Information for participants

the mexico city prospective study privacy notice 

The purpose of this Privacy Notice is to explain to you, the participants, how we, the University of Oxford collect, share and use the personal information about you that forms the Mexico City Prospective Study (MCPS), the study originally called the Coyoacán Project.

This Privacy Notice is updated from time to time to reflect changes in law, regulation and practice.

Fundamentally, we should like to assure you that we will only process, store and use your data in a manner that is consistent with the basis on which you joined the Mexico City Prospective Study (as described in the information materials and consent form you were given when you originally agreed to take part in the study). In particular, your information will continue to be made available only to bona fide researchers undertaking health research that is in the public good.

This Privacy Notice sets out the types of data that we have collected from you and how and by whom that data is used.  It also sets out the lawful basis on which we process your data, your rights as a data subject and your rights to withdraw from MCPS.

We would also emphasise that wherever possible your data is anonymised such that direct and indirect identifiers are removed.  We only use, and only permit third parties to use, identifiable data where necessary.

How (and why) does the University of Oxford use your personal data for research purposes?

1. Why is this information relevant to me?

Between 1998 and 2004, you agreed to participate in a research study run by the Mexican Ministry of Health and the National Autonomous University of Mexico (UNAM) (‘Proyecto Coyoacán’, and now referred to as ‘Mexico City Prospective Study’). That study was, and continues to be, done in collaboration with researchers at the University of Oxford (United Kingdom).

The study collected (and continues to collect) information about you from three sources (i) directly from you (via face-to-face interview in your home), (ii) through linkage to mortality records, and (iii) through data generation. Copies of all study data are held by both UNAM and the University of Oxford.

i. Data collected directly from you by researchers at UNAM
When you were recruited to join MCPS you had a face-to-face interview in your home where you provided information about yourself (such as your education, employment, lifestyle, and history of disease) and had some physical measurements taken (such as weight, height and blood pressure). Most of you also provided a blood sample, which was subsequently sent to Oxford for long-term storage and future processing. Following the initial recruitment, MCPS has continued to collect more data directly from you, such as

• data collected from a subset of you who participated in a resurvey between 2015 and 2019
• data collected from a health follow-up survey which began recruiting in 2019 and is still in progress.

ii. Data collected from linkage to other data providers
The Mexico City Prospective Study is a prospective resource and participants are ‘tracked’ for mortality through linkage to Mexican national mortality records. This enables the study to explore how social, lifestyle, physical, metabolic and genetic factors influence the major causes of death in Mexican adults.

iii. Data generation
With the data and samples that you provide, we are able to generate further data to enhance our database, particularly from undertaking assays from samples.  This includes biomarkers and genetic data.  All assay work is conducted in a manner whereby the participant remains anonymised. We will not tell you the results of these blood analyses. Instead, the data are used for scientific research to benefit future generations of Mexicans. 

The information you previously provided has been shared with researchers at the University of Oxford solely for research purposes. The information below explains how the University of Oxford handles your data (and will handle any future data) and describes the University of Oxford’s commitment to protect your privacy and comply with data protection laws. 

2. Who will process my personal data?

The University of Oxford is a joint “data controller” for the personal data that we process for the Mexico City Prospective Study (The University’s legal title is the ‘Chancellor, Masters and Scholars of the University of Oxford’). This means that we decide how to use it and are responsible for looking after it in accordance with the UK General Data Protection Regulation (GDPR). Your personal data will be processed securely, in the United Kingdom (UK), by the University of Oxford, including its relevant departments and research units, and any other organisations who are involved in carrying out the study together with the University of Oxford. These may include other universities or hospitals, or commercial entities sponsoring the research.

It is possible that in the future, the University of Oxford may share minimally identifiable data with other academic or commercial organisations they collaborate with to carry out further related research (where this is in the public interest or necessary for the purposes of another organisation’s legitimate research interests). The Regeneron Genetics Center (RGC), USA, has analysed your genetic data which is now being used for the purposes of genetic population research. These data have also been shared with AstraZeneca (UK) and, for a subset of ~10,000 people, with AbbVie (USA) for research purposes. The University of Oxford will always make sure that any such sharing for further research is done in compliance with data protection laws, and under terms that protect your privacy and the confidentiality of your data.

