Privacy notices - National Neonatal Audit Programme: Your baby's information

Using your baby’s information in the National Neonatal Audit Programme

While your baby is in the neonatal unit, staff record information in an electronic record. They use this to care for your baby, and to help the health service run well. All neonatal units use electronic records. Partners outside the hospital use this information to improve neonatal services through audit and research; this includes the National Neonatal Audit Programme.

What is the National Neonatal Audit Programme?

The National Neonatal Audit Programme (NNAP) is run by the Royal College of Paediatrics and Child Health (RCPCH). We are commissioned by the Healthcare Quality Improvement Partnership (HQIP) and funded by NHS England, the Scottish Government, the Welsh Government and Manx Care (Isle of Man).

The National Neonatal Audit Programme helps neonatal units to improve the care they provide to babies who need specialist treatment. We use information about your baby’s care to help neonatal units in England, Scotland and Wales to improve the care and outcomes for other babies. 

We look at whether babies receive consistent, high quality care, whether babies have recommended health checks to reduce the risk of complications and monitor how well babies are doing following this care.

What data does NNAP collect?

Neonatal unit staff enter your baby's information onto a secure electronic record system named BadgerNet. All neonatal units share information from these electronic records with the NNAP project team within the RCPCH, via another processor, System C, who manage the BadgerNet system used by neonatal units to record clinical data. This includes identifiable and special category personal data, including NHS or CHI Number (Baby and Mother), Date and time of admission to neonatal care (Baby), Date and time of discharge from neonatal care (Baby), Date and time of birth (Baby), Date of death (Baby), Date of birth (Mother), Ethnicity (Mother), Gender (Baby), Postcode of usual address (Mother), information about the care that mum and baby received and any related health conditions. The NNAP project team only uses the information for the purpose of the National Neonatal Audit Programme to monitor and try to improve standards of patient care.

Information is stored securely and used in accordance with UK Data Protection legislation and Isle of Man GDPR and LED Implementing Regulations 2018. The NNAP only conducts analysis of NNAP data once all identifiable information has been removed.

The RCPCH and its partners feel it is in the best interests of babies and families to process this information to improve the care babies receive. Our partners include parents and parent representative organisations, such as Bliss, the charity which champions the right for every baby born premature or sick to receive the best care by supporting families, campaigning for changes, supporting professionals, and enabling life-changing research.

Legal basis for processing patient data

England and Wales

The NNAP has section 251 approval to collect patient identifiable data in England and Wales without explicit patient consent as its aims are in the public interest since the audit will help improve standards of neonatal care, ensuring that high standards and quality of neonatal care continue. To find out more about section 251 approval, visit the Health Research Authority website.

Processing is permitted under the General Data Protection Regulation (GDPR) on the following legal bases:

Article 6 (1) (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This is justified through commissioning arrangements which link back to NHS England and the Welsh Government.

Article 9 (2) (i) processing is necessary for reasons of public interest in the area of public health. This is justified as the NNAP aims to drive improvements in the quality and safety of care and to improve outcomes for patients.

We also protect your privacy rights by providing you with the ability to choose for your data to not be included in the audit.

Scotland

The NNAP has approval from the Public Benefit and Privacy Panel for Health and Social Care (HSC-PBPP) to process patient identifiable data without explicit patient consent as its aims are in the public interest since the audit will help improve standards of neonatal care, ensuring that high standards and quality of neonatal care continue. To find out more about Public Benefit and Privacy Panel for Health and Social Care approval, visit the HSC-PBPP website.  

Processing is permitted under the UK General Data Protection Regulation (UK GDPR) on the following legal bases:  

Article 6 (1) (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller.  This is justified through commissioning arrangements which link back to the Scottish government.

Article 9 (2) (i) processing is necessary for reasons of public interest in the area of public health. This is justified as the NNAP aims to drive improvements in the quality and safety of care and to improve outcomes for patients.  

We also protect your privacy rights by providing you with the ability to choose for your data to not be included in the audit.

Isle of Man

The NNAP data sharing has been approved by the Isle of Man Department of Health and Social Care and the Isle of Man Information Commissioner. 

Processing is permitted under the Isle of Man GDPR and LED Regulations 2018 on the following legal bases:  

Applied GDPR Article 6 (1) (e) processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller, inter alia, Manx Care.

