The University of Edinburgh and NHS Lothian are the co-sponsors for this study based in the United Kingdom. Both organisations are responsible for the conduct of our clinical research study.
They will use information from you and/or your medical records in order to undertake the study and will act as joint data controllers. This means that they are responsible for looking after your information and using it properly and will keep identifiable information about you for 5 years after the study has finished.
This privacy notice tells you what to expect when GenOMICC (Genetics of susceptibility and mortality in critical care) collects your personal information.
GenOMICC gathers information about participants from case report forms, registration forms (if you’re a volunteer), samples and other sources such as health records and national registers. GenOMICC processes these data to make sure they are as accurate as possible, and to remove the risk that any person may be identified from the data. GenOMICC then shares these data with qualified researchers, in order to conduct clinical research that may benefit the wider public, for example, by increasing scientific knowledge and finding new treatments for critical illness.
Your rights to access, change or move your information are limited, as it is necessary to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, the co-sponsors will keep the information about you that has already been obtained. To safeguard your rights, the minimum personally-identifiable information possible will be used.
The University of Edinburgh and NHS Lothian are the joint data controllers, as defined in the Data Protection Act.
GenOMICC complies with the requirements of the General Data Protection Regulations (GDPR) and the Data Protection Act (2018) regarding the collection, processing, storage, and disclosure of personal information.
The Data Controller at The University of Edinburgh can be contacted by email at: DPO@ed.ac.uk or you can write to:
Data Protection Officer
Governance and Strategic Planning
The University of Edinburgh
Old College
Edinburgh
EH8 9YL
Scotland
The purpose of GenOMICC is to conduct scientific research that aims to find the specific genes that lead to life threatening illness. This means that when you agree to take part in our research study, we will use your data (including your health data) in the ways needed to conduct our research. Health and care research should serve the public interest, which means that we must demonstrate that our research serves the interests of society as a whole.
Our legal basis for using your information, under GDPR and the Data Protection Act 2018, is:
The GDPR defines “sensitive personal information” as “information that reveals a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership; and the processing of genetic data or biometric data for the purpose of uniquely identifying a person; data concerning health or data concerning sex life or sexual orientation.”
Joining our study is voluntary and by consenting to become part of GenOMICC either as a patient or as a volunteer, you consent for your details to be collected and used according to the purposes stated within the participant information sheet, which should be read and understood before joining our study, either as a severely ill patient, a representative of a patient or a healthy volunteer.
Staff within the NHS will collect information from you and your medical records for this research. We need to know what type of illness you had and how sick you were. The NHS hospital will store information about your illness and personal information such as your name, date of birth and NHS/CHI number.
The NHS hospital will pass these details to the University of Edinburgh and NHS Lothian along with information collected from you and your medical records. This information is gathered onto a secure Case Report Form (CRF) and transferred electronically. Individuals from the University of Edinburgh and NHS Lothian and regulatory organisations may look at your medical and research records to check the accuracy of the data.
The only people in the University of Edinburgh and NHS Lothian who will have access to information that identifies you will be people who need to contact you about study follow up, future research opportunities (unless you have opted out) or audit the data collection process.
The NHS hospital where you were recruited to GenOMICC will keep identifiable information about you from this study for 5 years after the study end date.
When registering to volunteer for GenOMICC, you enter information directly into an online form, known as a registration form, or an online case report form. Full details of the study are given in the participant information sheet which should be read and understood before registering for the study. This document outlines the information that will be collected and includes personal information such as name, date of birth and ethnicity.
By submitting the form, you consent for your information to be used in our research and The GenOMICC study team at the University of Edinburgh will keep your name, contact details, and all information you completed at the time of enrolment to the study.
The only people in the University of Edinburgh who will have access to the information that identifies you will be the people who need to contact you about the study, future research opportunities (unless you have opted out) or to audit the data collection process.
The GenOMICC study may contact you using a platform such as Dotdigital which can supply bulk email capabilities. This is a university approved email service provider.
As a publicly funded organisation, we have to ensure that it is in the public interest when we use personally identifiable information from people who have agreed to take part in research. This provides the legal basis for our use of your data; GDPR Article 6(1)(e) and Article 9(2) (j).
This means that when you agree to take part in our research study, we will use your data (including your health data) in the ways needed to conduct and analyse the research study.
We will keep your direct identifiers (e.g., name) for up to five years after the study has finished, unless you are under 18 in which case we have to keep it until you are 21 because of the statute of limitations.
Your other personal data will be retained for at least 30 years after the end of the study, in line with relevant legislation. At the end of this retention period, your personal data will either be deleted or rendered anonymous (non-identifiable).
We may need to retain personal data for longer if it is necessary to fulfil our purposes, including any relating to legal, accounting, or reporting requirements. We may also retain personal data for further research for which a legal basis exists. This will always be done in accordance with data protection laws. General information about how long different types of information are retained by the University can be found in the University’s Privacy Notice for Research Participants:
Edinburgh University Privacy Notice
We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption or destruction. We use technical measures such as encryption and password protection to protect your data and the systems they are held in.
We also use operational measures to protect the data, for example by limiting the number of people who have access to the databases in which your data is held and using unique reference numbers to identify participants rather than names wherever possible.
We keep these security measures under review and refer to University Security Policies to keep up to date with current good practice.
When you agree to take part in our research study, the information about your health and care may be provided to researchers running other research studies in this organisation and in other organisations.
These organisations may be universities, NHS organisations or companies involved in health and care research in the UK or abroad. Your information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Health and Social Care Research.
Under the General Data Protection Regulation (GDPR), which came into effect on 25 May 2018, you have the following rights in relation to the information that we hold about you (your ‘personal data’):
The right to request access to your data (commonly known as a “subject access request”). This enables you to receive a copy of your data and to check that we are lawfully processing it.
The right to request correction of your data. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.
The right to request removal of your data. This enables you to ask us to delete or remove your data in certain circumstances for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
The right to object to the processing of your data, where we are processing it to meet our public tasks or legitimate interests (or the legitimate interests of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your data for direct marketing purposes.
The right to request that the processing of your data is restricted. This enables you to ask us to suspend the processing of your data, for example, if you want us to establish its accuracy or the reason for processing it.
The right to access, change or move your data.
Depending on the circumstances, we may have grounds for not complying with your request, for example, where we consider that deleting your information would seriously harm the research or where we need to process your data for the performance of a task in the public interest.
If you wish to exercise any of these rights, please contact the study team at: genomicc@roslin.ed.ac.uk
If you change your mind and decide you no longer wish to be part of this study, then you can withdraw at any time and we will ensure you are removed from any future research and that your genetic sample is destroyed. However, we can’t remove you from research that has already taken place or remove the information about you that we have already obtained for this purpose. To safeguard your rights, we will use the minimum personally-identifiable information possible.
We aim to meet the highest standards when collecting and using personal information. However, should you wish to complain about our handling of your data, you can contact our Data Protection Officer, dpo@ed.ac.uk, who will investigate the matter.
If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful, you can complain to the Information Commissioner’s Office (ICO) by visiting:
Information Commissioner’s office - complaints
Should you have any questions or would like more information about how we process and protect data collected for our research, then please do not hesitate to contact the study team. We can be contacted by:
Email: genomicc@roslin.ed.ac.uk
Telephone: 0300 365 7660
or write to:
GenOMICC
The Roslin Institute
Easter Bush Campus
Midlothian
EH25 9RG
Contact us and we’ll get back to you as soon as possible.
Contact GenOMICC teamUpdated June 2024
