How we use patient data

The importance of medical records to improve public health

Research is important to the NHS and benefits us all, whether we are fit and healthy or suffering from an illness or condition. Research helps our understanding of the causes, prevention and treatment of disease and to improve the health care we receive.

Whenever you visit your doctor or use an NHS service, your electronic health record is updated. This record contains important information about your health and wellbeing and describes the care that you have received, which is vital for medical research.

For more than 30 years, GP practices across the UK have contributed de-identified health information within patient records to CPRD for medical research such as:

CPRD is an official supporter of Understanding Patient Data, an initiative to support better conversations about the uses of health information. Its aim is to explain how and why data can be used for care and research, what’s allowed and what’s not, and how personal information is kept safe. The initiative works with patients, charities and healthcare professionals to champion responsible uses of data. The Understanding Patient Data website has more information about how and why data is vital for your individual care, and to improve health, care and services across the NHS.  

See how patient data is being used to benefit medical research 

Research using CPRD data has provided evidence for drug safety guidance and improved healthcare delivery. More than 2,600 public health studies have been published using CPRD data. See examples about how CPRD has used anonymised data to benefit patient and public health.

View the list of approved applications of studies using CPRD data. 

Protecting your identity and confidentiality

Your confidential information is protected in the following ways:

  • You cannot be identified from the information sent to CPRD from your GP practice. CPRD never receives any personal identifying details, such as your name, address, NHS number or date of birth, from your GP
  • CPRD only provides anonymised health data to researchers
  • Data can only be used for research to improve patient and public health
  • All research applications must be reviewed and approved by an expert scientific committee
  • CPRD must obtain annual ethics and governance approvals to collect and supply data for research
  • Data is held securely by CPRD and researchers must comply with strict terms and conditions when carrying out research

Find out more on our Safeguarding Patient Data page

Privacy Notice

The Clinical Practice Research Datalink (CPRD) is a centre of the Medicines and Healthcare products Regulatory Agency (MHRA), an executive agency of the Department of Health & Social Care (DHSC), which regulates medicines, medical devices and blood components for transfusion in the UK. The DHSC is the legal ‘controller’ of the data which we hold. You may contact the Data Protection Officer at:

Data Protection Officer
1st Floor North
39 Victoria Street

or at

This rest of this statement covers only the medical research data which CPRD holds. Other more administrative forms of personal data (e.g. on staff, public enquiries, emails, etc.) will be covered under transparency notices of our parent bodies, MHRA and DHSC.

You may also wish to look at the Understanding Patient Data website for more general information about research use of medical data.

What data we hold and why

Observational Research

We hold de-identified information derived from general practice (GP) records so that we can support medical research and the monitoring of the effectiveness and safety of medical drugs and devices. This information may be supplemented with related information from other national and regional sources for particular studies:

  • Death registration data from the Office of National Statistics (ONS)
  • Cancer data from Public Health England (PHE)
  • Hospital Episode data from NHS Digital and regional hospital trusts (accident and emergency, In-patient admissions and Out-patient appointments including information on prescriptions, procedures and other clinical investigations)
  • Clinical audit data from organisations such as the Health Quality Improvement Partnership (HQIP)
  • Specialist secondary care services like adult mental health services and maternity services
  • Quality of life measures and patient reported outcomes from PHE and NHS Digital
  • Disease registry data for e.g. kidney disease, joints register
  • Screening data for e.g. diabetic eye disease screening
  • Medicines dispensing data
  • Maternity and children’s services data from hospital and community services
  • Other data-sets as needed for particular studies, e.g. air pollution data, social deprivation indices 

Patient-consented clinical research

CPRD supports clinical research involving patient participation where patients have been invited by their doctor and have consented to take part in a particular clinical study. We only hold medical information specific to that study and we do not know who the patients are.

All clinical studies require approval by a Research Ethics Committee.

The legal bases for processing this information

We do not hold or process personal data on patients; however, NHS Digital (formally the Health and Social Care Centre) may process ‘personal data’ for us as an accredited ‘safe haven’ or ‘trusted third-party’ within the NHS when linking GP data with data from other sources. The legal bases for processing this data are:

  • Medicines and medical device monitoring: Article 6(e) and Article 9(2)(i) - public interest in the area of public health
  • Medical research and statistics: Article 6(e) and Article 9(2)(j) - public interest and scientific research purposes

Any data we hold or pass on to bona fide researchers for observational research will have been anonymised in accordance with the Information Commissioner’s Office Anonymisation Code of Practice. We will hold data indefinitely for the benefit of future research, but studies will normally only hold the data we release to them for twelve months.

Your data subject rights under the General Data Protection Regulation (GDPR)

With effect from 25 May 2018, the General Data Protection Regulation came into force in the UK and this provides for a number of data rights for individuals:

  • the right to be informed about the processing of any data about you (which is what this notice is intended to cover);
  • the right of access to see or receive a printed copy of any personal data relating to you;
  • the right to rectification – to correct any material errors in the personal data we may hold about you;
  • the right to erasure – where appropriate, to ask that all personal data about you is erased;
  • the right to restrict processing – to ask that some or all processing ceases – generally this would involve invoking the National Data Opt-out through your GP or withdrawing from a clinical research study directly;
  • the right to data portability – this only applies to data you have provided directly;
  • the right to object to and not to be subject to automated decision-making, including profiling. We do not have any automated decision-making.

As the data we hold is anonymised, we are not required to support these rights nor is it possible as we have no indication of anyone’s identity. If you are involved in any clinical research studies, then you would have been approached to participate by your GP, who will hold records about your involvement – we do not hold information that identifies you.

You may make a complaint to the Information Commissioner’s Office through their website or their helpline 0303 123 1113.

You can opt out

You can opt out of any of your patient information being used for planning and research. If you do not want your GP practice to share such information from your health record, let your doctor know. Opting out of sharing your health records will not affect the direct care that you receive, though may affect how well the NHS can operate (see below). You can find out more about the National Data Opt-out in England.

CPRD operates in compliance with the National Data Opt-out Policy for patients in England.

The Government depends on the data collected by CPRD to monitor drug safety and safeguard public health. If large numbers of patients or specific patient groups choose not to share anonymised health information for research, the information in CPRD will not truly represent the UK population. This situation may lead to unreliable evidence from research studies and incorrect answers to important health and safety concerns.

There is also information on the Understanding Patient Data website, including this article: What’s the potential impact of the national data opt-out?

[Page last reviewed 5 May 2020]