Applied GDPR Article 9(2)(h) processing is necessary for the purposes of ... the management of health or social care systems and services on the basis of Union law (as applied to the Island by or under the authority of an Act of Tynwald) or Manx law... and under Schedule 2, Regulation 12, Part 2(2)(f) the management of health care systems or services or social care systems or services...of the GDPR and LED Implementing Regulations 2018 to fulfil the statutory obligation placed upon Manx Care, prescribed under Section 23 of the Manx Care Act 2021 namely, as to improvement in quality of services. Public interest under the common law duty of confidentiality, reinforced by the Manx Care Act and the NHS Act 2001 which mandate Manx Care to provide the function around improvement of health and social care on behalf of the Isle of Man Dept. of Health and Social Care.

Will my baby's personal data be shared?

England and Wales

The NNAP publishes data in anonymised, aggregated form. No individual babies are identified in any of our reports. 

Data will only ever be shared with the approval of HQIP. For HQIP to approve the request, the requestor must be able to demonstrate compliance with stringent data protection policies and arrangements and the aims of the research must be approved, as per HQIP’s guidance to applicants.

For England only, we also share data with and receive data from the UK Health Security Agency (UKHSA) for the purpose of reporting rates of bloodstream infections in neonatal units. 

For more information about how data might be shared, please see the HQIP NCAPOP privacy notice: https://www.hqip.org.uk/about-us/privacy-notice/.
 
Personal data shall not be transferred to a country or territory outside the UK unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. No individual babies are identified in any of our reports.

Scotland

The NNAP publishes data in anonymised, aggregated form. No individual babies are identified in any of our reports. The NNAP does not share identifiable or pseudonymised data from Scottish services with others.

Personal data shall not be transferred to a country or territory outside the UK unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. 

Isle of Man

The NNAP published data in anonymised, aggregated form. No individual babies are identified in any of our reports. The NNAP does not share identifiable or pseudonymised data from Scottish services with others.

Manx Care will share your personal data with the NNAP audit which is based in the UK. As the UK is deemed adequate by the EU, they are also deemed adequate by the Isle of Man, so no further steps are required to ensure the transfer of your data from the Isle of Man to the UK. This is because the UK is considered to have equivalent data protection legislation in place which will provide the same level of protection to your data as it would receive in the Isle of Man.  

Data will only ever be further shared with the approval of HQIP. For HQIP to approve the request, the requestor must be able to demonstrate compliance with stringent data protection policies and arrangements and the aims of the research must be approved, as per HQIP’s guidance to applicants. 
 
Once NNAP receive your data, personal data shall not be transferred to a country or territory outside the UK unless that country or territory ensures an adequate level of protection for the rights and freedoms of data subjects in relation to the processing of personal data. 

Hold long are the data held for?

England and Wales

The NNAP team at the RCPCH acts as the data processor on behalf of the Healthcare Quality Improvement Partnership (HQIP), who have contracted us to carry out this audit, and are data controllers for the NNAP data.

HQIP are joint data controllers with NHS England for English NNAP data and with Digital Health and Care Wales (DHCW) for Welsh NNAP data. The RCPCH will hold the NNAP data for as long as it is commissioned to deliver the NNAP project by HQIP.

All data will be deleted or transferred back to HQIP within two weeks of the end of our contract. If HQIP commissions the RCPCH to deliver the NNAP under a new or extended contract, then the data will be retained for the period of the new contract.

Scotland

The NNAP team at the RCPCH acts as the data processor on behalf of the Healthcare Quality Improvement Partnership, who have contracted us to carry out this audit, and are data controllers for the NNAP data.

The RCPCH will hold the NNAP data for as long as it is commissioned to deliver the NNAP project by HQIP. All patient identifiable data will be deleted at the end of our contract with HQIP. If HQIP commissions the RCPCH to deliver the NNAP under a new or extended contract, then the data will be retained by the RCPCH for the period of the new contract.

Isle of Man

The NNAP team at the RCPCH acts as the data processor on behalf of the Healthcare Quality Improvement Partnership (HQIP), who have contracted us to carry out this audit, and who are sole data controllers for the NNAP data.

The RCPCH will hold the NNAP data for as long as it is commissioned to deliver the NNAP project by HQIP. All data will be deleted or transferred back to HQIP within two weeks of the end of our contract.  If HQIP commissions the RCPCH to deliver the NNAP under a new or extended contract, then the data will be retained for the period of the new contract.

Do you ask permission to use my baby's data?

England and Wales

Information about all babies admitted to an NHS neonatal unit is routinely included in the NNAP. It is important that we include information on every baby treated by a neonatal unit so that the NNAP is properly representative of neonatal care in the UK.

