Privacy notice - BPSU

This privacy notice covers the personal data of the BPSU clinical respondents who contribute to the BPSU epidemiology system. This privacy notice does not cover the use of clinical data or the legal grounds for processing it.

Privacy details on the clinical data collected by the study teams is available on the specific study web pages and corresponding Patient Information Leaflets.

Who are we?

We are the British Paediatric Surveillance Unit (BPSU), based at the Royal College of Paediatrics and Child Health (RCPCH), 5-11 Theobalds Road, London WC1X 8SH (telephone: +44 (0)20 7092 6000).

The BPSU was formed in 1986 to faciltate the epidemiological surveillance of rare paediatric conditions and events across the UK and Ireland. It has three partners, the RCPCH, University College London Great Ormond Street Institute of Child Health and Department of Health and Social Care. They are known as the data controllers and are the organisations responsible for ensuring your data is properly managed. The BPSU also receives support from the Royal College of Physicians Ireland. Great Ormond Street Hospital Children’s Charity also contributes financially to the activity.

For further information on the BPSU you can contact the BPSU by email:

The BPSU information governance is overseen by RCPCH Data Protection Officer is contactable via emailing:

What information do we collect from you?

For those clinicians contributing to the BPSU ‘report system’, the following details are held: name; hospital address; trust / NHS email and an alternative email; paediatric specialty; monthly response rates; and case conditions reported. 

Through the ‘electronic report card’, BPSU collect a monthly report from ‘reporting clinicians’ as to whether or not they have seen a case for a condition that we are carrying out surveillance for; comments from ’reporting clinicians’ to be used to update their contact details, eg retirement or change of email or of work address. 

All information is supplied by the clinician.  New clinicians to be included on the system are identified via the Certification of Completion of Training lists and via Advisory Appointments Committee as supplied by the RCPCH training and governance divisions, or through 'signing up' to receive the 'report card'. We will initially contact all new clinicians on the 'reporting system' as it is in the public interest to inform them about the BPSU 'reporting card' which enables us to collect information on a number of rare or uncommon disorders. Reporting clinicians can opt out of receiving the 'reporting card' at any time.

Why do we collect this information?

Though compliance with the BPSU rare disease 'reporting system' is voluntary, we strive for full participation as there is a clear public interest in undertaking this work. By contributing to the reporting system, you are agreeing for the information that we collect to be used for the following purposes:

  • To facilitate and support the national disease screening programmes
  • To facilitate and support national monitoring of statutory reportable paediatric disease
  • To facilitate monitor the impact of public and child health programmes e.g. vaccine introduction
  • Monitoring your compliance to the BPSU ‘reporting system’
  • Monitor regional compliance rates
  • Monitor regional case reports to allow for identification of possible case under ascertainment
  • To send re-validation certificate to those who contribute
  • Where you have returned a 'reporting card to us, we will continue to inform you of BPSU activities and events via receipt of e-newsletter as it is in our legitimate interest to do so. You can opt out of this at anytime by letting us know if you no longer want to receive it by emailing:
  • Although we ask that you keep us up to date with any changes to your contact details, we may contact you from time to time via post, email or telephone, to check if the details we hold on file are still correct.
  • BPSU are only responsible for managing the contact details of clinicians for the purposes of reporting. Any requests or queries relating to research data, must be directed to the BPSU office who will in turn inform the HIC team as the BPSU acts as the data controller and HIC is the data processer. If you are unsure about which research team holds relevant data please contact the BPSU office who will notify the relevant research team.

Who might we share your information with?

  • Notification of ‘case reports’ are sent to the respective ‘research team’ so they can communicate with you and collect further data on the ‘case report’. The information passed to the ‘research team’ is name; hospital address; and trust/NHS email or alternative email. Please note all BPSU facilitated studies have the appropriate ethics and governance requirements, further information on these approvals can be found on the respective study web pages. Confirmation of a case is then conveyed back to the BPSU from the ‘research teams’. The BPSU holds no clinical details whatsoever on the case.
  • Collated ‘regional response rates’ and ‘case reports’ are published in an annual report. No identifiable information is communicated in this process.
  • All information is held in the strictest confidence as outlined in the BPSU’s Confidentiality Advisory Group and Public Benefits Privacy Panel approvals.
  • From time to time the BPSU may ask you to participate in a snapshot survey which are voluntary and ask for data about a particular issue. The responses to the survey may be shared with research teams or teams within the college where it is within our legitimate interest to do so. This data is then used for publications or reports.

The BPSU will never publish raw data. When publishing, any data that could be used to identify you will be removed or changed and only anonymised data will presented.

What do we do with your information?

We sometimes use third party suppliers to provide us with products and services and they will also process your personal data on our behalf. .We use HIC’s system (privacy notice found here) to provide us with the reporting system and we sometimes use Microsoft forms (privacy notice found here). Redcap and HIC provide us with surveys. 

Your personal data will not be transferred outside of the European Economic Area.  

How can I access the information you hold about me?

Under GDPR you have certain rights in regards to the data we hold about you. You can ask us to delete your personal data (called a right to be forgotten), change any inaccuracies, restrict what we use your personal data for or ask us to stop processing your personal data. You can also request that the data we hold about you is given back to you or given to another service provider in a commonly used format. This is called data portability. You are entitled to ask for a copy of the data we hold about you as well. However, there are some restrictions which apply to these requests, such as if we have an overriding legal obligation to keep the data.

To find out more about your rights visit the ICO website or to make a request contact the Data Protection Officer: or write to the Information Governance Manager, RCPCH, 5-11 Theobalds Road, London WC1X 8SH.

In accordance with Data Protection Legislation, we have a legal duty to protect any information we collect from you and we have measures in place to ensure your data is securely and safely stored.

You have the right to complain to the ICO if you have concerns about the way your personal data is being handled:

How long do we keep hold of your information for?

We will use your information for as long as you participate in the BPSU reporting scheme. We will contact you periodically to check if you are still happy to participate in the BPSU. As soon as you withdraw consent, we shall suppress your details. If we do not have a response, we will remove you from our list. You can rejoin at any time by completing this form: Any personal data we collect in relation to a reported case may be retained for 20 years and then is reviewed for permanent preservation for historical research purposes, in line with current MRC guidance. Any data collected for snap short surveys may be retained for 10 years under the same MRC guidance after which it is reviewed.

If you opt out of receiving our e-reporting scheme, we will suppress your details. If you opt out we will suppress your details so we can keep a record that you opted out. Should you wish to have the information we have on you deleted please refer to the ‘How can I access the information you hold about me?’ section.

Contact details for further information

For further information on the BPSU you can contact the BPSU by email:

The BPSU information governance is overseen by RCPCH Data Protection Officer is contactable via emailing: