HFEA.gov.uk uses cookies to deliver content and make improvements to the website.

Configure cookies
Skip to main content
Menu toggle
Home HFEA dashboard Contact us
Read our latest report on The Fertility Sector 2025/26 here.

Privacy Notice

Updated 6th October 2026.

Table of contents

1. Background

This notice outlines the ways the HFEA collects and uses personal information about patients and individuals who contact the HFEA. This personal information may be collected through your treatment in a licenced UK fertility clinic or when you contact us directly for any reason. The HFEA is legally responsible for ensuring its processing of personal information is compliant with all current data protection laws.

This notice explains what personal information about you will be collected by the HFEA either when you register or undergo treatment at a licenced fertility clinic, or when you contact us, how this information will be used, and how you can control the collection, correction and/or deletion of your personal information. We will not use or share your personal information with anyone except as described in this Privacy Notice.

  • In this Privacy Notice, we use the term ‘personal information’ to mean any information relating to an identified or identifiable person
  • The term ‘special category data’ means personal information revealing racial or ethnic origin, political opinions, religious or philosophical beliefs, or trade union membership, genetic data, biometric data for the purpose of uniquely identifying an individual, data concerning health or data concerning an individual’s sex life or sexual orientation.

2. What information do we collect?

There are two main routes by which we will receive personal information about you.

2.1 Through our regulation of licenced UK fertility clinics, we have a legal duty to keep a register of information relating to treatment provided by fertility clinics and the people who receive that treatment. We therefore require clinics to report prescribed information to us; it is a legal requirement under the Human Fertilisation and Embryology Act 1990 (as amended) (‘the HFE Act’) that clinics report this information to us. The information that we receive includes details such as your name, date of birth, address, NHS number, and details of your treatment and outcome e.g. whether you had a birth. The full list of information we receive from clinics is listed in our Data Dictionary.

We may also collect some personal information for the purposes of fulfilling other functions and legal duties that we have under the HFE Act for example, during inspections of clinics, when investigating incidents that have occurred at clinics or when we are investigating complaints about a clinic.

2.2 When you contact us directly, such as with a complaint about the HFEA, freedom of information request, or when submitting an enquiry.

People often contact us with enquiries, complaints or to ask for information. We have to hold the details of the people who contact us in order to respond to them. This may include personal information such as your full name, phone number, email address or similar, as well as any details about you that you provide to us in your communication with us. Where you contact us, we will use the contact details you provide to respond to your enquiry.

We will only collect, use and keep your personal information according to the law and will not collect more information that we need to fulfil our stated purposes and will not retain it for longer than is necessary or required by law.

The HFEA has a statutory duty to keep personal information about people who have had treatment at a licenced UK fertility clinic on our Register. Section 31 of the Human Fertilisation and Embryology Act 1990 (‘the HFE Act’) requires the HFEA to keep a register and defines some of the personal information which must be collected and kept on the register. In line with this statutory duty, we collect, process and keep personal information about patients, their partners, donors and children born from fertility treatment.

Our lawful bases for processing

Under data protection law, we must always have a lawful basis for processing your personal information. The lawful basis we rely on will depend on the purpose for which we are processing your information, as set out in the table below.

