This privacy statement provides information about the personal information that Aberdeen Fertility Centre collects, and the ways in which your personal information is used.

Identity of controller and the data protection officer

The organisation responsible for your personal information in terms of data protection legislation is the University of Aberdeen. The University is licensed to operate the Aberdeen Fertility Centre by the Human Fertilisation and Embryology Authority.

Any enquiries relating to data protection should be made to the University’s Data Protection Officer. The Data Protection Officer can be contacted by email at dpa@abdn.ac.uk.

The information being collected and used

The Centre collects the following personal information about patients and donors:

- First name, surname, date of birth, age, sex

- How and by whom the patient or donor has been identified

- Services provided to the patient or donor

- Medical history

- Welfare of the child assessment

- Consent for services

- Clinical and laboratory data

Purpose of the processing and legal basis

The Centre processes personal information for two purposes:

1. To provide fertility services

Collecting and using personal information for this purpose enables the Centre to treat patients on behalf of the NHS.

Legal basis: Personal information is processed with the consent of data subjects, in the provision of health care, in the performance of a task carried out in the public interest by the University, and under the Centre’s legal obligation to manage personal information.

2. To provide data for academic research and publication

Sharing information for academic research, and publishing the results of the research, increases understanding about fertility, infertility, diseases or medical conditions and helps the effective treatment of patients.

All research projects that request use of information held by the Centre are independently checked by the NHS Research Ethics Committee. Any information approved for use in research is fully anonymised before being given to the research project. No information that identifies an individual will be used or published.

Legal basis: The University of Aberdeen processes personal information for academic research and publication in performing its official duties and as a task in the public interest.

Whether the provision of personal data is a statutory or contractual requirement or obligation and possible consequences of failing to provide the personal data

The Centre is required to process personal information of donors, patients and partners in accordance with the Human Fertilisation and Embryology Acts. This is a condition of the University’s licence to operate the Centre.

Any recipient or categories of recipients of the personal data

The Centre shares your personal information in the following ways:

-Your personal information and details of your treatment are shared with your GP, with your consent.

-Your personal information and details of your treatment are shared with the Human Fertilisation and Embryology Authority in accordance with the Centre’s licence and the legal obligations of the Human Fertilisation and Embryology Acts.

Your name, address, date of birth and CHI number are shared with the University finance department in order to raise invoices for those paying their own treatment. Your CHI number is shared with your health board and the Centre’s auditor in order to administer the Centre’s services. No details of your treatment are shared with these partners.

Your personal information may be shared with the Grampian Data Safe Haven so that it can be anonymised and used for health research.

The Centre uses third parties to process personal information on its behalf in order to administer the Centres' services. All third parties are subject to security checks and a data processing contract.

Retention period or criteria used

Personal information is retained for a minimum of 30 years after clinical use. This period may be varied by Directions given under the Human Fertilisation and Embryology Acts.

Data subject rights

You have the following rights over your personal information under data protection legislation:

- The right of access to your personal information

- The right to correction of inaccurate personal information

- The right of erasure of your personal information

- The right to restrict use of your personal information

- The right of portability of your personal information

- The right to withdraw consent or to object to the processing of your personal information

Please note that there are conditions attached to these rights. The rights do not apply to all circumstances. This means the University may not be able to comply with requests to change or delete your personal information, or to withdraw consent or object to processing.

Right to complain to supervisory authority

If are dissatisfied with the way your personal information has been handled, you have the right to lodge a complaint with the Information Commissioner. The Information Commissioner’s Office can be contacted via their website at www.ico.org.uk/concerns/