Privacy Notice
We take your confidentiality and privacy rights very seriously. This notice explains how we collect, process, transfer and store your health data. It forms part of our duty of accountability and transparency under the General Data Protection Regulation (GDPR) and Data Protection Act (2018) (DPA).
The primary outcome of the ASPECT study requires the linkage of personal (health) data collected during the study (study data) to routinely collected NHS health data (routine data). This will enable the study team at the Bristol Trials Centre Trust to determine which of the study participants have had a hospital admission since randomisation onto the study. The process of linking study data to routine data is managed by Data Controllers. The University of Bristol and North Bristol NHS Trust are the Data Controllers for this study. The University of Bristol and University Hospitals Bristol and Weston NHS Foundation Trust are the Data Processors for this study.
Patients admitted to hospital with pneumonia will be asked for consent to take part in the ASPECT study. This will include consent for their identifiable data to be sent to NHS England (previously known as NHS Digital). Patients who have consented to participate in the study will have their study data (Personal Data) stored on a secure server hosted by University Hospitals Bristol and Weston NHS Foundation Trust.
In order to link the study data to the routine health data held by NHS England, University Hospitals Bristol and Weston NHS Foundation Trust will send study participant’s identifiable data (a pseudonymised Study ID, NHS Number, Date of Birth, Name, Gender, Post Code) to NHS England. NHS England will then link these identifiers to Hospital Episode Statistics (HES) data and the Office for National Statistics (ONS). NHS England will then return the required data to University of Bristol. Data will be pseudonymised to remove all identifiers.
The ASPECT study team will undertake some data cleaning before undertaking data analysis. The analysis will allow the study team to determine the frequency with which study participants are admitted to hospital and for what reason. The team will be specifically looking at major adverse cardiovascular events (MACE) and any events which could be related to aspirin, eg. bleeding events. The study can then determine whether the incidence is similar or not between the two groups of participants.
The National Opt-out
The national data opt-out was introduced on 25 May 2018, enabling patients to opt out from the use of their data for research or planning purposes.
Patients can view or change their national data opt-out choice at any time by using the online service at www.nhs.uk/your-nhs-data-matters or by clicking on “Your Health” in the NHS App, and selecting “Choose if data from your health records is shared for research and planning”.
Patients can choose to opt out of sharing confidential patient information for research and planning. However, you can also still consent to take part in a specific research project.
Patients who have opted out will still be able to take part in ASPECT. By signing the consent form, this overrides the National Opt-out, meaning the patient is agreeing to share their medical information with the ASPECT study team.
Data Retention and Onward Sharing
The linked data is held securely on University of Bristol servers and will be securely stored for 10 years after the trial is completed.
Patients can choose to have their information stored for future research and training purposes. For patients who opt-in for onward sharing, their data will be stored in a University of Bristol secure repository under controlled access and made available only to researchers who meet the criteria for access to confidential data. Patients can still be involved in the study if you do not want their data to be saved for future research.
Data from NHS England (previously NHS Digital) will not be shareable outside of the ASPECT team.
General Data Protection Regulation (GDPR) Legal Basis for Processing
Your data is being processed under General Data Protection Regulation (GDPR) Article 6(1)(e), processing for a task in the public interest, and Article 9(2)(j), processing for scientific research purposes.
Rights of the Individual
The GDPR provides rights for individuals which we need to make you aware of; the right to be informed, the right of access, the right to rectification, the right to erasure, the right to restrict processing, the right to data portability, the right to object to processing and rights in relation to automated decision making and profiling. There is no automated decision making (making a decision solely by automated means without any human involvement) or profiling (automated processing of personal data to evaluate certain things about an individual) involved in this study. The rights available to you depend on the reasons why we are processing your data. In certain circumstances, you have the right to request the restriction of the processing of your personal data. This means that you can limit the way that an organisation involved in this study uses your data. You may contest the accuracy of your personal data, you may feel that your data has been unlawfully processed, you may wish for an organisation to keep your data for a longer period in relation to a legal claim, or you may object to the articles under which an organisation has processed your data.
These requests can be made in writing. You can contact the Project Manager via email at aspect-trial@bristol.ac.uk.
Consent
We will ask for your consent before using your data for the study. We’ll always explain to you what’s going to happen and give you the choice to go ahead.
You consent has to be:
- Voluntary – it’s your decision.
- Informed – we have to give you all the information on this study.
You give consent by signing a consent form.
If you wish to withdraw your consent for data to be processed in this study you can do so at any time, without giving a reason, by contacting the Project Manager via email at aspect-trial@bristol.ac.uk.
Concerns and Complaints
If you have concerns about how an organisation has handled your information, you have the right to lodge a complaint to the Information Commissioner’s Office. Their helpline number is 0303 123 1113 or website: https://ico.org.uk/make-a-complaint/
You can also contact the Project Manager or the relevant Data Protection Officer in the first instance.
If you wish, you can contact the Data Protection Officer at the University of Bristol: data-protection@bristol.ac.uk