Why we process your information Lawful basis under UK GDPR Special category condition (where applicable)
Maintaining the HFEA Register Article 6(1)(c) Legal obligation and Article 6(1)(e) Public task Article 9(2)(g) Substantial public interest
Regulating, licensing and inspecting fertility clinics Article 6(1)(e) Public task Article 9(2)(g) Substantial public interest
Investigating incidents, complaints and regulatory concerns Article 6(1)(e) Public task Article 9(2)(g) Substantial public interest
Responding to enquiries and correspondence Article 6(1)(e) Public task Article 9(2)(g) Substantial public interest (where special category data is involved)
Responding to Freedom of Information requests and other statutory requests Article 6(1)(c) Legal obligation Not normally applicable
Responding to Subject Access Requests and other data subject rights requests Article 6(1)(c) Legal obligation Article 9(2)(g) Substantial public interest (where special category data is involved)
Sharing information for approved research purposes where permitted by law Article 6(1)(e) Public task Article 9(2)(g) Reasons of substantial public interest, supported by the Human Fertilisation and Embryology Act 1990 and associated regulations
Where an individual has provided explicit consent for a specific purpose Article 6(1)(a) Consent Article 9(2)(a) Explicit consent
Employment Article 6(1)(b) Contract Article 9(2)(b) Employment
Protecting an individual's life or safety in exceptional circumstances Article 6(1)(d) Vital interests Article 9(2)(c) Vital interests

Much of the information processed by the HFEA relates to fertility treatment, genetic information and health data and is therefore classified as special category personal data. The HFEA processes this information in accordance with UK data protection legislation, the Human Fertilisation and Embryology Act 1990 and associated regulations.

4. How do we maintain the security of your information?

We take our duty to protect your personal information very seriously and where relevant we are committed to ensuring that we maintain your confidentiality. Any unauthorised disclosure, even inadvertent or indirect, of an individual’s information that’s contained on our Register is a criminal offence.

We process personal information securely by means of ‘appropriate technical and organisational measures’, which include:

  • We undertake an analysis of the risks presented by our processing and use this to assess the appropriate level of security we need to put in place. We do this using Data Protection Impact Assessments, our Information Auditing process, and regular organisational review meetings via our strategic risk register.
  • Clinics use a fully encrypted electronic data submission system to send personal information to us. We activate local encryption such that all information stored on the HFEA system is always encrypted. In addition, the system sits behind local firewalls and local username and password controls.
  • We make sure that we regularly review our information security policies and measures and, where necessary, improve them.
  • We have put in place basic technical controls such as those specified by established frameworks like ISO27001.
  • We understand that we may also need to put other technical measures in place depending on our circumstances and the type of personal information we process.
  • We use encryption where it is appropriate to do so.
  • We understand the requirements of confidentiality, integrity and availability for the personal data we process, and have appointed a Senior Information Risk Owner (SIRO), Caldicott Guardian and Data Protection Officer (DPO).
  • We make sure that we can restore access to personal data in the event of any incidents, such as by establishing an appropriate backup process.
  • We conduct regular testing and reviews of our measures to ensure they remain effective, and act on the results of those tests where they highlight areas for improvement.
  • We ensure that any data processor we use also implements appropriate technical and organisational measures, setting these out in data processing contracts, information sharing agreements and contractual terms.

5. How is your information used by the HFEA?

Your personal information is used by the HFEA to respond to your questions or concerns, develop our regulatory policy and effectively regulate licenced clinics in the UK to ensure that patients continue to receive high-quality care and that improvements in scientific and public health research continue in line with approved ethical and legislative requirements.

We process information for reasons specified at the point of collection, which can include:

  • Maintaining our Register
  • Fulfilling requests for information which are made under the HFE Act e.g. providing information to people who have a statutory right to request information about their donor, genetically related siblings or someone they intend to marry and with whom they have an intimate relationship.
  • Organisational information assurance e.g. auditing our records
  • Ensuring clinics are licensed and regulated effectively
  • Maintaining and developing policy, regulatory tools (e.g. the Code of Practice) and guidance to improve the standard of care in clinics
  • Investigating and responding to complaints about clinics and the HFEA
  • Subject access requests (SARs) or other data subject requests
  • Investigating incidents that have occurred at clinics and taking appropriate regulatory action in response to such incidents
  • Carrying out surveys of patients, licensed clinics and the public
  • Information sharing for research, where strict legal and ethical criteria have been met

National Data Opt-out Compliance Statement

The national data opt-out is an NHS policy that allows individuals to opt out of their confidential patient information being used for research and planning purposes. It does not apply in situations where the participant has given explicit consent for use of their data. This includes where the HFEA asks for your consent to use personal information held in the Register for research purposes. Decisions to grant access to individual research groups are authorised under the Human Fertilisation and Embryology (Disclosure of Information for Research Purposes) Regulations 2010. To find out more information about the HFEA’s research activities, visit our data webpage. If you wish to change or withdraw your consent for research, please contact your clinic.

