This section explains how health researchers use information from participants. PEARLS study is run centrally by the Nottingham Clinical Trials Unit, which is part of the University of Nottingham. The study is funded by National Institute for Health and Care Research (NIHR) Heath Technology Assessment (HTA) Ref: NIHR135121 and sponsored by the University of Nottingham. The study is supported by hospitals and community hubs across the UK. To answer the study research question, we aim to recruit 400 participants and collect data from them. Once we receive information about you, it will be processed to help study analysis and answer the research question. The sections below explain what processing of personal data is and how your data is protected in this study.
“Data processing” is any operation performed on the data such as collection, use, management or disclosure.
Personal “data” is information that relates to an identified or identifiable individual. It does not include information relating to dead people, groups or communities of people, organisations or businesses. Nonetheless, the PEARLS study team will ensure they keep information confidential, safe and secure after the death of any individual taking part in the study.
Legal basis of data processing?
Any information we hold about the study participants is processed for the purposes of ‘the performance of a task carried out in the public interest’ (the Article 6(1)(e)) of the Data Protection Act 2018, and ‘scientific research’ (the Article 9(2)(j)) of the Data Protection Act 2018.
The EU General Data Protection 2016/679 (GDPR) came into regulation from 25 May 2018, which was thereafter supplemented by the DPA 2018. The DPA 1998 covers how personal data may be lawfully processed (collected, used and shared). This is referred as a “data protection law”. The data protection law regulates how we process participants’ “personal data”. Find out more how University of Nottingham processes your data: https://www.nottingham.ac.uk/utilities/privacy/privacy.aspx.
What personal data will be processed in this study?
The information we collect on the study participant may include and is not limited to:
- Name, date of birth, NHS number
- GP/hospital name and contact details
- Medical information relevant to the study
During the study we will process further details on participants. This may include:
- Details about participation in the study
- Outcomes of any procedures, tests; questionnaires undertaken as part of the study
Please note that personal details will be deleted when they are no longer needed
How we manage personal information?
The Data Protection Act 2018 (DPA 2018) regulates the management of personal information. This is how we look after personal information on study participants. When we ask for participants’ personal information we:
- make sure that the participant knows why it’s needed
- ask only for minimum and sufficient information that is required and do not collect too much or irrelevant information
- protect it and make sure no unauthorised person has access to it
- let participants know if we share it with other organisations, which is necessary to improve public services
- do not keep it for longer than it is necessary
- inform participants that they can withdraw from the study any time
- give contact details of a person/department/body to where enquires or complaints can be directed
Participants receive an ethically approved Participant Information Sheet (PIS) upon invitation to take part in the trial. The PIS will detail information about the study, how participant information will be collected and handled and where it would be collected from. The PIS will also explain what their involvement in the study would be. In addition, the document will explain if other organisations will be involved in the study and what their roles are.
Potential participants will be given plenty of opportunity to ask the study related questions to a member of the research team. In return we ask participants to:
- give us accurate information
- tell us as soon as possible if there are any changes to their personal circumstances such as contact details to enable us to keep the information reliable and up to date
What is the purpose of processing data?
We collect participants’ personal and healthcare data in order to answer the study questions. Collecting personal information is necessary for traceability and collection of further data. The data will be collected directly from the study participants, medical records and may also be collected from NHS agencies. The data will be directly relevant to answer the study specific question. More information about the study can be found on the trial website.
Where do we collect data from?
The data will be normally collected either directly from participants or from medical records from the hospitals and GP practices.
To safeguard participants’ rights, we collect the minimum personally-identifiable information possible.
Some of the data we process is classed as ‘special category’ or sensitive personal data. This data may include information concerning health, racial or ethnic origin.
What will we do with data obtained?
The study statisticians will analyse the data according to the statistical analysis plan. The aggregate data (data from ALL participants without identifiers) will be published and disseminated among professionals. Primarily, the study participants will be informed about the results of the study.
With whom will we share the data?
The PEARLS study involves many organisations such as hospitals recruiting participants, GP practices, the sponsor (University of Nottingham), Research Ethics Committee (REC), Medicines and Healthcare products Regulatory Agency (MHRA), the study oversight committees and study management group. For the purposes of assessment and analysis of the study data or safety issues it may become necessary to share participants identifiable and healthcare information with these organisations during the study.
The study team at the sites (hospitals) or authorised personnel from the sponsor and other regulatory bodies may look at the participants medical records. This is necessary to ensure that the study is being conducted and managed to the highest possible standards.
Participant anonymised information may be occasionally shared with researchers of other ethically approved studies. They may be based at the University of Nottingham, or any other universities, NHS organisations or companies involved in healthcare research in the UK or outside of the UK. The access to information will be strictly controlled and anonymised before being shared. Participants will not be identified in any way in any report, presentation or publication arising from this data sharing agreement. The study team will ensure that appropriate safeguards are in place to protect the confidentiality and security of the participants’ data.
On some occasions, the study may be inspected by a third-party organisation to make sure that it is conducted in accordance with relevant requirements and legislation. In such circumstances data sharing becomes necessary to meet legal and regulatory requirements and is only for the purposes of the audit.
How long will we keep the data?
The information collected on the study participants will be kept within the Nottingham Clinical Trials Unit (NCTU) and the hospital for a minimum of 7 years after the completion of the study.
Participants' rights in relation to their data & "Right to be forgotten"
The details on participants’ rights can be found on the https://www.nottingham.ac.uk/utilities/privacy/privacy.aspx.
Under the article 17 of GDPR the study participants have right to request “right to be forgotten” (aka “the erasure”) of their personal data without undue delay. The trial subjects can request this verbally or in writing. We have the obligation to erase the personal data without undue delay and will respond to this request typically within one month.
What happens if participants change their mind?
During the course of the study participants may change their mind about their data being included in the PEARLS study analysis. The inclusion of their data is entirely up to the participant and choosing to do so will not disadvantage them in any way. However, because the study is being conducted as a ‘task in the public interest’ and ‘scientific research’ according to the data protection law, a participant’s right to change or remove information may be limited. This is because we need to process information in such ways that the research we carry out is at the highest standard, reliable, accurate and verifiable. This means that we will keep the data that has already been obtained before a participant’s withdrawal from the study.
When we ask you for information we will keep to the law, including the Data Protection Act 2018. Through appropriate management and strict controls, we will follow the 8 principles of data protection described in the act. Also see the Information Commissioners general guidance on the implementation of data protection.
We will also ensure that:
- there is someone with specific responsibility for data protection in the organisation (the nominated person is called the Data Protection Coordinator)
- everyone managing and handling personal information understands that they are contractually responsible for following good data protection practice, is appropriately trained to do so and is appropriately supervised
- we deal with enquiries about how we handle personal information promptly and courteously
- we describe how we handle personal information clearly, regularly review and audit how we manage personal information, and regularly assess and evaluate methods of handling personal information