Because of the large number of babies involved, it is impractical to seek consent from each family. You can choose for your baby’s information not to be used for the purpose of the NNAP. If you would like to make that choice then please tell the staff on the neonatal unit where your baby is receiving care.

They will make sure your baby’s information is not included in the NNAP. You can also speak to the NNAP team to find out how to opt out by contacting nnap@rcpch.ac.uk or calling us on 0203 861 1910.

Scotland

Information about all babies admitted to an NHS neonatal unit is routinely included in the National Neonatal Audit Programme. It is important that we include information on every baby treated by a neonatal unit so that the National Neonatal Audit Programme is properly representative of neonatal care in the UK.

Because of the large number of babies involved, it is impractical to seek consent from each family. You can choose for your baby’s information not to be used for the purpose of the NNAP. If you would like to make that choice then please tell the staff on the neonatal unit where your baby is receiving care.

They will make sure your baby’s information is not included in the National Neonatal Audit Programme. You can also speak to the NNAP team to find out how to opt out by contacting  nnap@rcpch.ac.uk or calling us on 0203 861 1910.

Isle of Man

Information about all babies admitted to an NHS neonatal unit is routinely included in the NNAP. It is important that we include information on every baby treated by a neonatal unit so that the NNAP is properly representative of neonatal care in the UK.

Because of the large number of babies involved, it is impractical to seek consent from each family. You can choose for your baby’s information not to be used for any purpose other than routine healthcare.

To opt out, please contact the Isle of Man Government by emailing fps@gov.im. You can also speak to the NNAP team to find out how to opt out by contacting nnap@rcpch.ac.uk or calling us on 0203 861 1910.

Your data rights

England and Wales

We explain a bit more about your rights below:

Right of access: The personal data we hold about you is provided by your unit. We can let you know which categories of data we collect but you will need to contact your unit directly for a copy of the information as they are data controllers of your patient record.
Right to Erasure and Right to Object: The right of erasure does not apply to this audit because your data is being processed for the purposes of performing a task in the public interest, which in this case is for ensuring high standards of quality and safety health care. However, if you want to opt out of future audit rounds, please let your unit know and they will remove you from the submission so that we don't receive the data.
Right to rectification of inaccurate data: Any requests to amend or update your personal data should be sent to your unit as data controller. If we receive any requests, we will forward these to the unit.
Right to restriction: Any requests for restriction of processing should be sent to your Trust and they will inform us where applicable.
 

Scotland

We explain a bit more about your rights below:

Right of access: The personal data we hold about you is provided by your unit. We can let you know which categories of data we collect but you will need to contact your unit directly for a copy of the information as they are data controllers of your patient record.
Right to Erasure and Right to Object: The right of erasure does not apply to this audit because your data is being processed for the purposes of performing a task in the public interest, which in this case is for ensuring high standards of quality and safety health care. However, if you want to opt out of future audit rounds, please let your unit know and they will remove you from the submission so that we don't receive the data.
Right to rectification of inaccurate data: Any requests to amend or update your personal data should be sent to your unit as data controller. If we receive any requests, we will forward these to the unit.
Right to restriction: Any requests for restriction of processing should be sent to your NHS Health Board and they will inform us where applicable.

Isle of Man

We explain a bit more about your rights below:

Right of access: The personal data we hold about you is provided by your unit. We can let you know which categories of data we collect but you will need to contact your unit directly for a copy of the information as they are data controllers of your patient record.
Right to Erasure and Right to Object: The right of erasure does not apply to this audit because your data is being processed for the purposes of performing a task in the public interest, which in this case is for ensuring high standards of quality and safety health care. However, if you want to opt out of future audit rounds, please let your unit know and they will remove you from the submission so that we don't receive the data.
Right to rectification of inaccurate data: Any requests to amend or update your personal data should be sent to your unit as data controller. If we receive any requests, we will forward these to the unit.
Right to restriction: Any requests for restriction of processing should be sent to Manx Care and they will inform us where applicable.

To action any of these rights or if you have any queries related to your privacy, please contact the Manx Care Data Protection Officer at: DPO-ManxCare@gov.im.

More information on GDPR

If you would like to learn more about the information provided above, please visit our page on Understanding GDPR and your data rights. The page also explains common words and phrases used in our privacy notices, and describes our use of artificial intelligence (AI).

Will I have access to the audit report?

