Privacy Notice
1) HOW WE USE YOUR INFORMATION
The UK Women’s Cohort Study (UKWCS) was established with the aim to investigate links between diet and health.
It is one of the largest studies of diet and cancer in middle-aged UK women, with members of the cohort being involved in several different projects over the past 20 years with information collected about their diet and lifestyle. The UKWCS also links this data to health records.
This combined dataset is held at the Consumer Data Research Centre (CDRC) in a pseudonymised form. Researchers wishing to use the data are required to submit their request with details of their research to the Research Approval Group (RAG) for approval. On approval, the researchers are permitted to access the pseudonymised data via the Virtual Research Environment (VRE). Data will not be transferred to third countries or international organisations.
Over time this combined dataset grows as an insightful resource into the links between diet and health as more health related incidents are collated. Hence it is envisaged the dataset will be retained until 2045.
The University of Leeds is the ‘data controller’ as defined in the Data Protection Act (the organisation who determines why and how personal data are processed). The UKWCS complies with the requirements of the General Data Protection Regulations (GDPR) and the Data Protection Act (2018) with regard to the collection, processing, storage and disclosure of personal information.
Microsoft Ireland Operations Limited is our data processor providing cloud storage services. The University of Leeds instruct Microsoft to securely store all data in the Microsoft Azure (Cloud) UK datacentres in the UK region only. Microsoft will not process this data outside of the UK and/or the EEA, without the explicit instruction of the University of Leeds.
This privacy policy explains how we will use any data that you share with us. We are legally required to tell you how we will use this information and give you the opportunity to tell us not to use your information in that way.
It applies to information we collect when you:
* Visit our website
For researchers:
* Submit a proposal
* Complete a data access agreement, confidentiality agreement etc.
* Submit a manuscript for review
For participants:
* Phone or email us
* Return completed questionnaires, consent forms, reply slips or other written information
* Bio samples
* Collect data from health records
It also applies to the way we handle, process and store your information in:
* Sending mail and email
* Storing questionnaires and consent forms
* Finding participants who we lose contact with
* Providing research data for use in scientific research
We also provide you with further information on your privacy, confidentiality and anonymity in other parts of our website and, for participants, in the information we send you via post and email when we ask you to take part in clinics or questionnaires.
2) OUR LEGAL BASIS
Who controls the use of our data
The University of Leeds is the data controller and can be contacted at:
Alice Temple,
Data Protection Officer,
University of Leeds, 11.72 EC Stoner Building, Leeds LS2 9JT, UK.
The University’s main telephone number is +44 (0) 113 2431751.
Complaints or queries
If you have any queries or concerns relating to this privacy notice or the way your data is being processed then please contact the University of Leeds’ Deputy Secretary, David Wardle on d.wardle@adm.leeds.ac.uk or you may complain to the Information Commissioner's Office.
Our legal basis:
The UKWCS’s purpose is to conduct scientific research that aims to improve the public good. This is part of the wider purpose of the University of Leeds to conduct research aiming to improve scientific understanding.
Our legal basis for using your information, under GDPR and the Data Protection Act 2018, is:
1) performance of a task carried out in the public interest (Article 6(1)(e) in the GDPR); and, where sensitive personal information is involved:
2) scientific or historical research purposes or statistical purposes (Article 9(2)(j) in accordance with Article 89(1)).
The GDPR defines ‘sensitive personal information’ as information that reveals a person’s racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership; and the processing of genetic data or biometric data for the purpose of uniquely identifying a person; data concerning health or data concerning sex life or sexual orientation.
This legal basis within GDPR and the Data Protection Act 2018 is separate to, and in addition to, our seeking consent to take part in the research process, which we use to help ensure our research is ethical and complies with other applicable laws.
We may disclose your personal information to third parties if we are under a duty to disclose or share your personal data in order to comply with any legal obligation, or in order to enforce or apply our terms of use and other agreements; or to protect the rights, property, or safety of UKWCS, or others.
3) PRIVACY NOTICE INFORMATION FOR ALL
Visitors to our website
Where we request personal data from you on our website you will be informed at that time of the purpose for which the data will be processed and how it will be processed, its legal basis for processing as well as any transfers to third parties.
