IBD Registry Closure FAQs

The future ownership of the data, tools, and other assets is under careful consideration, ensuring compliance with legal and data protection obligations. We understand especially patients want to understand possible pathways for the data, and this will be clearly communicated to the key patient stakeholders to maintain the high standards of data transparency that the IBD Registry has always upheld.

The IBD Registry also holds a set of anonymised study datasets (these are specific subsets of the main dataset that were used in research and other studies). Best practice in research and studies is that the same analysis can be done again (reproduced) if needed, to show that the study findings were robust.  For this, it is envisaged that each study dataset will be securely returned to the academic lead or clinical centre for the study, in line with best practice and to provide reproducibility for the study if required.

The final decisions on the data will be considered by the IBD Registry Board of Directors, who will make a recommendation to the governing Member organisations of the IBD Registry for final approval.

Discussions are underway with a selected group of appropriate organisations, to a ensure a safe, secure and trusted home for the data, so that any decisions are well-informed.

We will be guided closely by our Data Protection Officer to ensure compliance with all legal requirements in our decision-making, including GDPR. We will also seek guidance and approval as required from key regulatory bodies, such as the Confidentiality Advisory Group and Health Research Authority.

Communications with stakeholders, especially people with IBD, will take place during the upcoming closing period.  We will also be consulting closely with our Patient Advisory Group, and guided closely by our Caldicott Guardian who represents the patient within the clinical community.

The IBD Registry is closing current activities by Easter 2024, and is in discussions through Spring 2024 for transition to an NHS organisation. Please use [email protected] for clinical or industry enquiries, and [email protected] for public and patient enquiries.

The data, tools and other assets are being transferred to a safe haven organisation, whilst discussions are underway with partners on a permanent home for the data. The IBD Registry website will remain available, with updates posted there. Any contact points required will also be listed there as well.

11 MAR 24 – We remain contactable in Spring 2024. Please use [email protected] for clinical or industry enquiries, and [email protected] for public and patient enquiries.

The IBD Registry has collaborated with over 170 hospital teams and over 60,000 patients across the UK to create 5 primary datasets for quality of care improvement and research. These have contributed to published papers and presentations at national and international meetings, as well as producing national reports and reports for individual IBD teams.  There are more details on our story here.

Current outstanding projects are being completed in the coming months to March 2024, so that we expect to close with all contracts and obligations fulfilled.

We are working with key partners to establish the best possible way to transfer and integrate the data, tools and know-how, so that the ongoing benefit to people with IBD can continue.

We have now just completed the current data collection year (2023) for the Quality Accounts year 2023-24; and are preparing for participating hospitals and IBD teams their annual Quality Accounts report.  We anticipate delivering this by early March 2024 at the latest, to allow time for any queries back.

The current plans are that both will be decommissioned by the end of March 2024. We are contacting all WebTool users to make arrangements for transferring their data to their IBD team. For the KPIs Tool, we have been exploring whether this could be continued by another organisation, but this is looking unlikely. It is possible for a Trust with an existing REDCap installation and technical capability to set up a local version of this if wished. If this is of interest to you, please contact [email protected].

The Cerner IBD Registry module has been developed independently (but based on the IBD Registry dataset definition) by IBD clinicians together with Cerner; and allows a Trust using the Cerner eHR system to download a module designed for IBD. It is live for use, and for details please contact: [email protected].

The current activities of our Patient Advisory Group (PAG) are being sustained until March 2024, to support our goal of embedding patient voice in the processes during this period. However, following this period, the PAG will be disbanded. We extend our sincere gratitude to all our members for their dedication and hard work throughout this journey.

For patients that have consented, they will be contacted directly using the email address that they gave us with information and options. For those patients that gave us a mobile phone number, we will use that for contact, and for those who gave a home address as preference we will use post.

Anyone who has consented to the IBD Registry can withdraw their consent in the usual way, up until early March 2024.

Communication: We will use your contact information to contact you to keep you informed and updated about the closure process. 

Data storage: We may anonymise your data and/or process your data into a format that is more secure for storage and transfer. 

Completion of Projects: We are in the process of finalising the remaining quality improvement and research projects. 

To maximise the legacy of the Registry’s work and your contributions to improving the care and treatments that people with IBD receive, we are in discussions with suitable organisations about a future long-term home for our data (see below for an update).

We want to keep everyone who has engaged with us up to date with plans.  A number of studies and contacts have been anonymous, which means we don’t hold any contact information, and so we will publicise in newsletters and other public means.

For participants who have consented to join the IBD Registry, we will be sending out individual emails (or other preferred contact method) to keep you updated with plans for your personal data held in our records.

UPDATE 14 FEBRUARY 2024:

Our data assets, including personal data, will be securely transferred to the Royal College of Physicians (RCP) who will act as interim stewards for the safeguarding of the data and other assets.  The RCP will take over responsibility for the safeguarding of the data and become the new Data Controller.