Yes, each year, the NNAP produces a parent and carer guide to the audit, called Your baby’s care. The guide is available in English and Welsh. We also produce a poster of results that neonatal units can display on the wall. You can also view the full NNAP national annual report and information about each hospital on NNAP Online. 

Who should I contact for more information?

England and Wales

To find out more about the audit and how your baby’s information is used, please talk to the staff in your neonatal unit. You can also contact the project team at nnap@rcpch.ac.uk or visit our website www.rcpch.ac.uk/nnap. You can also contact the College’s Data Protection Officer if you have queries about how the college processes personal data: information.governance@rcpch.ac.uk

The Healthcare Quality Improvement Partnership (HQIP) is the data controller of the NNAP (jointly with NHS England for English data and Digital Health and Care Wales for Welsh data) and can also be contacted if you have any questions about how your information is being used for the audit. Please direct any queries for the Healthcare Quality Improvement Partnership Data Protection Officer to: communications@hqip.org.uk.

Your NHS Trust or Health Board is the data controller of your baby’s record, so please contact them directly if you have any questions about your baby’s medical record.

You do also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at casework@ico.org.uk if you have concerns about the way your baby’s personal data are being handled.

Scotland

To find out more about the audit and how your baby’s information is used, please talk to the staff in your neonatal unit. You can also contact the project team at nnap@rcpch.ac.uk or visit our website www.rcpch.ac.uk/nnap. You can also contact the College’s Data Protection Officer if you have queries about how the college processes personal data: information.governance@rcpch.ac.uk

The Healthcare Quality Improvement Partnership (HQIP) is the data controller of the NNAP and can also be contacted if you have any questions about how your information is being used for the audit. Please direct any queries for the Healthcare Quality Improvement Partnership Data Protection Officer to: communications@hqip.org.uk.

Your Health Board is the data controller of your baby’s record, so please contact them directly if you have any questions about your baby’s medical record.

You do also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) Scotland at Scotland@ico.org.uk if you have concerns about the way your baby’s personal data are being handled.

Isle of Man

To find out more about the audit and how your baby’s information is used, please talk to the staff in your neonatal unit. You can also contact the project team at nnap@rcpch.ac.uk or visit our website www.rcpch.ac.uk/nnap. You can also contact the College’s Data Protection Officer if you have queries about how the college processes personal data: information.governance@rcpch.ac.uk

The Healthcare Quality Improvement Partnership (HQIP) is the data controller of the NNAP (jointly with NHS England for English data and Digital Health and Care Wales for Welsh data) and can also be contacted if you have any questions about how your information is being used for the audit. Please direct any queries for the Healthcare Quality Improvement Partnership Data Protection Officer to: communications@hqip.org.uk.

Your NHS Trust or Health Board is the data controller of your baby’s record, Please contact the Manx Care Data Protection Officer if you have any questions about your baby’s medical record at: DPO-ManxCare@gov.im

You do also have the right to lodge a complaint with the Information Commissioner’s Office (ICO) at casework@ico.org.uk if you have concerns about the way your baby’s personal data are being handled.

Clinical Team Audit Participants

The NNAP uses audit participant data—such as name, clinical role, place of work, email address, and telephone number—primarily to manage communication and access for the audit. 

UKGDPR requires a legal basis for any processing of personal data. Our legal bases for processing your data are:
Processing is permitted under GDPR on the following legal bases:

• “Public Task” - Where processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller. This is justified through commissioning arrangements which link back to NHS England, NHS Scotland and the Welsh Government.
• “Legitimate Interest”  - Where we have assessed that the benefits of us processing your data are legitimate and not outweighed by your interests or legal rights

We process your data for the following purposes:

• To ensure participants receive essential updates, reports, and requests for data validation, and
• to enable follow-up on audit processes like outlier notifications and annual mailouts.
• To support identity verification for system access, facilitate liaison between units, networks, and the NNAP team, and underpin governance protocols for user management within restricted-access platforms.

All handling of this data aligns with UK data protection requirements and RCPCH’s information governance policies to safeguard confidentiality and ensure appropriate use for audit delivery and quality improvement.

