Data protection and sharing policy

BCTU Privacy Notice

This privacy notice explains how the Birmingham Clinical Trials Unit (the BCTU) within the University of Birmingham (the University) uses the personal data it collects and processes as part of the clinical trials we operate. It supplements the page on the University’s website ‘Data Protection – How The University Uses Your Data’ which, amongst other things, includes key definitions, explains what a privacy notice is, gives general information about how the University protects personal data and what your rights are.

Who are we?

The BCTU is one of two clinical trials units based within the University. Clinical trials units (CTUs) are specialised research units which design, centrally coordinate and analyse clinical trials and other studies which involve participants (usually patients or occasionally healthy people) who volunteer to take part in the research. The participants are recruited from hospitals or GP practices in the UK. The clinical trials or other research studies (referred to as trials in this privacy notice) are usually designed to answer questions about improving health or social care.

 The BCTU specialises in the design, conduct and analysis of definitive clinical trials and test evaluation studies.

 Our research is conducted in accordance with the principles of Good Clinical Practice and the applicable legislation for that type of trial. All of our research is also reviewed and approved by an independent Research Ethics Committee.

 See the Health Research Authority website (https://www.hra.nhs.uk) for more information about the rules and regulations governing trials.

 Our research is led by a senior medical doctor and is usually sponsored by the University of Birmingham, but the BCTU may work with other sponsors, NHS and academic organisations, as well. The sponsor of the trial will be the Data Controller for the purposes of the Data Protection Act (2018), so this will usually be the University. If another organisation is the Data Controller for a particular trial, you will be advised of this when you are invited to take part.

How does this privacy notice relate to other privacy notices?

When you are/were invited to take part in a trial, you will be/have been provided with a document called a Participant Information Sheet. This document is ethically approved, and provides information about the trial, the information to be collected and processed, where it is collected from, what your involvement will be and how your data will be handled. It will also explain if other organisations are involved in the trial and what their roles are.

 Data protection law changed on 25th May 2018, so if you received your Participant Information Sheet before then, this Privacy Notice provides updated information for participants in our trials about how personal data are used.

What personal data will be processed?

Information relating to trial participants:

At the outset of the trial, in order to answer the trial question and to oversee the quality of the trial, we collect personal information and healthcare data about participants taking part. This data may include:

• Name, date of birth, NHS Number or some other identifiers;
• GP/Consultant/Hospital name and contact details;
• Medical information which is relevant to the trial and/or your medical records;
• Your contact details, if you are a potential participant, who has asked to be kept informed about the trial, electronically. These details will be deleted when they are no longer needed.

During the trial, we will process further information about you, which will include:

• Details about your participation in the trial;
• Results/outcomes of any procedures, tests, interviews or questionnaire undertaken as part of the trial.

 We will normally collect this information from you directly, or from the hospital or GP practice where you are being seen. Sometimes we collect personal information and healthcare data from other sources such as GP practices, NHS Digital or national cancer registries. For some trials data may also be collected from third parties, for example those analysing tissue samples or reviewing scans. If the latter is relevant to the trial that you are taking part in, more details about this will be provided in the Participant Information Sheet for the trial.

 The type and amount of information collected for each participant depends upon the trial question, what information we need to identify you when we are communicating with third parties (e.g., the recruiting hospital) and whether we are contacting you directly. To safeguard your rights, we collect the minimum personally-identifiable information as possible.

 Some of the data we process are classed as ‘special category’ or sensitive personal data. This includes data concerning health, genetic data and biometric data for the purpose of uniquely identifying a natural person, racial or ethnic origin, religious or philosophical beliefs or data concerning a natural person’s sex life or sexual orientation.

 Information relating to healthcare professionals involved in the trial:

The BCTU also collects personal information about:

• doctors, nurses and other staff involved in the recruitment, diagnosis, and treatment of participants taking part in our trials;
• laboratory staff, company employees, and staff from other organisation which are supporting the trial;
• members of the public who contribute to the design and conduct of our trials or sit on local working groups or committees; and
• healthcare professionals who contribute to the trial management groups and oversight committees.

What is the legal basis for the processing?

We consider the processing of your information to be necessary for the purpose of:

• carrying out research, which is a task performed by the University in the public interest;
• scientific or historical research purposes, statistical purposes or archiving purposes in the public interest;
• for compliance with a legal obligation to which the University is subject, for example, retention of records in accordance with good (clinical) practice, inspection or audit;
• very occasionally, for example in the case of an emergency, to protect your vital interests when you are physically or legally incapable of giving consent.