The University of Oxford may also disclose your personal data to third party service providers or subcontractors in connection with any of the research activities described above. Activities that may be carried out by third-party service providers include linking your data to that held by your health-service providers. Any third-party service providers are required to take appropriate security measures to protect your personal data in line with the University of Oxford’s policies. Third-party service providers are not allowed to use your personal data for their own purposes, but rather to only process your personal data for specified purposes and in accordance with the University of Oxford’s instructions. To date, UK Biocentre have aliquoted the study blood samples and extracted DNA for the purposes of genetic population research; and Nightingale Health Plc (Kuopio, Finland) have carried out nuclear magnetic resonance (NMR) spectroscopy to characterise circulating plasma lipids.

Your personal data may be transferred to, and stored at, a destination outside the United Kingdom (UK), in accordance with the law. For example, this may happen where the University of Oxford uses IT systems which are hosted outside the UK. The University of Oxford will make sure that identifiable data is removed whenever possible and that any data transfer is done securely. If any foreign country to which data is transferred does not have equivalent data protection standards to those required in the UK, appropriate safeguards will be adopted to protect and maintain the confidentiality of your data (including using standard data protection clauses adopted by the European Commission, where relevant). If you require any information about these safeguards, you may contact us (see data protection officer email address below). 

3. What is the purpose and legal basis of the processing?

In general terms, the University of Oxford uses your personal data (including sensitive or “special category” data such as health data) to carry out academic and/or translational research in the public interest. This is the University of Oxford’s legal basis for processing personal data under UK data protection law.

Your personal data may also be used for further research beyond the initial study where this is in the public interest or where necessary for the purposes of another organisation’s legitimate interests in such research, provided that your interests and fundamental rights do not override those interests. This will be done in accordance with the law and by sharing and using minimal personally identifiable information – fully anonymising it whenever possible. We will only use any personally identifiable data to the extent necessary to achieve such research purposes. 

4. How long is my personal data kept?

As outlined in section 3 above, the University of Oxford may retain your personal data for further research for which a legal basis exists, and this will always be done in accordance with data protection laws. General information about how long different types of information are retained by the University can be found in the University’s Policy on the Management of Research Data and Records (http://researchdata.ox.ac.uk/university-of-oxford-policy-on-the-management-of-data-supporting-research-outputs/). When it is no longer necessary to retain personal data, it will either be deleted or rendered anonymous (non-identifiable). 

5. What are my rights?

You have certain rights with respect to your personal data. These include being able to request access to it, correction of any mistakes in it, deletion of it, restriction of its use, as well as being able to object to any processing of it (i.e. any use of it), or request that it be transferred elsewhere.

However, depending on the circumstances, the University of Oxford may have grounds for not complying with your request, for example, where they consider that deleting your information would seriously harm the research or where they need to process your data for the performance of a task in the public interest.

For further details visit https://compliance.admin.ox.ac.uk/individual-rights. 

6. Who can i contact about the use of my data?

The Mexican data privacy statement gives details of how to exercise your rights regarding your personal data under Mexican law.

For further information about the Mexico City Prospective Study or to ask questions about how your data is used, please contact us at mcps@ndph.ox.ac.uk If you would like to exercise any of your rights under GDPR or if, for any reason, you are not happy with the way the University of Oxford has handled your data, please contact the University’s Information Compliance Team at data.protection@admin.ox.ac.uk. The same address can be used to contact the University’s Data Protection Officer.

If you are still not happy, you have the right to make a complaint to the Information Commissioner’s Office (ICO) which can be made by visiting their website (https://ico.org.uk/) or by calling their helpline (+44 303 123 1113).

Date of last update 16 March 2023. Version 1.0

The research completed by MCPS in Oxford and Mexico City, including the collection of participant data, has been approved by the Mexican Ministry of Health, The Mexican National Council of Humanities, Science and Technology, the National Autonomous University of Mexico and the University of Oxford.

BACK TO MEXICO CITY PROSPECTIVE STUDY HOMEPAGE