Y Rhaglen Archwilio Newydd-anedig Genedlaethol: Gwybodaeth am eich baban – Hysbysiad preifatrwydd / Welsh Language Speakers

Mae’r Rhaglen Archwilio Newydd-anedig Genedlaethol (NNAP) yn helpu unedau babanod newydd-anedig i wella’r gofal maent yn roi i fabanod sydd angen triniaeth arbenigol. Mae hyn yn cynnwys babanod a enir yn rhy gynnar, sy’n isel eu pwysau adeg geni neu sydd â chyflyrau meddygol sy’n galw am driniaeth arbenigol. Byddwn yn defnyddio gwybodaeth am ofal eich baban i helpu unedau babanod newydd-anedig yn Lloegr, yr Alban, Cymru ac Ynys Manaw i wella’r gofal a’r canlyniadau i fabanod eraill.

Defnyddio gwybodaeth am eich baban yn y Rhaglen Archwilio Newydd-anedig Genedlaethol 

Tra bydd eich baban yn yr uned babanod newydd-anedig, bydd y staff yn cofnodi gwybodaeth mewn cofnod electronig. Maent yn defnyddio hyn i ofalu am eich baban, ac i helpu’r gwasanaeth iechyd i redeg yn dda. Mae pob uned i fabanod newydd-anedig yn defnyddio cofnodion electronig. Bydd partneriaid y tu allan i’r ysbyty yn defnyddio’r wybodaeth hon i wella gwasanaethau i’r newydd-anedig trwy archwilio ac ymchwil; mae hyn yn cynnwys y Rhaglen Archwilio Newydd-anedig Genedlaethol.

Beth yw’r Rhaglen Archwilio Newydd-anedig Genedlaethol?

Mae’r Rhaglen Archwilio Newydd-anedig Genedlaethol (NNAP) yn cael ei rhedeg gan y Coleg Brenhinol Pediatreg ac Iechyd Plant (RCPCH). Rydym wedi ein comisiynu gan y Bartneriaeth Gwella Ansawdd Gofal Iechyd (HQIP) ac fe’n cyllidir gan NHS England, Llywodraeth yr Alban, Llywodraeth Cymru a Manx Care (Ynys Manaw).

Mae’r Rhaglen Archwilio Newydd-anedig Genedlaethol yn helpu unedau babanod newydd-anedig i wella’r gofal maent yn roi i fabanod sydd angen triniaeth arbenigol. Byddwn yn defnyddio gwybodaeth am ofal eich baban i helpu unedau babanod newydd-anedig yn Lloegr, yr Alban a Chymru i wella’r gofal a’r canlyniadau i fabanod eraill. 

Rydym yn edrych i weld a yw babanod ynd erbyn gofal cyson, o ansawdd uchel, a yw babanod yn cael y gwiriadau iechyd a argymhellir er mwyn lleihau’r risg o gymhlethdodau, ac yn monitro pa mor dda y mae babanod yn gwneud wedi’r gofal hwn.

Pa ddata mae’r NNAP yn gasglu?

Bydd staff yr uned babanod newydd-anedig yn rhoi gwybodaeth am eich baban ar system gofnodi electronig ddiogel o’r enw BadgerNet. Mae pob uned babanod newydd-anedig yn rhannu gwybodaeth o’r cofnodion electronig hyn gyda thîm prosiect yr NNAP sydd yn yr RCPCH, trwy brosesydd arall, System C, sy’n rheoli’r system BadgerNet a ddefnyddir gan uendau babanod newydd-anedig i gofnodi data clinigol. Mae hyn yn cynnwys data personol categori arbennig a data y mae modd adnabod rhywun, gan gynnwys rhif GIG neu CHI (Baban a Mam), Dyddiad ac amser derby i ofal newydd-anedig (Baban), Dyddiad ac amser gadael gofal newydd-anedig (Baban), Dyddiad ac amser geni (Baban), Dyddiad marwolaeth (Baban), Dyddiad geni (Mam), Ethnigrwydd (Mam), Rhyw (Baban), Cod post y cyfeiriad arferol (Mam), gwybodaeth am y gofal a derbyniodd y fam a’i baban ac unrhyw gyflyrau iechyd cysylltiedig. Bydd tîm prosiect yr NNAP yn defnyddio’r wybodaeth yn unig at ddibenion y Rhaglen Archwilio Newydd-anedig Genedlaethol i fonitro a cheisio gwella safonau gofal i gleifion.

Mae gwybodaeth yn cael ei storio’n ddiogel a’i ddefnyddio yn unol â deddfwriaeth Diogelu Data y DU a Rheoliadau Gweithredu GDPR ac LED Ynys Manaw 2018. Mae’r NNAP yn cynnal dadansoddiad o ddata NNAP yn unig unwaith i’r holl wybodaeth sy’n peri adnabod unrhyw un gael ei dynnu ymaith.