6. With whom, and when, will we share your information?

6.1 Sharing personal information without your consent.

Ordinarily, we will not disclose your personal information without your consent. However, there are circumstances in which we will need to share your personal information with other organisations, and we will do so without seeking your consent. These circumstances are limited to when we have a legal obligation, legitimate interest or if the disclosure is necessary to protect the vital interests of the person.

Organisations we may share personal information include:

  • Licenced clinics
  • Police, regulators and other public bodies
  • Organisations working for us or on our behalf for example our lawyers or IT contractors working on our systems
  • Department of Health and Social Care and other central or local government departments
  • Research establishments
  • The National Health Service

6.2. Sharing information with your consent for research purposes.

We may share your personal information if you have given consent for your information to be used in research. Researchers are allowed to request identifying information from us. They can only use information that would identify you with your consent. Research using your data is incredibly valuable and could, for example, be used to investigate the safety and efficacy of fertility treatments, develop new treatment and storage techniques and study the effect of national policies, such as the HFEA multiple births policy. It can also be used to link fertility treatment data with other healthcare records for example, to see whether IVF affects the health of women or their children.

Your personal information will only be made available to researchers linked to a recognised UK research institution and any research project also need to have received approval from a research ethics committee. We only allow researchers to use identifying information in cases where their research couldn’t be conducted without it. Where researchers publish their research findings it won’t be possible to identify you.

Prior to October 2009, consent to research was not collected for patients who were undergoing treatment at a licensed fertility clinic. Since 1 October 2009, under new legislation the Human Fertilisation and Embryology (Disclosure of Information for Research Purposes) Regulations 2010, researchers have been able to apply to access identifying information for patients involved in treatment between August 1991 and September 2009 (and any children born as a result of treatment) without getting their consent. If you’ve had treatment during this time and you’d prefer that your information was not shared, please contact us (see section 10). There are certain circumstances or criteria that means information cannot be legally disclosed. This will be judged on a need to know and case by case basis. Information recorded from October 2009 about patients and partners who have given their consent may be disclosed under the Human Fertilisation and Embryology Act 1990 (as amended).

When we authorise a research study to use our data, we put in place strict security requirements and retention and deletion schedules that must be followed. Any unauthorised disclosure, even inadvertent or indirect, of an individual’s information that’s contained on our Register is a criminal offence.

For more details, please click here.

6.3. Sharing information with a third-party processor.

Occasionally we may rely on another organisation (a third-party processor) to carry out processing of your personal information on our behalf e.g. NHS Digital who may help us link your data for research purposes. Where that is the case, we are committed to looking after your personal information in a secure and responsible way and ensuring that the third-party processor does too. Therefore, any Data Processor we engage will have signed a Data Processing Contract, which sets out their legal obligations and responsibilities regarding your personal information. These are legally binding agreements for limited periods only and considered on a case-by-case basis.

6.4. International Transfers

We do not routinely transfer personal information outside the United Kingdom. Where an international transfer is necessary, we will ensure that the transfer is either (i) approved by current adequacy regulations, (ii) made subject to appropriate safeguards, or (iii) made in reliance with a derogation for specific situations, as required by UK data protection legislation.

7. How long do we store your information?

Personal information which is held on the HFEA Register will be held in perpetuity i.e. for ever, in order to ensure that the HFEA is able to continue fulfilling its statutory duties for which the Register data is necessary.

