ToSCiN Privacy Notice
Who is responsible for your data?
The data controller for the data we collect about you is Manchester University NHS Foundation Trust (the Sponsor of the study).
How will we use information about you?
If you have enrolled your child in ToSCiN, we will need to use information from you and your child's medical records for this research project.
This information will include name, address, contact details, and your baby's NHS number.
If you have agreed to participate in an interview for ToSCiN, we will need to use information from you for this research project. This information will include your name and contact details.
People will use this information to do the research or to check your records to make sure that the research is being done properly. See below for more information on this.
People who do not need to know who you are will not be able to see your name or contact details. Your data will have a code number instead.
We will keep all information about you safe and secure.
Once we have finished the study, we will keep some of the data so we can check the results. We will write our reports in a way that no-one can work out that you took part in the study.
Personal data we collect about you
If you have enrolled your child in ToSCiN, staff within the NHS, or other healthcare provider, will collect information from your child's medical records for this. You have agreed for yourself and / or your child to take part, in accordance with our instructions. The National Perinatal Epidemiology Unit Clinical Trials Unit (NPEU CTU) and the University of Liverpool will use your name, address, NHS number and contact details to contact you about the research study, and make sure that relevant information about the study is recorded for your care, and to oversee the quality of the study. Individuals from the Sponsoring Organisation and regulatory organisations may look at your medical and research records to check the accuracy of the research data. The only people in the NPEU CTU and the University of Liverpool who will have access to information that identifies you will be people involved in the processes of:
- Contacting you to carry out study interviews
- Sending you a copy of the results (if you consented to receiving this)
- Auditing the data collection process
- Contacting you about future related studies (if you consented to receiving this)
The people who analyse the information will not be able to identify you and will not be able to find out your name, address, NHS number or your contact details.
How we use your personal data
As organisations that undertake clinical research, we use personally-identifiable information to conduct research to improve health, care and services. As a publicly-funded organisation, we have to ensure that it is in the public interest when we use personally-identifiable information from people who have agreed to take part in research. This means that when you agree to take part in a research study, we will use your data in the ways needed to conduct and analyse the research study. Health and care research should serve the public interest, which means that we have to demonstrate that our research serves the interests of society as a whole. To ensure we carry out the research to the highest standards we comply with the UK Policy Framework for Health and Social Care Research.
How long we keep your data
The NPEU CTU will keep identifiable information about you and your child for 25 years after the study has finished.
If you participate in an interview or focus group, the University of Liverpool will keep identifiable information about you for 10 years after the study has finished.
This is so that, in the extremely unlikely event that a very long term effect from the study is discovered, we are able to contact you.
What are your choices about how your information is used?
You can stop being part of the study at any time, without giving a reason, but we will keep information about you that we already have.
We need to manage your records in specific ways for the research to be reliable. This means that we won't be able to let you see or change the data we hold about you.
How we protect your data
We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption or destruction.
We use technical measures such as encryption and password protection to protect your data and the systems they are held in. We also use operational measures to protect the data, for example by limiting the number of people who have access to the databases in which your data is held.
We keep these security measures under review and refer to University security policies to keep up to date with current best practice. Read the University of Oxford's data protection policy. Read the University of Liverpool's data protection policy.
If you have consented to participate in an interview, with your permission we will record the interview. We will send the recording of the interview to a transcription company who will write up what has been said. The recording will be stored safely and securely throughout this and the transcription company will have a confidentiality agreement with the University of Liverpool for the recordings. The write-up of the interview will then have all identifying details (such as names) removed, and the original recording will be deleted.
Sharing your data
Your personal data which are collected and managed by the NPEU CTU will not be shared with anyone else, unless you have consented to participate in an interview, in which case, it will be shared with the research team at the University of Liverpool, so that they can contact you to arrange this. Otherwise, it will be used only to allow us to send you a summary of the results or to tell you about future related studies, if you agreed to this. At the end of the trial anonymised data (from which you cannot be identified) may be shared with other research groups who are doing similar research. This information will not identify you and will not be combined with other information in a way that could identify you. The information will only be used for the purpose of health and care research, and cannot be used to contact you or to affect your care. It will not be used to make decisions about future services available to you, such as insurance.
If you participated in an interview, we may use brief quotations from you in study reports about the interviews. No one will be able to identify you or your child in these reports.
Your rights
Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible.
Where can you find out more about how your information is used?
You can find out more about how we use your information:
- On the HRA website
- By asking one of the ToSCiN research team using the contact details on the consent form
- By sending an email to toscin@npeu.ox.ac.uk
- By contacting the sponsor's Data Protection Officer at DPO@mft.nhs.uk
If you wish to raise a complaint on how we have handled your personal data, you can contact the sponsor's Data Protection Officer at DPO@mft.nhs.uk and they will investigate the matter. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner's Office (ICO).
