Research Participant Privacy Notice
Introduction
LSTM is committed to ensuring that your privacy is protected and will only process personal data in accordance with the Data Protection Act 2018 and UK General Data Protection Regulation (UK GDPR) and any other applicable data protection legislation.
What information is being collected & what is the legal basis for collecting your data?
The information collected will vary based on the research study you are taking part in. This should be set out in the participant information sheet that you received.
LSTM’s lawful basis for processing your personal data for research is that it is necessary for the performance of a task carried out in the public interest.
Where research involves special category data, such as health information, LSTM relies on the research provisions under Article 9(2)(j) UK GDPR and Schedule 1 of the Data Protection Act 2018.
When taking part in a research project you may be asked for your consent in relation to participation, this is to help LSTM collect and use personal data ethically and is not the lawful basis for processing your data. Research Participants may withdraw consent to participate in the research study at any time.
If you are participating in a clinical trial the research project may, in the event of an adverse event, process your personal data to protect your vital interest if your consent can’t be sought, for example informing a local hospital of your involvement in the trial so you can receive medical support.
How are we using your data?
LSTMÂ uses your personal data to conduct the research study that you are participating in.
The participant information sheet should describe the research project and its aims, as well as the intended outputs, to help you understand how your data are being used.
How is your information collected?
Your personal information may be collected in a number of ways and will vary depending on the research study you are participating in, your participant information sheet should tell you how your data is collected.
Your information may be collected by LSTM or it may be collected by another organisation that LSTM is working with for the research project.
How is your information processed?
A variety of systems may be used to process your data depending on the research project you are participating in.
Appropriate technical and organisational measures are applied to keep personal data safe including limiting access to data to those who have a business need to access it within LSTM.
When LSTM uses a supplier appropriate due diligence is undertaken to ensure that they also have appropriate security measures in place.
If information is sent outside the UK or EEA appropriate safeguards are in place to ensure adequate levels of protection. Where information is transferred outside the UK, appropriate safeguards will be used to ensure that personal data remains protected in accordance with UK data protection law (for example through approved contractual clauses).
Who will your information be shared with?
Information may be shared with other organisations that LSTM is working with in relation to the research project. Your participant information sheet should detail any other organisations that are involved.
For some research projects pseudonymised or anonymised personal data may be shared in project reports to funders.
Pseudonymised or fully anonymised data may be made available to other researchers for reuse through secure research repositories or open access platforms where this is required by funders or appropriate for the research.
Information may also be shared if its disclosure is required by law.
Retention of your data and updating your information
Your personal data is retained for the length of time it takes the research project to be completed and then a number of years after completion.
For some research projects personal data may be kept for 5 years following the end of the research study. Whilst clinical trials may retain your data for 20 years following the end of the research study. Your participant information sheet will tell you how long your data are being kept for.
Consent forms are kept separate to any data created as part of the research study and retained in accordance with the terms and conditions of the study and with LSTM’s research data retention schedules.
Your rights and how to find out what information we hold about you
The GDPR gives individuals the following rights, it should be noted that these rights are not an absolute:
1. The right to be informed
2. The right of access
3. The right to rectification
4. The right to erasure (to be forgotten)
5. The right to restrict processing
6. The right to data portability
7. The right to object
8. Rights in relation to automated decision making and profiling
Some of these rights may be limited where personal data are processed for research purposes, where applying the right would seriously impair the research.
How to contact us
If you would like further information or to make an access request for your personal data, please contact the LSTM data protection officer dataprotection@lstmed.ac.uk, 0151 702 9323, or by post to:
Data Protection Officer
Liverpool School of Tropical Medicine
Pembroke Place
Liverpool
L3 5QA
United Kingdom
How to complain
If you are unhappy with how your information is being used, first complain to the Data Protection Officer using the contact details above. If you continue to have concerns, you can contact the Information Commissioner:
Helpline: 0303 123 1113
Website:Â https://ico.org.uk/for-the-public/raising-concerns/