Study privacy policy

Who is responsible for your data if you take part in GenOMICC?

The University of Edinburgh and NHS Lothian are the co-sponsors for this study based in the United Kingdom. Both organisations are responsible for the conduct of our clinical research study.

They will use information from you and/or your medical records in order to undertake the study and will act as joint data controllers. This means that they are responsible for looking after your information and using it properly and will keep identifiable information about you for 5 years after the study has finished.

This privacy notice tells you what to expect when GenOMICC (Genetics of susceptibility and mortality in critical care) collects your personal information.

How we use your information

GenOMICC gathers information about participants from case report forms, registration forms (if you’re a volunteer), samples and other sources such as health records and national registers. GenOMICC processes these data to make sure they are as accurate as possible, and to remove the risk that any person may be identified from the data. GenOMICC then shares these data with qualified researchers, in order to conduct clinical research that may benefit the wider public, for example, by increasing scientific knowledge and finding new treatments for critical illness.

Your rights to access, change or move your information are limited, as it is necessary to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, the co-sponsors will keep the information about you that has already been obtained. To safeguard your rights, the minimum personally-identifiable information possible will be used.

Who controls the use of your data

The University of Edinburgh and NHS Lothian are the joint data controllers, as defined in the Data Protection Act.

GenOMICC complies with the requirements of the General Data Protection Regulations (GDPR) and the Data Protection Act (2018) regarding the collection, processing, storage, and disclosure of personal information.

The Data Controller at The University of Edinburgh can be contacted by email at: or you can write to:

Data Protection Officer
Governance and Strategic Planning
The University of Edinburgh
Old College

The purpose of GenOMICC is to conduct scientific research that aims to find the specific genes that lead to life threatening illness. This means that when you agree to take part in our research study, we will use your data (including your health data) in the ways needed to conduct our research. Health and care research should serve the public interest, which means that we must demonstrate that our research serves the interests of society as a whole.

Our legal basis for using your information, under GDPR and the Data Protection Act 2018, is:

  1. Performance of a task carried out in the public interest (Article 6(1)(e) in the GDPR); and, where sensitive personal information is involved;
  2. Scientific or historical research purposes or statistical purposes (Article 9(2)(j) in accordance with Article 89(1)).

The GDPR defines “sensitive personal information” as “information that reveals a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership; and the processing of genetic data or biometric data for the purpose of uniquely identifying a person; data concerning health or data concerning sex life or sexual orientation.”

Joining our study is voluntary and by consenting to become part of GenOMICC either as a patient or as a volunteer, you consent for your details to be collected and used according to the purposes stated within the participant information sheet, which should be read and understood before joining our study, either as a severely ill patient, a representative of a patient or a healthy volunteer.

Personal data we collect about you as a patient

Staff within the NHS will collect information from you and your medical records for this research. We need to know what type of illness you had and how sick you were. The NHS hospital will store information about your illness and personal information such as your name, date of birth and NHS/CHI number.

The NHS hospital will pass these details to the University of Edinburgh and NHS Lothian along with information collected from you and your medical records. This information is gathered onto a secure Case Report Form (CRF) and transferred electronically. Individuals from the University of Edinburgh and NHS Lothian and regulatory organisations may look at your medical and research records to check the accuracy of the data.

The only people in the University of Edinburgh and NHS Lothian who will have access to information that identifies you will be people who need to contact you about study follow up, future research opportunities (unless you have opted out) or audit the data collection process.

The NHS hospital where you were recruited to GenOMICC will keep identifiable information about you from this study for 5 years after the study end date.

Personal data we collect about you as a volunteer

When registering to volunteer for GenOMICC, you enter information directly into an online form, known as a registration form, or an online case report form. Full details of the study are given in the participant information sheet which should be read and understood before registering for the study. This document outlines the information that will be collected and includes personal information such as name, date of birth and ethnicity.

By submitting the form, you consent for your information to be used in our research and The GenOMICC study team at the University of Edinburgh will keep your name, contact details, and all information you completed at the time of enrolment to the study.

The only people in the University of Edinburgh who will have access to the information that identifies you will be the people who need to contact you about the study, future research opportunities (unless you have opted out) or to audit the data collection process.

The GenOMICC study may contact you using a platform such as Dotdigital which can supply bulk email capabilities. This is a university approved email service provider.

How we use your personal data

As a publicly funded organisation, we have to ensure that it is in the public interest when we use personally identifiable information from people who have agreed to take part in research. This provides the legal basis for our use of your data; GDPR Article 6(1)(e) and Article 9(2) (j).

This means that when you agree to take part in our research study, we will use your data (including your health data) in the ways needed to conduct and analyse the research study.

How long we keep your data

We will keep your direct identifiers (e.g., name) for up to five years after the study has finished, unless you are under 18 in which case we have to keep it until you are 21 because of the statute of limitations.

Your other personal data will be retained for at least 30 years after the end of the study, in line with relevant legislation. At the end of this retention period, your personal data will either be deleted or rendered anonymous (non-identifiable).

We may need to retain personal data for longer if it is necessary to fulfil our purposes, including any relating to legal, accounting, or reporting requirements. We may also retain personal data for further research for which a legal basis exists. This will always be done in accordance with data protection laws. General information about how long different types of information are retained by the University can be found in the University’s Privacy Notice for Research Participants:

Edinburgh University Privacy Notice

How we protect your data

We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption or destruction. We use technical measures such as encryption and password protection to protect your data and the systems they are held in.

We also use operational measures to protect the data, for example by limiting the number of people who have access to the databases in which your data is held and using unique reference numbers to identify participants rather than names wherever possible.

We keep these security measures under review and refer to University Security Policies to keep up to date with current good practice.

Sharing your data

When you agree to take part in our research study, the information about your health and care may be provided to researchers running other research studies in this organisation and in other organisations.

These organisations may be universities, NHS organisations or companies involved in health and care research in the UK or abroad. Your information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Health and Social Care Research.

Your rights

Under the General Data Protection Regulation (GDPR), which came into effect on 25 May 2018, you have the following rights in relation to the information that we hold about you (your ‘personal data’):

Depending on the circumstances, we may have grounds for not complying with your request, for example, where we consider that deleting your information would seriously harm the research or where we need to process your data for the performance of a task in the public interest.

If you wish to exercise any of these rights, please contact the study team at:

If you change your mind and decide you no longer wish to be part of this study, then you can withdraw at any time and we will ensure you are removed from any future research and that your genetic sample is destroyed. However, we can’t remove you from research that has already taken place or remove the information about you that we have already obtained for this purpose. To safeguard your rights, we will use the minimum personally-identifiable information possible.


We aim to meet the highest standards when collecting and using personal information. However, should you wish to complain about our handling of your data, you can contact our Data Protection Officer,, who will investigate the matter.

If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful, you can complain to the Information Commissioner’s Office (ICO) by visiting:

Information Commissioner’s office - complaints

Contact us

Should you have any questions or would like more information about how we process and protect data collected for our research, then please do not hesitate to contact the study team. We can be contacted by:


Telephone: 0300 365 7660

or write to:

The Roslin Institute
Easter Bush Campus
EH25 9RG

Can't find what you need?

Contact us and we’ll get back to you as soon as possible.

Contact GenOMICC team

Updated June 2024