Privacy Notice
This notice is provided in compliance with the General Data Protection Regulation 2018 (GDPR).
Background
More research is needed to help provide the best health care for women, with or at risk of diabetes, who are planning pregnancy or are pregnant. The Diabetes & Pregnancy Priority Setting Partnership (PSP) project aims to identify a top ten list of questions that women, their families and friends, and healthcare professionals (HCPs) jointly agree are the most important. These questions will be shared with researchers and research funders. By doing this project, we aim to support research that answers the questions about diabetes and pregnancy of greatest value to women, their families, and HCPs.
The project is led by the National Perinatal Epidemiology Unit (NPEU). The NPEU is a research unit in the Nuffield Department of Population Health at the University of Oxford. Our mission is to conduct methodologically rigorous research to provide evidence to improve the care provided to women, babies and families during pregnancy, childbirth, the newborn period and early childhood as well as promoting the effective use of resources by perinatal health services.
What is this privacy notice about?
To carry out this project, we need to collect and process information about the people who take part in the project. This notice provides information about what information we collect and what we do with it.
Who is responsible for the data we collect?
Under the General Data Protection Regulation (GDPR) the 'data controller' is responsible for what happens to data which is collected. The University of Oxford is the “data controller" for the personal data that we process for the Diabetes & Pregnancy PSP project (The University's legal title is the 'Chancellor, Masters and Scholars of the University of Oxford'). This means that we decide how to use it and are responsible for looking after it in accordance with the GDPR. The University of Oxford's Data Protection Officer can be contacted via data.protection@admin.ox.ac.uk.
Personal data we collect about individuals
The Diabetes & Pregnancy PSP project aim is to support future research to focus on answering the questions of most value and importance to those who will be impacted by it. To achieve this research aim, we need to collect and process some personal information such as, name, contact details i.e. email address, postal address, telephone number; demographic information i.e. age, ethnicity, UK country, and health data e.g. about pregnancy and diabetes experiences.
How we use personal data
Personal data is only collected for the purposes of this project. We will use demographic and health data to understand the representativeness of our participants as a whole. We will use identifiable information i.e. email addresses, to communicate with our participants for the purposes that will be clearly detailed at each stage this information is requested e.g. to send them information about the final workshop. We will not use the information for any other purpose.
Our lawful basis for processing personal data including special category data for the Diabetes & Pregnancy PSP project is that the processing is necessary to perform a task in the public interest or for official functions, and the task or function has a clear basis in law – GDPR Article 6(1)(e).
How long we keep personal data for
Typically, personal data collected for the Diabetes & Pregnancy PSP project will be retained until the end of the project, expected to be up to 2 years from the date the initial survey opens. After this time, personal data will either be deleted or rendered anonymous (non-identifiable). All the anonymised data will be kept indefinitely.
The identifiable data collected for the purpose of identifying and communicating with individuals for the final workshop will be securely removed once all the workshop administration and follow-up (feedback on the workshop and sharing outcomes) is completed, or until the individual requests it to be removed.
The identifiable data, namely email addresses, provided by individuals with permission for project updates and news about other projects in diabetes or pregnancy, will be kept securely indefinitely, or until the individual requests it to be removed.
We may need to retain personal data for longer if it is necessary to fulfil our purposes, including any relating to legal, accounting, or reporting requirements. We may also retain personal data for further research for which a legal basis exists. This will always be done in accordance with data protection laws.General information about how long different types of information are retained by the University can be found in the University's Policy on the Management of Research Data and Records, available via http://researchdata.ox.ac.uk/university-of-oxford-policy-on-the-management-of-data-supporting-research-outputs/.
How we protect data
We ensure that we protect personal identifiable data against unauthorised access, unlawful use, accidental loss, corruption or destruction. We store all data in encrypted files on the University's secure servers. Files containing personal identifiable data are password protected. File access is limited to authorised members of the team who require access. Personal information is only made available to specified individuals in the project team on a 'need to know' basis.
We keep these security measures under review and refer to University Security Policies to keep up to date with current best practice. Read the University's data protection policy.
Sharing identifiable data
Personal identifiable data which is collected and managed by the NPEU will not be shared with anyone else.
At the end of the project anonymised data (from which individuals cannot be identified) may be shared with other groups who are doing similar research. The data which is shared in these circumstances will not include any information to enable individuals to be identified and the data will not be combined with any other information in a way that could lead to individuals being identified. Any information shared will only be used for the purpose of health and care research, and will not be used to contact individuals or to affect their care. It will not be used to make decisions about future services available to individuals, such as insurance.
The rights of individuals
Under the General Data Protection Regulation (GDPR), you have rights in relation to the personal data we hold about you. Your rights can be found here: https://compliance.admin.ox.ac.uk/individual-rights.
To safeguard an individual's rights, we will use the minimum personally-identifiable information possible. Individuals who have taken part in the project and for whom we hold personal data, have the right to withdraw their data from the project at any time. If this happens we will keep the anonymised information that we have already obtained but securely remove all identifiable data.
Complaints
If you want to exercise any of your rights under the GDPR or are dissatisfied with the way we have used your information, you should contact the University's Information Compliance Team via data.protection@admin.ox.ac.uk. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner's Office (ICO). A complaint to the ICO can be made by visiting their website https://ico.org.uk/make-a-complaint/ or by calling their helpline on 0303 123 1113.
Contact us
If you would like to contact us directly for more information about how we use and protect data collected for the Diabetes & Pregnancy PSP project, please contact Dr Goher Ayman, Diabetes & Pregnancy PSP Co-lead, NPEU, by email JLAPSP@npeu.ox.ac.uk or phone on +44 (0)1865 289 757.