REVEAL Data Privacy Notice for Participants

1. Who is responsible for your data?

The Data Controller and the Sponsoring organisation for REVEAL is the University of Oxford. This means that we, as the University of Oxford researchers, are responsible for looking after your information and using it properly in accordance with the UK General Data Protection Regulation (UK GDPR).

2. Personal data we collect about you

Information about people taking part in REVEAL comes mainly from the data collected at study visits that you attended either in person or via telephone during the main trial (between May 2011 and Jan 2017) and post-trial follow-up (between May 2017 and Apr 2019). We may have also received information from your GP, hospital records and national registries of health data (e.g. NHS England and NHS Scotland).

We are now investigating the longer-term effects of anacetrapib (the treatment studied in the REVEAL trial) in participants from the UK only. This will help scientists assess the long-term safety and benefits of controlling cholesterol levels. For this extended follow-up (from 2019 onwards) we will provide your details (name, date of birth, gender, NHS number – or CHI number in Scotland - and postcode) to health registries or NHS bodies in order to receive information about study participants in return.

The following is a list of the types of information we may hold about you (including both data collected during the main trial, and ongoing data collection from NHS Registries):

• Your name, address, NHS number, date of birth and sex
• Your medical conditions including whether you have had a heart attack or a stroke
• Information about hospital admissions, and attendance at outpatients clinics, and accident and emergency departments
• Some results from tests done on the blood and urine samples you provided during the study
• Other information related to health such as height, weight, BMI and blood pressure
• Dates and causes of death
• Information about cancers
• Information about diabetes
• Information about prescriptions
• Information from NHS registries about your cholesterol levels and the results of diabetes and kidney blood tests.

Information is requested from NHS England for information about English and Welsh participants, Public Health Scotland and the NHS Central Register (NHSCR) about Scottish participants, and from Digital Health and Care Wales (DHCW) and the SAIL Databank for participants in Wales.

3. Why we collect and process your data

By agreeing to take part in REVEAL, participants accepted that there would be long-term collection of their data. The University of Oxford will use this data to study the long-term effects of anacetrapib on vascular events, deaths, and other serious adverse events. We will also use your data to research new ways of running clinical trials in the future.

We may use information collected about REVEAL participants to help with identifying specific outcomes within NHS Registry data. This could include improving how we identify certain cardiovascular events such as heart attacks and strokes. While some of this work will be directly related to the REVEAL trial, it will also be relevant to current and future trials (at the University of Oxford) that rely largely on routine healthcare data provided by NHS Registries to collect information about participants.

We will only process your personal data for the research purposes for which we collected it, unless we reasonably consider that it needs to be used for another reason that is compatible with the original purpose. We will not use your personal data for any form of automated decision-making or public profiling, or any other unrelated purpose.

4. How we use your personal data

As a publicly funded organisation, we have to ensure that the research we do is in the public interest when we use personally identifiable information from the people who agree to take part in the research.

The legal basis for the processing and storage of your personal data for REVEAL and its sub-studies is that it is ‘a task in the public interest’ (Article 6(1)(e) UK General Data Protection Regulation (UK GDPR)). In addition, a required condition under the UK GDPR to process your special category (sensitive) personal data is met as it is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes (Article 9(2)(j) UK GDPR).

This means that we will use your data (including your health data) in the ways needed to conduct and analyse the research study. We also have to demonstrate that our research serves the interests of society as a whole. To ensure we carry out the research to the highest standards we comply with the Clinical Trials Regulation 536/2014 and the UK Policy Framework for Health and Social Care Research. The extended follow-up has also been reviewed and approved by the Oxford B Research Ethics Committee (ref: 10/H0605/83).

5. How long we keep your data

The University of Oxford will retain your personal data for at least 25 years after the end of the study, in line with Good Clinical Practice regulatory guidelines and relevant legislation. We intend to collect linkage data up until 2033. In order to do so, your direct identifiers will be stored until at least 2033 and your other personal data may be stored for a longer period until 2058. At the end of the retention period, your personal data will either be deleted or rendered anonymous (non-identifiable). The need to retain your data will be reviewed regularly.

We may need to retain your personal data for longer if it is necessary to fulfil our purposes, including any legal, accounting, or reporting requirements. We may also retain personal data for further research for which a legal basis exists, but this will always be done in accordance with data protection laws.

General information about how long different types of information are retained by the University can be found in the University’s Policy on the Management of Research Data and Records, available at ttps://researchdata.ox.ac.uk/university-of-oxford-policy-on-the-management-of-data-supporting-research-outputs/.