The retention period applied to personal information depends on the purpose for which it was collected. While information held on the HFEA Register is retained permanently in accordance with our statutory obligations, other records are retained in accordance with the HFEA Records Retention and Deletion Schedule.

Examples include:

  • Subject Access Requests
  • Freedom of Information requests
  • Complaints and investigations
  • General enquiries and correspondence
  • Regulatory and licensing records

Further information about specific retention periods is available on request.

8. What rights do you have?

Under data protection law, individuals have several rights in relation to their personal information. These rights are not absolute and only apply in certain circumstances.

  • The right to be informed about the collection and use of your personal information.
  • The right to access a copy of your personal information and supplementary information and the right to be made aware of and verify the lawfulness of the processing of your personal information.
  • The right to have inaccurate personal information rectified or completed if it is incomplete.
  • The right to have your personal information erased.
  • The right to request the restriction or suppression of your personal information.
  • The right to data portability which allows you to obtain and reuse your personal information for your own purposes across different services.
  • The right to object to processing based on legitimate interests or performance of a task in the public interest/exercise of official authority in certain circumstances; direct marketing; and scientific/historical research and statistics in certain circumstances.
  • Rights in relation to automated decision making and profiling including the right to information about the automated processing, and the right to request human intervention or to challenge an automated decision. Please note, the HFEA does not currently undertake solely automated decision-making or profiling that produces legal or similarly significant effects on individuals.

9. How can you exercise your rights?

If you want to exercise any of your rights, email: [email protected], or if you prefer to write to us:

The Human Fertilisation and Embryology Authority
2nd floor, 2 Redman Place
London
E20 1JQ

If you wish to request to access your personal data, the quickest way to do is to complete the 'Subject Access Request' (SAR) webform. The HFEA uses a third-party GDPR compliance tool, PrivacyEngine, to manage these requests. Your information will be handled securely.

Please note that we may need to get back in touch with you to clarify your request or to request additional information if we need to verify your identity and locate your records. We will always try to deal with your request within one month; however, we may need to extend the deadline by an additional two months if it is a complicated request. Information will be provided free of charge except where requests are unfounded or excessive, such as repeated requests, in which case the HFEA may either charge a reasonable fee or refuse to act on the request. In most circumstances, we will fulfil your request by sending your copy electronically.

10. Data Controller details

A data controller is a person, organisation or corporate body who (either alone, jointly or in common with other persons) determines the purposes and the manner in which any personal data are processed. The HFEA is the data controller for the personal information we hold about you. Our details are:

The Human Fertilisation and Embryology Authority
2nd floor, 2 Redman Place
London
E20 1JQ

Telephone No: 020 7291 8200

Website: www.hfea.gov.uk

11. Who should you contact with any concerns?

If you have any concerns about how we handle your information you have a right to complain by following our complaints procedure: Making a complaint about us.

If you are not satisfied with how we have handled your complaint, you have a right to complain to the Information Commission’s Office (‘ICO’) about it.

The Information Commission can be contacted at:

Information Commission’s Office

4th Floor, No.3 Circle Square

5 Hawkshaw Street

Manchester

M1 7BL

Website: www.ico.gov.uk

11.1. Senior Information Risk Owner

The Senior Information Risk Owner’s (SIRO) responsibilities are to lead a culture of good information management, own the overall information risk policy and procedures and advise the Accounting Officer on information risk.

Our SIRO contact:

Director of Finance, Technology and Planning

11.2. Data Protection Officer

A data protection officer (DPO) is a role required by current data protection laws for public bodies. Data protection officers are responsible for overseeing data protection strategy and implementation to ensure compliance with UK GDPR requirements.

Our DPO contact:

Jon Belcher

Email: [email protected]

11.3. Caldicott Guardian

A Caldicott Guardian is a senior person responsible for protecting the confidentiality of people's health and care information and making sure it is used properly.

Our Caldicott Guardian contact:

Head of Information

Page publication and last review dates
Publication date:
Last reviewed: