS – for example by leaving the country. With this information we can look at risk of suicide after a presentation to hospital for self-harm, and look at any changes in risk over time.

The Manchester Self-Harm project is also one of three self-harm monitoring projects that make up the collaborative Multicentre Study of Self-harm in England (along with studies based at the University of Oxford and Derbyshire Healthcare NHS Foundation), a limited amount of data is sent to the Multicentre Study Coordinator who is based in Oxford.

The Study Coordinator merges the site-specific data into a single database that includes information on self-harm and mortality follow-up, and then securely sends a copy of the full database back to us. We do share date of death and cause of death if we have received this information from NHS Digital, but we do not share any names, addresses, dates of birth, NHS numbers, or any other identifiable personal data of anyone we collect data on in Manchester.

Instead we use local study codes in the combined Multicentre Study database to link together data on each person so we know if someone has presented to hospital for self-harm on multiple occasions. Once a copy of the Multicentre Study database has been received, that copy belongs to The Manchester Self-Harm Project, and the data controller is therefore the University of Manchester.

How we use collected information

The Manchester Self-Harm Project produces a number of outputs based on analysis of the information we collect.

We publish local reports on self-harm in Manchester which includes detailed analysis of who attends hospital for self-harm, self-harm methods, timings, and how common self-harm is in different groups (e.g. age groups, gender, people with a history of psychiatric care), as well as trends over time.

We also produce infographics that provide clear and concise messages about self-harm in Manchester, including infographics relating to specific subgroups (e.g. children and young people). We also publish papers in peer reviewed scientific journals using Manchester-only data as well as leading on various collaborative papers as part of the Multicentre Study of Self-harm in England.

We only publish aggregate figures, and we follow ONS guidance about small numbers (i.e. we do not publish low counts), and we do not share information about any individuals in our outputs. There are various retention periods for the information we collect, based on the specific requirements of the data providers and our overall Section 251 approval. Once a data destruction date is reached personal data are securely destroyed.

 

Data security information

Data controller and security measures

Processing of data held by The Manchester Self-Harm Project is lawful under Article 6(1)(e) of the General Data Protection Regulation (2016) for ‘task in the public interest,’ and Article 9(2)(i) for ‘processing special category personal data, concerning health.’

We also comply with the Data Protection Act (2018), and NHS information governance procedures to ensure that any personal information we hold remains confidential and safe at all times. In order to carry out our work we have the following approvals in place:

  • Section 251 approval; this allows us to hold identifiable and patient sensitive data.
  • Data Sharing Agreements; these are agreements of principals for the release of sensitive data.
  • A 100% assessment on the Information Governance Toolkit; this is an online assessment against NHS information governance policies and standards.

The Manchester Self-Harm Project and its data are based at The University of Manchester, which was established by Royal Charter. As host organisation The University of Manchester is the data controller for the Manchester Self-Harm Project.

If you have any questions about how your personal information is used you can contact the data protection officer by email at dataprotection@manchester.ac.uk, or by writing to:

The Data Protection Officer
Information Governance Office
Christie Building
University of Manchester
Oxford Road
Manchester M13 9PL

Accessing your individual data

If you believe that The Manchester Self-Harm Project holds personal information about you, you have a right to ask for a copy of that information. This is commonly known as a Subject Access Request. A request for information from health records has to be made with the organisation that holds your health records. For hospital health records, please contact the records manager or patient services manager at the relevant NHS hospital or mental health trust. You can find a list of NHS trusts on the NHS Choices website. If you would like to receive a copy of other information we hold about you, your request should be made in writing (or email) to The Manchester Self-Harm Project.

Email: MASH@manchester.ac.uk

Address:

The Manchester Self-Harm Project
Room 2.316 Jean McFarlane Building
The University of Manchester
Oxford Road
Manchester
M13 9PL

Please include the words ‘Subject Access Request’ at the beginning of your letter or in the subject line of your email. When making your request, please include your name, address and postcode and the type of information you want to look at including any relevant dates. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.

Correction request

You have the right to request that any personal information about you that is inaccurate be corrected. If you would like to request that personal data that we hold about you be corrected, your request should be made in writing (or email) to The Manchester Self-Harm Project (addresses provided above).

Please include the words ‘Correction of information’ at the beginning of your letter or in the subject line of your email. When making your request, please include your name, address and postcode and the type of information you want amending including any relevant dates. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.

How to request removal of your data

You have the right to opt out of having your personal data processed by The Manchester Self-Harm Project for tasks in the public interest. If you would like to request having your data removed from the project, your request should be made in writing to:

The Manchester Self-Harm Project
Room 2.316 Jean McFarlane Building
The University of Manchester
Oxford Road
Manchester
M13 9PL

Or by email to: MASH@manchester.ac.uk

Please include the words ‘Opt Out of Processing’ at the beginning of your letter or in the subject line of your email. When making your request, please include your name, address and postcode. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.

Restriction of processing request

You may also request the right to restrict processing of your data. This is not an absolute right and applies only in specific circumstances:

Where you contest the accuracy of your personal data and we need to verify the accuracy of the data.

The personal data were unlawfully processed (i.e. in breach of the Data Protection Act 2018 and General Data Protection Regulation), and you request restriction rather than erasure of the data.

Where the personal data are no longer necessary in relation to the purpose for which it were originally collected/processed, but you need us to keep the data in relation to a legal claim.

When you object to the processing and we are considering whether our legitimate interest for continuing the processing would override this objection.

If you would like to raise an objection to the processing of your data, your objection should be made in writing (or email) to The Manchester Self-Harm Project (addresses provided above).

Please include the words ‘Restriction of Processing’ at the beginning of your letter or in the subject line of your email. When making your request, please include your name, address and postcode and the type of information you want to look at including any relevant dates. We aim to send you a reply as soon as possible and by the latest within 30 calendar days. You may also be asked to provide proof of identity.