When you access our web pages certain information your browser provides, including your IP address at the time, browser type, and potentially the address of the page you last visited, will be automatically recorded by the University. This data may be used to aid detection in the event of a security breach. The legal basis for this processing is necessity to pursue our legitimate interests to keep our website secure. The University retains this data in a form from which you may be identifiable for a period of up to one month.
This notice is separate to, but supported by, the University of Leeds’ website privacy policy available at http://www.leeds.ac.uk/info/5000/about/237/privacy_notice
Accessing and updating personal information
As an individual, you have a right under the GDPR to update or amend the personal information we hold about you, to ask us to remove your personal information from our records and to obtain information from us, including a description of the personal data that we hold on you.
Individuals can find out if we hold any personal information by making a ‘subject access request’ under the Data Protection Act 2018. If we do hold information about you, we will:
* give you a description of it;
* tell you why we are holding it;
* tell you who it could be disclosed to; and
* let you have a copy of the information in an intelligible form
To make a request to us for any personal information we may hold you need to put the request in writing to the address provided on our website. Please see https://ico.org.uk/ for further information on the above rights. You may also contact the Data Protection Officer for further information.
You have a right to complain to the following supervisory authorities about the way in which we process your personal data: http://ec.europa.eu/newsroom/article29/document.cfm?action=display&doc_id=50061
Links to other websites
This privacy notice does not cover the links on our website which link to other sites. We encourage you to read the privacy statements on the other websites you visit.
How to contact us
You can contact us via the details on our website.
4) INFORMATION FOR RESEARCHERS ONLY
Proposal form and supporting documents
This data includes the name and contact details of the Principal Applicant, and those of any co-applicants and any other data users on the proposal and supporting documents. We will use this data so we can communicate with you about your proposal. We may also collect your personal details on a number of supporting documents related to your proposal. These include: data access agreements, confidentiality agreements etc., and UKWCS ethics application forms. We may also collect your personal details when you submit a manuscript for review.
5) INFORMATION FOR UKWCS PARTICIPANTS ONLY
Our commitment to you
Taking part in the project is voluntary and you are free to withdraw at any time without giving a reason. You will not be identified from the research – researchers do not see your name with your information – they just see your ID number.
Changing your mind
If you wish to change the way you participate – or stop participating – you can do so at any time. More information on withdrawing from the study is available at https://ukwcs.leeds.ac.uk/participants/opt-out/
Phoning, emailing or texting us
When you phone, email or text us we will verify your identity and ensure that you are a study participant before proceeding. Any information that you give us will be recorded in our contact management system unless you request otherwise. We will also record relevant details (such as date or time) of the phone call, email or text message.
Secondary contacts
Where you have given us this information, we will store personal contact details of a friend or family member. Please ensure you have their permission for us to store their contact details and for us to contact them if necessary. We store this information on our contact management system. We will use this information to contact your friend or family member if we are unable to get in touch with you.
Returning completed questionnaires, consent forms, reply slips or other written information
When you return an item to us in writing (for example a questionnaire, consent form, reply slip or written letter) we will treat this information as confidential. We will not pass your personal details to third parties without your consent
How we will use your personal details
We will keep your personal details confidential. We will not pass your personal details to third parties without your consent. However, to facilitate record linkage with health data we will, under controlled conditions, share NHS number and date of birth with NHS digital and Public Health England to allow us to explore links between diet and health outcomes.
We may use your personal details to contact you regarding the UKWCS.
How we will use your research data
We will only collect your data with permission, for example by asking you to complete a questionnaire. Once we have collected it, it will be processed for research use. It will be stored securely and confidentially. We will de-identify the research data, so you cannot be identified from it. We will then provide this information to researchers on request and only under strict conditions
Collecting data from routine official records
Information from the following organisations:
- NHS Digital data - Hospital Episode Statistics (HES): Outpatient (OP) and Admitted Patient Care (APC) and Civil Registry data
- Public Health England data
- National Cancer Registration and Analysis Service
Are used alongside the information collected about you (for example, in questionnaires)
Through doing this, researchers study associations between diet and health.
Who we share data with
Researchers working at Universities, in government departments, at charities or other organisations across the world may apply to access research data. Each application is assessed by the Research Approval Group (RAG), who decide whether the researcher is legitimate, if the data requested is needed to conduct the research, and if the research project can be conducted in line with the commitments we have made to you. We only share data in a way that seeks to protect your confidentiality. No automated processing or profiling is in use.
About this privacy notice
Version 1.0 ; 24/07/2018