Study privacy policy

Who is responsible for your data if you take part in GenOMICC?

The University of Edinburgh and NHS Lothian are the Co-sponsors for this study based in the United Kingdom. They will use information from you and/or your medical records in order to undertake the study and will act as joint data controllers. This means that they are responsible for looking after your information and using it properly, and will keep identifiable information about you for 5 years after the study has finished.

Your rights to access, change or move your information are limited, as it is necessary to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, the Co-sponsors will keep the information about you that has already been obtained. To safeguard your rights, the minimum personally-identifiable information possible will be used.

GenOMICC Patient - data collection

Staff within the NHS will collect information from you and your medical records for this research. The NHS hospital will keep your name, NHS number and contact details to contact you about the research study, and make sure that relevant information about the study is recorded for your care, and to oversee the quality of the study.

Individuals from the University of Edinburgh and NHS Lothian and regulatory organisations may look at your medical and research records to check the accuracy of the research study. The NHS hospital will pass these details to the University of Edinburgh and NHS Lothian along with information collected from you and your medical records.

The only people in the University of Edinburgh and NHS Lothian who will have access to information that identifies you will be people who need to contact you about study follow up or audit the data collection process.

The NHS hospital will keep identifiable information about you from this study for 5 years after the study has finished.

GenOMICC Volunteer - data collection

When you enter your information in a form, we will specify the intended and future use of this information. By submitting the form, you consent for your information to be used according to these purposes. The GenOMICC study team at the University of Edinburgh will keep your name, contact details, and completed information.

The only people in the University of Edinburgh who will have access to the information that identifies you will be the people who need to contact you about the study or audit the data collection process.

How we use your personal data

As a publicly funded organisation, we have to ensure that it is in the public interest when we use personally identifiable information from people who have agreed to take part in research. This provides the legal basis for our use of your data; GDPR Article 6(1)(e) and Article 9(2) (j).

This means that when you agree to take part in a research study, we will use your data (including your health data) in the ways needed to conduct and analyse the research study.

Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole.

How long we keep your data

We will keep your direct identifiers (eg name) for up to two years after the study has finished, unless you are under 18 in which case we have to keep it until you are 21 because of the statute of limitations. Your other personal data will be retained for at least 30 years after the end of the study, in line with relevant legislation.

At the end of this retention period, your personal data will either be deleted or rendered anonymous (non-identifiable). We may need to retain personal data for longer if it is necessary to fulfil our purposes, including any relating to legal, accounting, or reporting requirements.

We may also retain personal data for further research for which a legal basis exists. This will always be done in accordance with data protection laws. General information about how long different types of information are retained by the University can be found in the University’s Privacy Notice for Research Participants:

Edinburgh University Privacy Notice

How we protect your data

We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption or destruction. We use technical measures such as encryption and password protection to protect your data and the systems they are held in.

We also use operational measures to protect the data, for example by limiting the number of people who have access to the databases in which your data is held and using unique reference numbers to identify participants rather than names wherever possible.

We keep these security measures under review and refer to University Security Policies to keep up to date with current good practice.

Sharing your data

When you agree to take part in a research study, the information about your health and care may be provided to researchers running other research studies in this organisation and in other organisations.

These organisations may be universities, NHS organisations or companies involved in health and care research in this country or abroad. Your information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Health and Social Care Research.

Your rights

Under the General Data Protection Regulation (GDPR), which came into effect on 25 May 2018, you have the following rights in relation to the information that we hold about you (your ‘personal data’):

Depending on the circumstances, we may have grounds for not complying with your request, for example, where we consider that deleting your information would seriously harm the research or where we need to process your data for the performance of a task in the public interest.

If you wish to exercise any of these rights, please contact the study team at genomicc@roslin.ed.ac.uk. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.

Complaints

If you wish to raise a complaint on how we have handled your personal data, you can contact our Data Protection Officer, dpo@ed.ac.uk, who will investigate the matter.

If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful, you can complain to the Information Commissioner’s Office (ICO) by visiting:

Information Commissioner’s office - complaints

Contact us

If you would like to contact us directly for more information about how we process and protect data collected for research, please email: genomicc@roslin.ed.ac.uk

If you prefer you can call the study team on 0300 365 7660 or write to:

GenOMICC
The Roslin Institute
Easter Bush Campus
Midlothian
EH25 9RG\

Can't find what you need?

Contact us and we’ll get back to you as soon as possible.

Contact GenOMICC team