Developers - Using health data during technology development

Reviewed by: Health and Care IG Panel

You may need to use personal data during the development stage of the technology. This is because using synthetic data or anonymous data may not be appropriate for the clinical-environment validation of the performance and safety of your technology.

When using personal data, remember that you need to have a lawful basis for doing so under data protection legislation (within the UK GDPR). The disclosure of any confidential patient and service-user information to you as a developer (when you do not work as part of the direct care team) will also need to have a lawful basis under the UK common law duty of confidentiality. This avoids harm to patients or service users from improper use of data. Otherwise, you may risk prosecution, a fine or damage to reputation.

How to process health and care data

When processing personal data related to health and care provision, you need to follow the requirements of the:

• UK GDPR (if the individual is still living) and
• common law duty of confidentiality (for both living and deceased individuals)