Mae’r RCPCH a’i bartneriaid yn teimlo ei fod er lles babanod a’u teuluoedd i brosesu’r wybodaeth hon er mwyn gwella’r gofal mae babanod yn dderbyn. Mae ein partneriaid yn cynnwys rhieni a mudiadau sy’n cynrychioli rhieni, megis Bliss, yr elusen sy’n hyrwyddo hawl pob baban a enir yn gynamserol neu’n sâl i dderbyn y gofal gorau trwy gefnogi teuluoedd, ymgyrchu dros newid, cefnogi gweithwyr proffesiynol, a galluogi ymchwil a all newid bywydau.

Sail gyfreithiol dros brosesu data am gleifion

Mae gan yr NNAP ganiatad adran 251 i gasglu data lle gellir adnabod cleifion yng Nghymru a Lloegr heb ganiatad penodol y cleifion gan fod eu nod er budd y cyhoedd oherwydd y bydd yr archwiliad yn helpu i wella safonau gofal i’r newydd-anedig, sicrhau y bydd safonau ac ansawdd uchel gofal i’r newydd-anedig yn parhau. I ganfod mwy am ganiatad adran 251, ewch at wefan yr Awdurdod Ymchwil Iechyd.

Caniateir prosesu dan y Rheoliad Diogelu Data Cyffredinol (GDPR) ar y seiliau cyfreithiol canlynol:

Erthygl 6 (1) (e) mae prosesu yn angenrheidiol er mwyn gwneud tasg a wneir er budd y cyhoedd neu wrth arfer awdurdod swyddogol a freinir yn y rheolydd. Mae hyn yn cael ei gyfiawnhau trwy drefniadau comisiynu sy’n cysylltu’n ôl ag NHS England a Llywodraeth Cymru.

Erthygl 9 (2) (i) mae prosesu yn angenrheidiol am resymkau budd y cyhoedd ym maes iechyd cyhoeddus. Mae hyn yn cael ei gyfiawnhau gan mai nod yr NNAP yw sbarduno gwelliannau yn ansawdd a diogelwch gofal ac i wella deilliannau i gleifion.

Yr ydym hefyd yn gwarchod eich hawliau preifatrwydd trwy roi’r gallu i chi ddewis i’ch data beidio a chael ei gynnwys yn yr archwiliad.

Fydd data personol fy maban yn cael ei rannu?

Mae’r NNAP yn cyhoeddi data ar ffurf wedi ei wneud yn ddienw ac wedi ei gyfanredu. Ni fydd modd adnabod unrhyw faban unigol yn unrhyw rai o’n hadroddiadau. 

Rhennir data yn unig gyda chaniatad HQIP. I HQIP gymeradwyo’r cais, rhaid i’r sawl sy’n gwneud y cais allu dangos cydymffurfio â pholisiau a threfniadau diogelu data llym, a rhaid i amcanion yr ymchwil gael eu cymeradwyo, yn ôl canllawiau HQIP i ymgeiswyr.

Ar gyfer Lloegr yn unig, rydym hefyd yn rhannu ac yn derbyn data gan Asiantaeth Diogelwch Iechyd y DU (UKHSA) at ddiben adrodd am gyfraddau o heintiadau llif y gwaed mewn unedau babanod newydd-anedig. 

Am fwy o wybodaeth am y modd y gellir rhannu data, gweler hysbysiad preifatrwydd HQIP NCAPOP: https://www.hqip.org.uk/about-us/privacy-notice/.
 
Ni chaiff data personol ei drosglwyddo i wlad na thiriogaeth y tu allan i’r DU oni fydd y wlad neu’r diriogaeth honno yn sicrhau lefel ddigonol o ddiogelwch i hawliau a rhyddid gwrthrychau data yng nghyswllt prosesu data personol. Ni fydd modd adnabod unrhyw faban unigol yn unrhyw rai o’n hadroddiadau. 

Am ba hyd y delir y data?

Mae tîm yr NNAP yn yr RCPCH yn gweithredu fel y prosesydd data ar ran y Bartneriaeth Gwella Ansawdd Gofal Iechyd (HQIP), sydd wedi ein contractio ni i gynnal yr archweiliad hwnh, a hwy yw’r rheolyddion data ar gyfer data’r NNAP. 

Mae HQIP yn rheolydddion data ar y cyd gydag NHS England ar gyfer data’r NNAP yn Lloegr a chydag Iechyd a Gofal Digidol Cymru (DHCW) ar gyfer data’r NNAP yng Nghymru. Bydd yr RCPCH yn dal data’r NNAP cyhyd ag y caiff ei gomisiynu i gyflwyno prosiect yr NNAP gan HQIP. 