Who will your personal data be shared with?

A single clinical trial involves many organisations including but not limited to: the hospitals recruiting participants, GP practices, laboratories analysing or reviewing samples, the sponsor, oversight committees and trial management group, national registries, pharmaceutical and biotech companies. It may be necessary to share participant personal (e.g., date of birth) and healthcare information with these parties during the course of the trial in routine communication or when assessing the quality and safety of the trial. The ethically approved trial specific Participant Information Sheet will provide information to participants on the organisations involved in delivering the trial in which they are taking part.

 Participants are also advised in the Participant Information Sheet that by taking part in one of our trials that they are agreeing to allow research staff at their hospital or GP practice and from the BCTU to look at their research and medical records; and that it may also be necessary to allow authorised personnel from the sponsor, NHS, regulatory bodies, and occasionally the company to have access to these records. This is to ensure that the trial is being conducted to the highest possible standards.

 Participant information may on occasion be shared with researchers running other ethically approved research studies (future related research). These researchers may be in the University of Birmingham, the sponsor organisation (if different), or in other universities, NHS organisations or companies involved in healthcare research in this country or abroad. Information is shared in accordance with the BCTU’s data sharing policy and access to information is strictly controlled. Where possible the information is anonymised before being shared. Participants will not be identified in any way in any report, presentation or publication arising from this future research.

 Information on the organisations given access to the personal information of other individuals on whom we hold data and who are involved in the delivery of a clinical trial will be provided in the protocol, where the governance arrangements for the trial are described, and/or on trial specific registration forms.

 Occasionally, trials may be inspected or audited by a third party organisation to make sure that the trial has been conducted in accordance with the relevant requirements. This might include, for example, the Medicine and Healthcare products Regulatory Authority (MHRA), NHS Digital or the Information Commissioner’s Office. In these circumstances, data is only shared as is necessary to comply with our legal and regulatory requirements and only for the purposes of the audit.

 Within the University, trial data are shared with only those University staff who need access for the purpose of delivering our academic and non-academic services and facilities.

 Participant personal data are shared as is necessary, on a considered and confidential basis, with several external organisations which assist the University with processing your information. These organisations act on our behalf, in accordance with our instructions, and do not process your data for any purpose over and above what we have asked them to do. We make sure we have appropriate contracts in place with them. Sometimes your personal data are processed by these organisations outside the European Economic Area (for example, because they use a cloud-based system with servers based outside the EEA), and if so, we make sure that appropriate safeguards are in place to ensure the confidentiality and security of your personal data.

 Outside of the data sharing requirements described above, we do not share personal data with any other third party without the express permission of the data subject or as permitted by data protection law.

 Participants are not identified in any report, presentation or publication arising from the trial.

How long will your data be kept?

Information relating to trial participants:

The information collected about participants is kept by the BCTU and the hospital or GP practice, or other institution providing the data, typically for at least 10 years after the end of the trial, to allow the results of the trial to be verified if needed. This is a legal requirement for some types of trial.

 Information relating to healthcare professionals:

Contact details of staff involved in trials are retained for the duration of the archiving period of the trial. This is in order to keep records of those individuals who have worked on the trial in accordance with the principles of Good Clinical Practice and for verification purposes.

Your rights in relation to your data

Details about your rights are set out on the website page ‘Data Protection – How the University Uses Your Data’. However, as our research is being conducted as a ‘task in the public interest’ under data protection law, rights to change or remove information are limited, as we need to manage information in specific ways in order for the research to be reliable, accurate and verifiable. If you therefore choose to withdraw from the trial, we keep the information already obtained.

 The website page ‘Data Protection – How the University Uses Your Data’ also explains how to ask any questions you may have about how your personal data are used, exercise any of your rights or complain about the way your data are being handled and provides the contact details for the University’s Information Compliance Manager, who will handle any data protection queries or requests.

 For general information about clinical trials, contact: bctu@contacts.bham.ac.uk 

Are changes made to this webpage?

This privacy notice is effective from 14 May 2018. It is reviewed when necessary and at least annually. Any changes will be published on this webpage. The latest review of this privacy notice was 08 March 2021.