The University of Edinburgh and NHS Lothian are the Co-sponsors for this study based in the United Kingdom. They will use information from you and/or your medical records in order to undertake the study and will act as joint data controllers. This means that they are responsible for looking after your information and using it properly, and will keep identifiable information about you for 5 years after the study has finished.
Your rights to access, change or move your information are limited, as it is necessary to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, the Co-sponsors will keep the information about you that has already been obtained. To safeguard your rights, the minimum personally-identifiable information possible will be used.
Staff within the NHS will collect information from you and your medical records for this research. The NHS hospital will keep your name, NHS number and contact details to contact you about the research study, and make sure that relevant information about the study is recorded for your care, and to oversee the quality of the study.
Individuals from the University of Edinburgh and NHS Lothian and regulatory organisations may look at your medical and research records to check the accuracy of the research study. The NHS hospital will pass these details to the University of Edinburgh and NHS Lothian along with information collected from you and your medical records.
The only people in the University of Edinburgh and NHS Lothian who will have access to information that identifies you will be people who need to contact you about study follow up or audit the data collection process.
The NHS hospital will keep identifiable information about you from this study for 5 years after the study has finished.
When you enter your information in a form, we will specify the intended and future use of this information. By submitting the form, you consent for your information to be used according to these purposes. The GenOMICC study team at the University of Edinburgh will keep your name, contact details, and completed information.
The only people in the University of Edinburgh who will have access to the information that identifies you will be the people who need to contact you about the study or audit the data collection process.
As a publicly funded organisation, we have to ensure that it is in the public interest when we use personally identifiable information from people who have agreed to take part in research. This provides the legal basis for our use of your data; GDPR Article 6(1)(e) and Article 9(2) (j).
This means that when you agree to take part in a research study, we will use your data (including your health data) in the ways needed to conduct and analyse the research study.
Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole.
We will keep your direct identifiers (eg name) for up to two years after the study has finished, unless you are under 18 in which case we have to keep it until you are 21 because of the statute of limitations. Your other personal data will be retained for at least 30 years after the end of the study, in line with relevant legislation.
At the end of this retention period, your personal data will either be deleted or rendered anonymous (non-identifiable). We may need to retain personal data for longer if it is necessary to fulfil our purposes, including any relating to legal, accounting, or reporting requirements.
We may also retain personal data for further research for which a legal basis exists. This will always be done in accordance with data protection laws. General information about how long different types of information are retained by the University can be found in the University’s Privacy Notice for Research Participants:
Edinburgh University Privacy Notice
We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption or destruction. We use technical measures such as encryption and password protection to protect your data and the systems they are held in.
We also use operational measures to protect the data, for example by limiting the number of people who have access to the databases in which your data is held and using unique reference numbers to identify participants rather than names wherever possible.
We keep these security measures under review and refer to University Security Policies to keep up to date with current good practice.
When you agree to take part in a research study, the information about your health and care may be provided to researchers running other research studies in this organisation and in other organisations.
These organisations may be universities, NHS organisations or companies involved in health and care research in this country or abroad. Your information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Health and Social Care Research.
Under the General Data Protection Regulation (GDPR), which came into effect on 25 May 2018, you have the following rights in relation to the information that we hold about you (your ‘personal data’):
The right to request access to your data (commonly known as a “subject access request”). This enables you to receive a copy of your data and to check that we are lawfully processing it.
The right to request correction of your data. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.
The right to request removal of your data. This enables you to ask us to delete or remove your data in certain circumstances for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
The right to object to the processing of your data, where we are processing it to meet our public tasks or legitimate interests (or the legitimate interests of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your data for direct marketing purposes.
The right to request that the processing of your data is restricted. This enables you to ask us to suspend the processing of your data, for example, if you want us to establish its accuracy or the reason for processing it.
The right to access, change or move your data.
Depending on the circumstances, we may have grounds for not complying with your request, for example, where we consider that deleting your information would seriously harm the research or where we need to process your data for the performance of a task in the public interest.
If you wish to exercise any of these rights, please contact the study team at genomicc@roslin.ed.ac.uk. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.
If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer, dpo@ed.ac.uk, who will investigate the matter.
If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful, you can complain to the Information Commissioner’s Office (ICO) by visiting:
Information Commissioner’s office - complaints
If you would like to contact us directly for more information about how we process and protect data collected for research, please email: genomicc@roslin.ed.ac.uk
If you prefer you can call the study team on 0300 365 7660 or write to:
GenOMICC
The Roslin Institute
Easter Bush Campus
Midlothian
EH25 9RG\
Contact us and we’ll get back to you as soon as possible.
Contact GenOMICC team