Bydd pob data yn cael ei ddileu neu ei drosglwyddo’n ôl i HQIP ymhen pythefnos o derfyn ein contract. Os bydd HQIP yn comisiynu’r RCPCH i gyflwyno’r NNAP dan gontract newydd neu estynedig, yna cedwir y data am gyfnod y contract newydd.

Fyddwch chi’n gofyn caniatad i ddefnyddio data fy maban?

Mae gwybodaeth am yr holl fabanod a dderbynir i uned babanod newydd-anedig y GIG yn cael ei gynnwys fel arfer yn yr NNAP. Mae’n bwysig ein bod yn cynnwys gwybodaeth am bob baban sy’n cael ei drin gan uned babanod newydd-anedig fel bod yr NNAP yn cynrychioli gofal newydd-anedig yn iawn yn y DU. 

Oherwydd bod nifer fawr o fabanod yn rhan o hyn, nid yw’n ymarferol ceisio caniatad pob teulu. Gallwch ddewis i wybodaeth am eich baban beidio â chael ei ddefnyddio at ddiben yr NNAP. Os hoffech wneud y dewis hwnnw, yna dywedwch wrth staff yr uned babanod newydd-anedig lle mae eich baban yn derbyn gofal. 

Byddant yn gwneud yn siwr na chynhwysir gwybodaeth eich baban yn yr NNAP. Gallwch gael gair hefyd gyda thîm yr NNAP i ganfod sut i optio allan trwy gysylltu â nnap@rcpch.ac.uk neu ein ffonio ni ar 0203 861 1910.

Eich hawliau data

Mae ychydig mwy o esboniad am eich hawliau isod:

Hawl mynediad: Mae’r data personol a ddelir gennym amdanoch chi yn cael ei ddarparu gan eich uned. Gallwn roi gwybod i chi pa gategoriau o ddata a gasglwn ond bydd angen i chi gysylltu’n uniongyrchol â’ch uned am gopi o’r wybodaeth gan mai hwy yw rheolwyr data eich cofnod fel claf.

Hawl i Dileu a Hawl i Wrthwynebu: Nid yw’r hawl i didleu yn gymwys i’r archwiliad hwn gan fod eich data yn cael ei brosesu at ddibenion gwneud tasg sydd er budd y cyhoedd, sef yn yr achos hwn, sicrhau safonau uchel o ansawdd a diogelwch mewn gofal iechyd. Fodd bynnag, os ydych am optio allan o rowndiau archwilio yn y dyfodol, rhowch wybod i’ch uned ac fe fyddnat hwy yn eich tynnu allan o’r cyflwyniad fel na fyddwn ynd erbyn y data.

Hawl i gywiro data anghywir: Dylai unrhyw geisiadau i newid neu ddiweddaru eich data personol gael eu hanfon at eich uned fel rheolwr data. Os byddwn yn derbyn unrhyw geisiadau, byddwn yn eu hanfon ymlaen at yr uned.

Hawl i gyfyngu:  Dylid anfon ceisiadau am gyfyngu prosesu at eich Ymddiriedolaeth a fe fyddant hwy yn rhoi gwybod i ni lle bo hynny’n gymwys.

Mwy o wybodaeth am GDPR

Os hoffech wybod mwy am y wybodaeth a ddarperir uchod, ewch at ein tudalen Deall mwy am GDPR a’ch hawliau data. Mae’r dudalen hefyd yn esbonio geiriau ac ymadroddion cyffredin a ddefnyddir yn ein  hysbysiadau preifatrwydd, ac yn disgrifio sut yr ydym yn defnyddio deallusrwydd artiffisial (AI).

Fydda’i yn gallu mynd at adroddiad yr archwiliad?

Byddwch; bob blwyddyn, mae’r NNAP yn cynhyrchu canllaw i rieni a gofalwyr am yr ymchwiliad, a elwir yn  Gofal eich baban. Mae’r canllaw ar gael yn Gymraeg ac yn Saesneg. Rydym hefyd yn cynhyrchu poster o ganlyniadau y gall unedau babanod newydd-anedig arddnagos ar y wal. Gallwch hefyd weld adroddiad blynyddol llawn yr NNAP a gwybodaeth am bob ysbyty ar NNAP Online. 

 phwy y dylwn i gysylltu am fwy o wybodaeth?

