NHS DigiTrials Service Transparency Notice

NHS England has enhanced its support for health and life sciences research by developing a service called NHS DigiTrials. NHS DigiTrials will enhance the efficiency and effectiveness of trials at every stage, using the data that NHS England already collects from health and care organisations across England.

The NHS DigiTrials service will:

• increase opportunities for the widest possible group of individuals to participate in clinical research to improve public health
• improve the diversity of research cohorts, so that those who are offered the opportunity to take part in research become more representative of the population
• support faster participant recruitment to trials to find answers to important clinical questions more rapidly
• optimise enrolment through effective reach, minimising invites
• reduce the cost of running clinical trials and other important research
• support a thriving UK life sciences research sector and attract more research to the UK
• ultimately improve population health, NHS services and access to evidence-based diagnostics, vaccines and treatments for the wider population.

The NHS DigiTrials service aims to do this by using data held by NHS England in a timely manner to support healthcare research studies (including clinical trials) within the bounds of robust governance, including data protection requirements and information security.

Each of the NHS DigiTrials services will process data that NHS England holds in different ways:

Feasibility service

Types of personal data we are processing

Fully anonymised and aggregate data will be processed to improve the assessment of clinical trial feasibility – supporting improved planning and location of clinical trials in the UK.

Controller of personal data

Under the UK General Data Protection Regulation 2018 (UK GDPR), NHS England is the Data Controller.

Legal basis to process personal data

NHS England has been directed by the Secretary of State for Health and Social Care under the Life Sciences Directions 2019, to convert record level data it holds into anonymised and pseudonymised forms. This is to support linkage of different data sets and to make that information available for dissemination in an anonymised and, where this is lawful, in pseudonymised form.

Who we share information with

Personal information is not shared as part of the Feasibility Service.

Recruitment Service

Types of personal data we are processing

The types of personal data that will be processed will be dependent upon the nature of the trial and will be specific to the needs of the trial. To identify people to be invited to take part in a trial we will likely process:

• demographic data – patient name, date of birth, sex, NHS number and contact details such as address, telephone number and email address
• health information – information relating to the health and care patients have been provided - this may include information about medical conditions (in the form of condition codes held in central NHS records)

Controller of personal data

Under the UK General Data Protection Regulation 2018 (UK GDPR), NHS England is the data controller.

The trial organisation is the data controller for the data they collect directly from participants that they have enrolled into the research study or clinical trial.

Legal basis to process personal data

NHS England has been directed by the Secretary of State for Health and Social Care to deliver the Recruitment Service under the NHS DigiTrials Recruitment Service Directions 2026.

Who we share information with

Where NHS DigiTrials are sending out invitations to take part in research on behalf of a trial, no sharing of personal data takes place.

Where NHS DigiTrials are sending the data to a trial to send out their own invitations to take part in research, we will share the minimum data required for the method of invitation:

• for postal invitations: name and address
• for SMS invitations: name and mobile number

In both instances the trial will receive an aggregate report of the number of people we have identified to be invited.

We will only share data with other organisations where this is lawful and in line with data protection law.

Communication Service

Types of personal data we are processing

The personal data that will be processed so that trial participants can be provided with ongoing information about the trial will be demographic data – patient name, date of birth, sex, NHS number and contact details such as address, telephone number and email address.

Controller of personal data

Under the UK General Data Protection Regulation 2018 (UK GDPR), NHS England is the data controller.

Legal basis to process personal data

Personal data is processed in this service under consent from trial participants, which is provided at the point of signing up to take part in a trial. 

Who we share information with

Where NHS DigiTrials are sending out communications on behalf of a trial, no sharing of personal data takes place.

Where NHS DigiTrials are sending the data to a trial to send out their own communications, we will share the minimum data required for the method of communication.

In both instances the trial will receive a record-level report of the people who they have requested communications to be sent too.

Outcomes Service

Types of personal data we are processing

The types of personal data that will be processed to support research teams about the impact of an intervention or to support the long term follow up of trial participants, will likely be:

• demographic data – patient name, date of birth, sex, NHS number and contact details such as address, telephone number and email address
• health information – information relating to the health and care patients have been provided - this may include information about medical conditions (in the form of condition codes held in central NHS records)

Controller of personal data

Under the UK General Data Protection Regulation 2018 (UK GDPR), NHS England is the data controller.

Legal basis to process personal information

Personal data is processed in this service under consent from trial participants, which is provided at the point of signing up to take part in a trial. Where the consent obtained from the research cohort is inadequate, we will ensure that an alternative legal basis is in place, such as section 251, for us to process the participants data on behalf of the trial.

Who we share information with

Approved researchers outside NHS England (subject to a rigorous governance process), including for the purposes of carrying out clinical trials (for example, to invite you to join a trial).

NHS England is able to provide many of these services under its existing statutory functions as set out in the Health and Social Care Act 2012 as amended by the Health and Social Care Information Centre (Transfer of Functions, Abolition and Transitional Provisions) Regulations 2023, including the ability to provide functions connected with the delivery of additional services, analysis, publication or other dissemination of information.

Where NHS England has been directed to process personal data, this is a legal obligation, and we are allowed to do this under Article 6 (1)(c) of UK GPDR.

Where we process personal data as part of our statutory functions, this is part of our public task. We are allowed to do this under Article 6(1)(e) of UK GDPR.

Where we need to process health data and other special categories of personal data, we will only do this where it is necessary as part of our statutory functions or directions. Under UK GPDR we are allowed to do this where it is necessary for scientific research or statistical purposes under Article 9(2)(j) – processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes; plus Part 1, Sched 1 Data Protection Act 2018, para 4 research. Where we are directed to process health data and other special categories of personal data, we will rely upon Article 9(2)(g) - statutory purposes by virtue of the Directions.

The NHS DigiTrials service uses the NHS England Data Access Service (DAS) to deliver its clinical trial services. The information about why and how we process data to deliver NHS DigiTrials services can be found at Data Access Request Service (DARS) online: GDPR information.

Data shall be retained for no longer than 20 years in accordance with the NHS Records Management Code of Practice 2021.

Other organisations with whom we share your personal data have obligations to keep it for no longer than is necessary for the purposes for which we have shared your personal data. Information about this will be provided in their transparency or privacy notices which are published on their websites.

NHS England only stores and processes personal data for this service within the EEA.

To read more about the health and care information NHS England collects, our legal basis for collecting this information and what choices and rights you have, see how we look after your health and care information, and our NHS England transparency notice.

We may make changes to this transparency notice. If we do, the ‘last updated’ date at the bottom of this notice will also change. Any changes to this notice will apply immediately from the date of any change.