How we use your data

Introduction

The Medical Research Council Clinical Trials Unit at University College London (MRC CTU at UCL) has invited you to participate in the Add-Aspirin trial to test whether taking aspirin daily for 5 years after treatment for early-stage cancer (cancer that has not spread widely), stops or delays the cancer coming back.

This privacy notice explains who we are, the personal data we collect, how we use it, who we share it with, and your legal rights. This notice is in addition to UCL’s privacy policy (visit the MRC CTU at UCL's privacy policy webpage) and applies specifically to personal information held for research purposes in the Add-Aspirin trial.

We keep this Privacy Notice under regular review.

About MRC CTU at UCL

The MRC CTU at UCL is one of the UK’s leading centres for clinical trials. Our research helps to improve health care in the UK and around the world, resolving internationally important questions in infections and cancer, and delivering swifter and more effective translation of scientific research into patient benefits. The MRC CTU at UCL obtains appropriate ethical and legal approvals for all trials and studies that it runs. You can find out more about the MRC CTU here: visit the MRC CTU webpage.

The MRC CTU is part of the School of Life and Medical Sciences at UCL and is running the Add-Aspirin trial. University College London (UCL), based in the United Kingdom, is the data controller and sponsor for this study in the United Kingdom and Republic of Ireland (Tata Memorial Centre is the sponsor for the trial in India).

Collecting personal information

Personal data, or personal information, means any information about an individual from which that person can be identified. It does not include data where the identity has been removed (anonymous data). Information about your health is a special category of personal data.

To safeguard your rights we will collect the minimal personal information necessary for Add-Aspirin. We collect personal information, which includes information about your health and treatment, from the following sources:

1. Directly from you with your consent
2. From third party sources which routinely collect your health data (such as NHS Digital, other UK NHS bodies, and disease registries) with your consent. – UK Participants only

Personal information specifically collected for Add-Aspirin include clinical information/notes such as information on your cancer diagnosis and treatment, details about the cancer should it return such a location and diagnosis date, details on other clinical events that may occur during your time on the study such as a heart attack or any major bleeding events.

Using your personal information

All of the personal information we collect is only used for the purposes of carrying out our scientific research in the public interest.

UCL is the data controller for processing personal data for Add-Aspirin. This means they are responsible for ensuring that the processing of your data complies with the General Data Protection Regulation and related legislation. The lawful basis for processing personal information in Add-Aspirin is GDPR Article 6(1)(e) – “processing is necessary for the performance of a task carried out in the public interest or in the exercise of official authority vested in the controller,” and Article 9(2)(j) for special category data – “processing is necessary for archiving purposes in the public interest, scientific or historical research purposes or statistical purposes.” We demonstrate that our research serves the interests of society by following the UK Policy Framework for Health and Social Care Research (visit the HRA UK Policy Framework for Health and Social Care Research webpage).

Data linkage – For UK Participants Only

We will ask for your consent to collect your NHS number, full name and date of birth to link to your health records in databases held by NHS Digital and their successor(s). The data we receive will provide us information on your long-term health outcomes such as cancer progression, new cancers (and the treatment you may receive), other non-cancer conditions and aspirin use after the trial. Linkage to this database will enable us to better understand the long-term health issues arising in people who have early-stage cancers in the four cancer groups addressed in this study, and tailor future care accordingly.

There is more information about the trial in the Patient Information Sheet and Consent Form that you received when you joined the trial. You can also contact the research nurse or doctor at your hospital if you have any questions.

Retention and storage of your data

The CTU stores all personal identifiable data securely, and only authorised trained staff are permitted access. Your NHS number (UK participants only), full name and date of birth will be stored in the UCL Data Safe Haven until they are transferred to the NHS Digital, the data providers for linkage with your health records. The UCL Data Safe Haven is known as a Trusted Research Environment – a secure space where sensitive personal data is stored and accessed.

Your NHS number, full name and date of birth will only be used by the data providers to link to your health records in their databases so that they can extract the appropriate data for our use. The NHS number and the other personal data used for linkage are removed before the data is sent to us for analysis.

We retain personal information for as long as is necessary to support the research study and its findings, and in line with research retention schedules and regulatory requirements specific for research. For Add-Aspirin, your data will be held for at least 25 years after the end of the study.

We have put in place appropriate security measures to prevent your personal data from being accidentally lost, used or accessed in an unauthorised way, altered or disclosed. We have established procedures to deal with any suspected personal data breach and will notify you and any applicable regulator of a breach where we are legally required to do so.

NHS Digital and UCL (by MRC CTU) will access identifiable information on UK participants. There will be no access to data by other third parties not listed in this agreement. No individual participants will be directly identified through any published results from the study.

Researchers (under the supervision of UCL) who wish to access the data from this study and/or contact participants about future research will have to apply to the CTU’s Data Access Committee.

Your legal rights

You have rights over your personal information by law. Your usual rights to access, change or move your information are limited because of exceptions applicable to some types of research, and also because we need to manage your information in specific lawful ways in order for the research to be reliable and accurate.

You have the right to request the restriction or suppression of your personal data, so you have the right to withdraw your consent to data linkage at any time. Please talk to your study doctor or nurse who will then inform the trial team of your decision. Contact details for members of your study team will be listed within your Patient Information Sheet (PIS). This decision will not affect the care you receive in any way. If you do this, we will use your data up to the point that you say you no longer wish to participate.

If you would like further information or have any concerns about the use of your personal information, please contact our Data Protection Officer by email data-protection@ucl.ac.uk or by writing to University College London, Gower Street, London WC1E 6BT.