I wybod mwy am yr archwiliad a sut y defnyddir gwybodaeth am eich baban, mynnwch air â staff eich uned babanod newydd-anedig. Gallwch hefyd gysylltu â thîm y prosiect ar nnap@rcpch.ac.uk neu fynd at ein gwefan www.rcpch.ac.uk/nnap. Gallwch hefyd gysylltu â Swyddog Diogelu Data’r Coleg os oes gennych gwestiynau am y modd mae’r coleg yn prosesu data personol: information.governance@rcpch.ac.uk

Y Bartneriaeth Gwella Ansawdd Gofal Iechyd (HQIP) yw rheolwr data’r NNAP (ar y cyd ag NHS England ar gyfer data Lloegr ac Iechyd a Gofal Digidol Cymru ar gyfer data yng Nghymru) a gellir cysylltu â hwy os oes gennych unrhyw gwestiynau am y modd y defnyddir eich gwybodaeth ar gyfer yr archwiliad. Anfonwch unrhyw ymholiadau i Swyddog Diogelu Data y Bartneriaeth Gwella Ansawdd Gofal Iechyd at: communications@hqip.org.uk.

Eich Ymddiriedolaeth GIG neu Fwrdd Iechyd yw rheolwr data cofnod eich baban, felly cysylltwch â hwy yn uniongyrchol os oes gennych unrhyw gwestiynau am gofnod meddygol eich baban.

Mae gennych hawl hefyd i gyflwyno cwyn gyda Swyddfa’r Comisiynydd Gwybodaeth (ICO) yn casework@ico.org.uk  os oes gennych bryderon am y modd y mae data personol eich baban yn cael ei drin.

Bliss yw’r elusen yn y DU sy’n gweithio i sicrhau fod gan bob baban a enir yn gynamserol neu’n sâl yn y DU y cyfle gorau am orosesi a chael ansawdd bywyd da. Mae Bliss yn llwyr gefnogi’r Rhaglen Archwilio Newydd-anedig Genedlaethol . Am fwy o wybodaeth am Bliss ewch at: www.bliss.org.uk.

Cyfranogwyr yn yr Archwiliad Timau Clinigol

Mae’r NNAP yn defnyddio data am gyfranogwyr yn yr archwiliad—megis enw, rôl glinigol, man gwaith, cyfeiriadau ebost, a rhifau ffôn—yn bennaf i reoli cyfathrebu a mynediad at yr archwiliad audit. 
Mae UKGDPR yn mynnu sail gyfreithiol ar gyfer prosesu unrhyw ddata personol. Dyma’n seiliau cyfreithiol ni ar gyfer prosesu eich dataare:

“Tasg Gyhoeddus” – Lle mae prosesu’n angenrheidiol i wneud tasg a gyflwnir er budd y cyhoedd neu wrth arfer awdurdod swyddogol a freiniwyd yn y rheolwr. Mae hyn wedi ei gyfiawnhau trwy drefniadau comisiynu sy’n cysylltu’n ôl ag NHS England, NHS Scotland a Llywodraeth Cymru.

• “Diddordeb Cyfreithlon”  - Lle’r ydym wedi asesu bod y budd i ni o brosesu eich data yn gyfreithlon a heb eu gorbwyso gan eich buddiannau chi na’ch hawliau cyfreithiol

Yr ydym yn prosesu eich data at y dibenion canlynol:

• I wneud yn siwr fod cyfranogwyr yn derbyn diweddariadau ac adroddiadau hanfodol, a cheisiadau am ddilysu data, ac
• I allu dilyn i fyny ar brosesau archwilio fel hysbysiadau allanol a gohebiaeth flynyddol.
• I gefnogi systemau gwirio hunaniaeeth er mwyn cyrchu systemau, hwyluso cyswllt rhwng unedau, rhwydweithiau, a thîm yr NNAP, a bod yn sail i brotocolau llywodraethiant i reoli defnyddwyr o fewn llwyfannau lle mae mynediad wedi ei gyfyngu.

Mae pob dull o drin y data hwn yn cydfynd a gofynion diogelu data y DU a pholisiau llywodraethiant gwybodaeth yr RCPCH er mwyn diogelu cyfrinachedd a sicrhau defnydd priodol ar gyfer cyflwyno archwiliadau a gwella ansawdd.

Changes to this privacy notice

We review our privacy notices regularly and any updates to this notice will be made here.

Last updated 1 December 2025