Please note: DataLoch hosts and processes personal data from both patients (routinely collected health and social care data used for research, hosted within NHS Lothian) and applicants (researcher application data, public enquiries and newsletter subscribers, hosted within the University of Edinburgh). 

The University of Edinburgh is responsible for researcher applicant data, public enquiries, and DataLoch newsletter subscriptions. NHS Lothian is responsible for patient data processed as part of the DataLoch service. (For details about personal data processed within NHS Lothian, visit the NHS Lothian DataLoch Privacy Notice.) 

The rest of this privacy notice is focused on researcher applicant data, public enquiries, and DataLoch newsletter subscriptions for which the University of Edinburgh is responsible. 


The type of information we collect and how we get it 

If you are an interested member of the public, the information you provide will be used to respond to queries or subscribe you to our newsletter, based on your request. This information will include your name and email address. 

If you are a researcher interested in accessing data or services, the information you provide will be used to centralise completion, submission, review and approval processes and documentation for applications. We may also receive personal information indirectly as part of a researcher request for access to data by virtue of you being a collaborator on that application. This information will include your name, business address and email address.  


How we use the personal information 

For enquiries and newsletter subscriptions: We are using information about you because it is necessary for responding to your query, or because you have given us your consent by subscribing to our newsletter. This information will not be shared further; it will only be used to subscribe you to our newsletter. You can withdraw your consent for the newsletter at any time by clicking on the ‘unsubscribe’ link in the newsletter or by contacting the DataLoch team.  

For research applications: We are using information about you because it will be necessary for the performance of a contract to access research data. Your personal information will only be used to process your project and give access to the relevant data. In order to complete this, your information may be shared with: a) NHS Lothian as Data Controller of the data; and b) Public Health Scotland for setting up secure access to the Scottish National Safe Haven.  


How we store your personal information 

All information is stored in secure UK GDPR-compliant servers within the EU.  

We will hold the personal data you provide for a limited time, based on the reason the personal data has been shared. We will hold the personal data for three years from the submission of your query, will confirm with you within three years after subscribing to the newsletter whether you still want your information to be registered for continued updates, or for three years from completion of your project request unless otherwise requested.  

Requests for removal of personal data can be made to

Disposal of your information will be in line with University of Edinburgh policies. 

If you have any questions, please contact

For further information about data sharing, your rights and how to complain about data held within the University of Edinburgh for research applications, public enquiries, and newsletter subscriptions, please see the second part of this privacy notice: Continued privacy notice 

As DataLoch develops further, this privacy notice will be updated accordingly. This privacy notice was last updated on 15 November 2021.