Last updated 23 September 2025

 

Summary

This notice explains how we use personal information for Work Package 2 (WP2) of the HIPPOCRATES programme. WP2 involves interviews, focus groups and co‑design workshops with people living in areas with high levels of socio-economic deprivation, and with health and social care professionals. The purpose is to develop interventions (treatments) to help people having big operations (major surgery) recover more quickly and without complications.

​

Who we are (data controllers)

University College London (UCL) and University College London Hospitals (UCLH) are both data controllers and data processors. Local NHS organisations are not data controllers for WP2 unless they host a session and collect data locally.

​

Data Protection Officer (DPO) contacts

• UCL DPO: data-protection@ucl.ac.uk

​

What we are doing and why (purpose of processing)?

We are talking with patients/public and professionals to hear their experiences and seek their views, in order to develop ideas for support we can offer to patients having big operations. The aim is to reduce the risk that future patents will have a major health problem after surgery (like an infection, breathing problem or other cause of serious illness). Such ideas include ways to support patients improving their own health and fitness before surgery, help with finances and benefits, and improving the support that is provided to help people recover after surgery. We will then see if these support systems work, by trialling them in real patients undergoing big operations, in a research project which will take place all over England. 

We will use your information to:

• invite and schedule you for a session;

• conduct the interview/group/workshop (which may be audio‑ or video-recorded with your consent);

• analyse notes and recordings transcripts to identify themes – the identities of people taking part in our focus groups and workshops will be hidden from the researchers doing the analysis

• develop our ideas for the support offers we will provide

• produce reports and academic publications. These will not identify you in anyway.

Participation is voluntary and will not affect your care or employment. You can choose not to answer any question.

​​

What information we collect

We only collect the minimum necessary information.

​

Contact details

Name: for scheduling and follow‑up.

Email:  for scheduling and follow‑up.

​

And/or phone numbers: to conduct any interviews over the phone.

​

Background information

• For patient/public participants: broad demographics relevant to inclusivity (e.g., age band, first part of postcode or local area, whether you have had major surgery), and any accessibility needs.

• For professional participants: role, organisation type and region.

​

Session data

• Audio recordings and notes.

• Written materials you create in co‑design (e.g., sticky notes, worksheets) and optional quotes from the discussion.

• Optional survey responses (e.g., short pre/post session questionnaires).

​

We do not ask for NHS number or access your medical records for WP2.

​

How we use and share your information

• Audio files are transcribed by the research team or an approved UK‑based transcription service under contract.

• We may take photos and short video clips to record the activities and materials produced (for example, group discussions shown on post-it notes). We may use selected images in project reports, on university webpages, and in conference presentations to explain what we did and what we learned. The aim is not to identify anyone. We will frame images to avoid faces and other identifying features; if a person is captured, we will blur or crop the image to remove identifying details.

• We remove names and other direct identifiers from transcripts before analysis.

• We may use short verbatim quotes in publications, but only after removing or changing details that could identify you. If a quote still carries a risk of recognition, we will ask for your specific permission.

• We do not sell your data and we do not publish information that identifies you.

​

Lawful basis for processing your data

University College London (UCL): Article 6(1)(e) – Public task (research in the public interest). As a public authority, UCL processes personal data where this is necessary to carry out research in the public interest. (For special category data, UCL relies on Article 9(2)(j) – scientific research – with the safeguards set out in the Data Protection Act 2018.)

 

Taking part is voluntary and based on informed consent for participation and optional audio‑/ video-recording or photos; however, our lawful basis for data processing is as above, not consent.

​

Where your data are stored and for how long

• Digital data are stored on secure UCL systems with access restricted to the WP2 research team.

• Approved processors (e.g., transcription providers) act under contract and only access the minimum necessary data.

• We keep identifiable data (e.g., consent forms, contact details) separately from transcripts/notes.

 

Retention

• Identifiable contact/consent information: kept for up to 10 years after the project ends.

• De‑identified transcripts/analysis files: may be retained for longer for verification and future ethically‑approved research, or archived in a secure data repository.

• Anonymised results may be kept indefinitely.

​

We do not routinely transfer your data outside the UK. If a transfer is necessary, we will use appropriate safeguards (e.g., approved contractual clauses).

​

Your rights

You have rights over your personal data, including to:

• access your information;

• ask us to correct inaccuracies;

• ask us to restrict or object to our use of your information;

• complain to the Information Commissioner’s Office (ICO).

 

Because this is scientific research, some rights (e.g., erasure and portability) may be limited if applying them would seriously impair the research. We will explain what is possible in your situation.

 

Who to contact

• Questions about WP2 or this notice: hippocrates@ucl.ac.uk

• UCL DPO: data-protection@ucl.ac.uk

• Information Commissioner’s Office: ico.org.uk or 0303 123 1113

​

Changes to this privacy notice

We review this notice regularly and will update it here. A change log is available on request.

​