6. How we protect your data

We protect your personal data against unauthorised access, unlawful use, accidental loss, corruption or destruction. We use technical measures such as encryption and passwords to protect your data and the systems they are held in. We also use operational measures to protect the data, for example, we limit the number of people who have access to the databases in which your data is held, and whenever possible, information that could identify you (e.g. your name, date of birth, gender, NHS number or CHI number in Scotland, and address) will be removed and replaced by a unique study ID number. Your data is treated in the strictest confidence and is used solely for academic research purposes. No individuals will be identified in any publications arising from this work.

We keep these security measures under review and refer to University Security Policies to keep up to date with current good practice.

7. Sharing your data

Any personal data that identifies you will be collected and managed by the research team at the University of Oxford. It will not be shared with anyone else, except to obtain health information about you from the health registries as described. None of the data provided by health registries will be shared outside of the University of Oxford.

Data that does not include your personal identifiers has previously been shared with Merck, Sharp & Dohme (Merck) as part of the contractual agreements for the period of study that you were taking the medications, and during the two-year post-trial follow-up period. Merck previously funded the study and provided the treatments. Your data will not be shared routinely with Merck or others whilst the extended follow-up study is ongoing.

At the end of the extended follow-up study in 2033, de-identified data (from which you cannot be identified) may be shared with other research groups who are doing similar research. This information will not identify you, nor will it be combined with other information in a way that could identify you. Other researchers will only be permitted to use the information for health and care studies. It will not be used to contact you, affect your care, or used to make decisions about future services available to you, such as insurance.

8. Transfer of your data outside of the European Economic Area (EEA)

Your data is securely stored by us at our premises within the UK. Only de-identified (and not identifiable) data may be transferred outside of the EEA.

As part of our ongoing research, we may send samples collected from participants during the main trial to laboratories outside the UK for analysis. Such analyses will be governed by a collaborative contract between the laboratory and the University of Oxford. It will not be possible to directly identify you from these samples. They will be labelled with a unique study number, which only authorised members of the REVEAL research team at the University of Oxford can trace back to you. The results from laboratories outside the University of Oxford will be transferred to us using secure methods.

9. Your rights

Under the UK General Data Protection Regulation (UK GDPR), you have the following rights in relation to the information that we hold about you (your ‘personal data’):

• The right to request access to your data (commonly known as a "subject access request"). This enables you to receive a copy of your data and to check that we are lawfully processing it.
• The right to request correction of your data. This enables you to ask us to correct any incomplete or inaccurate information we hold about you.
• The right to request erasure of your data. This enables you to ask us to delete or remove your data in certain circumstances for example, if you consider that there is no good reason for us continuing to process it. You also have the right to ask us to delete or remove your data where you have exercised your right to object to processing (see below).
• The right to object to the processing of your data. This enables you to oppose our using your data where we are processing it to meet our public tasks or legitimate interests (or the legitimate interests of a third party) and there is something about your particular situation which makes you want to object to processing on this ground. You also have the right to object where we are processing your data for direct marketing purposes.
• The right to request that the processing of your data is restricted. This enables you to ask us to suspend the processing of your data, for example, if you want us to establish its accuracy or the reason for processing it.
• The right to access, change or move your data. Depending on the circumstances, we may have grounds for not complying with your request, for example, where we consider that deleting your information would seriously harm the research or where we need to process your data for the performance of a task in the public interest.

If you wish to exercise any of these rights, please contact reveal@ndph.ox.ac.uk.

If you withdraw from the study, we will keep the information about you that we have already obtained. To safeguard your rights, we will use the minimum personally-identifiable information possible. For further information, see: https://compliance.admin.ox.ac.uk/individual-rights.

10.Changes to this privacy notice

We reserve the right to update this privacy notice at any time. Updated versions will be provided on the REVEAL website.

Note: the original website (as provided on the study documents you were given during the trial) was www.revealtrial.org. This address still works, but from October 2020 redirects to https://www.ctsu.ox.ac.uk/research/hps3-timi55-reveal.

11.Complaints

If you wish to raise a complaint about how we have handled your personal data, you can contact our Data Protection Officer (data.protection@admin.ox.ac.uk) or by telephone on 01865 280299. If you are not satisfied with our response or believe we are processing your personal data in a way that is not lawful you can complain to the Information Commissioner’s Office (ICO) by visiting their website at https://ico.org.uk/make-a-complaint/ or by calling their helpline on 0303 123 1113.

12.Contact

If you wish to raise any queries or concerns about this privacy notice please e-mail us at reveal@ndph.ox.ac.uk or write to: REVEAL, Clinical Trial Service Unit (CTSU), Richard Doll Building, University of Oxford, Roosevelt Drive, OXFORD, OX3 7LF.

You can also phone 0800 585 323.

REVEAL Data Privacy Notice for Participants, v2.0, 18-Oct-2023