GDPR
General Data Protection Regulation (GDPR) and the LENS Trial
The General Data Protection Regulation is a European Union regulation which came into force on 25 May 2018 and concerns individual privacy and data protection. To comply with this regulation we are required to provide the following information to all LENS trial participants. For individuals who agree to take part, the following will apply:
- The University of Oxford is the sponsor for this study based in the United Kingdom. We will be using information from you and your medical records in order to undertake this study and will act as the data controller for this trial. This means that we are responsible for looking after your information and using it properly. Your information is used in this way to conduct research in the public interest and our goal is to improve the health of patients with diabetic retinopathy. The University of Oxford will keep identifiable information about you for a maximum of 10 years after the trial has finished. When it is no longer necessary to retain personal data, it will either be deleted or rendered anonymous (non-identifiable). Information which is not identifiable will be retained for at least 25 years.
- Your rights to access, change or move your information are limited, as we need to manage your information in specific ways in order for the research, which is in the public interest, to be reliable and accurate. If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible. You can find out more about how we use your information by contacting the Chief Investigator, David Preiss, at lens@ndph.ox.ac.uk. You can also visit the compliance section of the University website.
- The University of Oxford and your NHS Scotland health board will use your name, CHI number and contact details to contact you about the research trial, and make sure that relevant information about the trial is recorded for your care, and to oversee the quality of the trial. Individuals from the University of Oxford and regulatory organisations may look at your medical and research records to check the accuracy of the research study. Your NHS health board will pass these details to the University of Oxford along with the information collected from you and/or your medical records. The only people in the University of Oxford who will have access to information that identifies you will be people who need to contact you by ‘phone, arrange sending you letters and postal questionnaires, arrange posting of study medication, or audit the data collection process. The people who analyse the information will not be able to identify you and will not be able to find out your name, CHI number or contact details.
-
In addition to personal data collected directly from LENS trial participants, we also collect personal data relevant to the trial from the following sources: NHS Scotland health boards, Public Health Scotland, the National Records of Scotland and the National Services Directorate.
- Your health board will keep identifiable information about you from the trial for a maximum of 10 years after the trial has finished.
- When you agree to take part in a research study, the information about your health and care may be provided to researchers running other research studies in this organisation and in other organisations. These organisations may be universities, NHS organisations or companies involved in health and care research in this country or abroad. Your information will be processed by PCI Pharma Services (in the UK) so that study treatment can be mailed to your address. If you contact the 24 hour Freephone number after hours, then your details may need to be processed by switchboard staff at Oxford University Hospitals NHS Foundation Trust (in the UK). Your information will only be used by organisations and researchers to conduct research in accordance with the UK Policy Framework for Health and Social Care Research.
- Your information could be used for research in any aspect of health or care, and could be combined with information about you from other sources held by researchers (whose institutions may act as data controllers), the NHS or government.
- Where this information could identify you, the information will be held securely with strict arrangements about who can access the information. The information will only be used for the purpose of health and care research, or to contact you about future opportunities to participate in research. It will not be used to make decisions about future services available to you, such as insurance.
- Where there is a risk that you can be identified, your data will only be used in research that has been independently reviewed by an ethics committee.
-
There may be occasions when we transfer your data outside the UK. Such transfers will only take place if one of the following applies: the country receiving the data is considered by the UK to provide an adequate level of data protection; the organisation receiving the data is covered by an arrangement recognised by the EU as providing an adequate standard of data protection; the transfer is governed by approved contractual clauses; the transfer has your consent; the transfer is necessary for the performance of a contract with you or to take steps requested by you prior to entering into that contract; or the transfer is necessary for the performance of a contract with another person, which is in your interests.
-
The University of Oxford’s Data Protection Officer can be contacted via data.protection@admin.ox.ac.uk.
-
You have the right to lodge a complaint with a supervisory authority. In the UK, this is the Information Commissioner’s Office (ICO). A complaint to the ICO can be made by visiting their website or by calling their helpline on 0303 123 1113.
-
This privacy notice was updated in February 2023.