The Royal College of Physicians exists to improve the practice of medicine, and is one of our founding member organisations. They have an extensive history of clinical audit and health database management, as well as excellent Data Security Standards and Cyber Essentials Certification. The original IBD Audit (the predecessor of the current IBD Registry) was held and managed by the RCP.  They are registered with the ICO, and their privacy policy can be found here.

The IBD Registry has collected a valuable set of data assets for the purpose of improving the care and treatments that people with IBD receive, supporting research, and increasing the information available about IBD.  There are discussions underway already with appropriate organisations about a future long term and active home for the data. Secure data movements take careful planning and a respected interim safe haven (the RCP) was thought the best option to allow the time needed to find the best fits for the data and tools, to maximise the legacy of the Registry’s work. As interim data stewards, the RCP is holding the dataset on a closed and inactive basis, with no data processing taking place.

No personal data processing will be performed by the RCP. The RCP are acting strictly as interim stewards for safeguarding the data, which will be held on an inactive basis as a closed dataset. As such, there is no ongoing or regular processing of personal data planned at the RCP.

We are in discussions with a potential suitable organisation for a long-term home for all data assets where personal data processing may occur. We will contact data subjects if any personal data processing is planned.

We perform data protection risk assessments for all data processing, which includes the closure of the Registry. This process includes considering where we can use privacy-enhancing technologies at any point in the process, to better protect the confidentiality of personal records.

You have all the usual rights under GDPR. The key right related to the proposed transfer is your right to object and to request that your data be withdrawn before this takes place.  Please see below for details of how to do this.  To learn more about your data rights please visit our privacy policy page. More information can be found on the Information Commissioner’s website

You can make a request for a copy of your data in any form. The best way to request this is to use our Data Subject Rights Portal, an online form that includes useful information to explain the process and request a copy of your data or deletion of your data.

The data will be returned to you electronically using a secure download link. Further instructions and guidance will be sent to you after you submit a request.

UPDATE 14 FEB 24 – DEADLINE EXTENDED TO 27 FEB 2024

The deadline for requests is 27 February 2024 to allow time for us to process your request.

UPDATE 29 FEB 24:

Our Data Subject Rights Portal is offline. The deadline for making requests to access or to delete your personal data was 27 February 2024. As we prepare our IT systems and databases for closure, it may not be feasible to process data requests. Requests will be still considered on a case-by-case basis, depending on the complexity and number of requests received. To make a request, please email [email protected]

You can make a data deletion request in any form. The best way to request this is to use our Data Subject Rights Portal, an online form that includes useful information to help you understand and request a copy of your data or deletion of your data.

UPDATE 14 FEB 24 – DEADLINE EXTENDED TO 27 FEB 2024

The deadline for requests is 27 February 2024 to allow time for us to process your request.

UPDATE 29 FEB 24:

Our Data Subject Rights Portal is offline. The deadline for making requests to access or to delete your personal data was 27 February 2024. As we prepare our IT systems and databases for closure, it may not be feasible to process data requests. Requests will be still considered on a case-by-case basis, depending on the complexity and number of requests received. To make a request, please email [email protected]

If you are not happy that your personal data will be transferred to the RCP, we can delete your data before the transfer.  You will need to make a data deletion request using our Data Subject Rights Portal. You can also request a copy of your data using this portal.

The deadline for requests is 27 February 2024 to allow time for us to process your request.

UPDATE 29 FEB 24:

Our Data Subject Rights Portal is offline. The deadline for making requests to access or to delete your personal data was 27 February 2024. As we prepare our IT systems and databases for closure, it may not be feasible to process data requests. Requests will be still considered on a case-by-case basis, depending on the complexity and number of requests received. To make a request, please email [email protected]

Yes, please contact us at 1 St Andrews Place, Regent’s Park, London or call us on our office number  (see bottom of the webpage) for further information. The deadline for postal requests is 5 March 2024.

You will need to provide your NHS number and date of birth so that we can match your personal data in our records. (if you are in Scotland or Northern Ireland your NHS Number is called a CHI number or HSC number).

You will also need to provide a valid email address (or if email is not possible, phone or postal address) so that we can contact you.

Your NHS number may be found on the top of any correspondence from your GP (doctor) or your hospital. It is also available on the NHS App, if you have this.  Alternatively, if you have forgotten your NHS number, you can use the NHS’s NHS Number finder service.

We will need to keep a record of this minimum set of your personal information to document and process your data requests.

The deadline for requests is 27 February 2024 to allow time for us to process your request.

You may still submit data related requests to the IBD Registry after the deadline of 27 February 2024. We will still consider each request on a case-by-case basis depending on the volume of requests and the complexity of your request. We may be able to fulfil basic requests, for example, “delete me from your mailing list”.

Our Data Subject Rights Portal will be unavailable from 28 February 2024. Before 31 March 2024, please email us at [email protected].

Once the data has transferred to the RCP (from 1 April 2024), any further enquiries regarding the data should be directed to them. You can contact the RCP data protection team from 1 April 2024 at [email protected].